Encryption is the process of scrambling data into an unreadable format so that only someone with the correct key can decode it. It sits quietly behind almost every digital interaction you have: online banking, email, messaging apps, cloud storage, and even the lock screen on your phone. Without it, your personal information would travel across the internet as plain text, visible to anyone willing to intercept it.
How encryption actually works
At its core, encryption uses a mathematical algorithm to transform readable data, called plaintext, into a scrambled version called ciphertext. To reverse the process, you need a key: a unique string of data that tells the algorithm how to unscramble the message. The longer and more complex the key, the harder it is to crack.
There are two main types in common use today.
Symmetric encryption uses a single key to both lock and unlock the data. It's fast and efficient, which makes it well-suited for encrypting large files or database contents. The catch is that both parties need to share that same key securely, which creates a distribution problem. If someone intercepts the key during the handoff, the encryption is worthless.
Asymmetric encryption solves that problem by using two mathematically linked keys: a public key and a private key. Anyone can use your public key to encrypt a message to you. Only your private key, which never leaves your device, can decrypt it. This is the system behind HTTPS, the padlock you see in your browser's address bar. When you connect to your bank's website, your browser and the bank's server exchange public keys and establish a secure channel before a single byte of your account data is transmitted.
What encryption protects you from
The most immediate threat encryption guards against is interception. On an unencrypted connection, a person on the same Wi-Fi network as you can capture your traffic with freely available software. Encryption means the captured data is useless without the key.
It also protects data at rest. A laptop stolen from a café is a disaster if the drive isn't encrypted. With full-disk encryption enabled, the thief has a box of unreadable noise. Both Windows (via BitLocker) and macOS (via FileVault) offer this as a built-in feature.
End-to-end encryption, used by apps like Signal, goes a step further. The messages are encrypted on your device and only decrypted on the recipient's device. Not even the app provider can read them. This is why governments periodically push to require "backdoors" into encrypted apps, and why security researchers consistently argue that backdoors weaken the system for everyone.
Encryption standards you'll actually encounter
AES-256 is the gold standard for symmetric encryption. The "256" refers to the key length in bits. A 256-bit key has 2256 possible combinations. Brute-forcing it with current computing power would take longer than the age of the universe. AES-256 protects everything from classified government files to your password manager's vault.
RSA is the most widely used asymmetric algorithm. You'll also see ECC (Elliptic Curve Cryptography) becoming more common, particularly on mobile devices, because it achieves equivalent security with shorter keys and uses less processing power. That matters when you're running on a phone battery.
TLS (Transport Layer Security) is the protocol that wraps HTTPS connections. TLS 1.3, released in 2018, is now the recommended version. It's faster and removes several older cipher suites that had known vulnerabilities. If you're running a website or managing a server, supporting TLS 1.3 isn't optional at this point.
Common misconceptions worth clearing up
A padlock in your browser means the connection is encrypted. It does not mean the website is trustworthy or legitimate. Phishing sites can and do use HTTPS. The encryption protects data in transit; it says nothing about what the site does with that data once it arrives. Phishing attacks have grown more convincing precisely because encrypted URLs now look identical to legitimate ones at a glance.
Encryption also doesn't protect you from malware already running on your device. If an attacker has installed a keylogger, it captures your keystrokes before encryption ever happens. That's why device security and encryption work together, not as substitutes for each other.
Some people assume that using a VPN means their data is always encrypted end-to-end. A VPN encrypts traffic between your device and the VPN server, but from that server to the destination website, the connection depends on whether the site itself uses HTTPS. A VPN and HTTPS serve different purposes and are stronger together.
Why everyday Australians should care
Australia's data breach statistics make the case plainly. The Office of the Australian Information Commissioner regularly reports hundreds of notifiable data breaches per year, with malicious or criminal attacks consistently the leading cause. Encryption won't stop every breach, but it ensures that stolen data is useless to the attacker if the files themselves are encrypted.
For individuals, the most practical steps are: enable full-disk encryption on your laptop and phone, use apps with end-to-end encryption for sensitive conversations, check for HTTPS before entering any personal information, and use a reputable password manager (which encrypts your vault locally). Pairing these habits with two-factor authentication on your key accounts closes off the most common attack paths.
Encryption isn't a silver bullet, but it's one of the few defences that genuinely raises the cost of an attack. When your data is properly encrypted, a breach becomes a logistical problem for the attacker rather than an instant windfall.