What Is Encryption and How Does It Protect Your Data?

You lock the office door at night without thinking about it. Encryption is the digital version of that lock, and it is already working for you dozens of times a day: when you log in to your bank, when your phone sits locked on a desk, and when an email crosses the internet.

The trouble is that most people don’t know where encryption is switched on, where it isn’t, and who holds the key. Those 3 questions decide whether a lost laptop is a minor annoyance or a reportable data breach. This guide explains how encryption works, the difference between encryption at rest and in transit, and what to check on the devices and services your business already uses.

What encryption actually does

Encryption turns readable data (called plaintext) into scrambled data (called ciphertext) using an algorithm and a key. Without the right key, the ciphertext looks like random noise. With the key, it turns back into the original data. That reverse step is decryption.

A simple way to picture it:

• The algorithm is the design of the lock. It is public, tested and standardized.
• The key is the secret. Security depends on keeping it private, not on hiding the algorithm.
• The ciphertext is what an attacker sees if they steal the data without the key.

This is why security experts say “protect the keys.” Strong encryption with a key written on a sticky note, or stored next to the data, protects very little.

Symmetric vs asymmetric encryption

There are 2 main families of encryption, and most real systems use both.

Symmetric encryption uses the same key to encrypt and decrypt data. It is fast, so it handles the heavy lifting of encrypting files, disks and network traffic. The most widely used symmetric algorithm is the Advanced Encryption Standard (AES), published by the US National Institute of Standards and Technology (NIST) as FIPS 197 in 2001 and updated in 2023. AES uses keys of 128, 192 or 256 bits.

Asymmetric encryption (also called public-key cryptography) uses a pair of keys: a public key anyone can use to encrypt or verify, and a private key only the owner holds to decrypt or sign. It solves the hardest problem in encryption: how 2 parties who have never met agree on a secret key over a public network.

When you visit a secure website, asymmetric cryptography sets up the connection and agrees on a session key, then symmetric encryption protects the actual data. You get the safety of one and the speed of the other.

Encryption in transit: protecting data on the move

Encryption in transit protects data while it travels between 2 points, such as your browser and a website, or one email server and another. Without it, anyone on the same network path, like a public Wi-Fi hotspot, could read or tamper with the traffic.

Websites and HTTPS

The padlock and “https://” in your browser mean the connection uses Transport Layer Security (TLS). The current version, TLS 1.3, was published by the Internet Engineering Task Force as RFC 8446 in August 2018. It is designed to prevent eavesdropping, tampering and message forgery between a client and a server.

One important limit: HTTPS proves the connection is encrypted, not that the website is honest. Phishing sites can and do use HTTPS. The padlock tells you nobody in the middle can read your password. It doesn’t tell you whether you should type it there.

Email

Email is a good example of encryption in transit with gaps. Google says all Gmail messages use TLS automatically, but that protection depends on the recipient’s email provider also supporting TLS. Gmail marks messages it could not send with encryption with a red open lock and advises against sending sensitive information in them.

TLS protects the hop between mail servers. It doesn’t stop the email providers on either end from reading stored messages. For stronger protection, Google offers S/MIME and client-side encryption for eligible work and school accounts, where messages stay encrypted with keys the sender and recipient (or their organization) control.

Encryption at rest: protecting stored data

Encryption at rest protects data where it is stored: a phone, a laptop drive, a USB stick, a server or a cloud bucket. Its main job is protecting you when a device is lost or stolen, or when someone gets physical access to storage.

Phones

Modern phones encrypt by default, but the passcode is what makes it strong.

• iPhone: Apple’s Platform Security guide says setting a passcode automatically turns on Data Protection. Each file is encrypted with its own 256-bit key using a hardware AES engine, and those keys are protected by keys tied to your passcode. A longer passcode means stronger protection.
• Android: Google requires all devices launching with Android 10 or later to use file-based encryption, which Android has supported since version 7.0.

A phone with no passcode, or “1234,” gives the encryption very little to work with. Use at least a 6-digit code, and turn on auto-lock.

Laptops and desktops

On Windows, Microsoft’s Device Encryption turns on BitLocker for the system drive and is available on a wider range of devices, including Windows Home. Full BitLocker management is included in Pro, Enterprise and Education editions. Microsoft notes that Device Encryption turns on automatically when you sign in with a Microsoft account or a work or school account, and the recovery key is linked to that account. With a local account, it is not turned on automatically. On a Mac, the built-in tool is FileVault.

Check this today: on Windows go to Settings > Privacy & security > Device encryption. On a Mac, open System Settings > Privacy & Security > FileVault.

Cloud storage

Cloud providers usually encrypt data at rest, but the key question is who holds the keys. Apple is a clear example. Under its default “standard data protection,” iCloud data is encrypted in transit and at rest, but Apple holds the keys for many categories, which lets it help you recover data. Some categories, including iCloud Keychain passwords and Health data, are end-to-end encrypted by default. With the optional Advanced Data Protection, most iCloud data, including iCloud Backup and Photos, becomes end-to-end encrypted, and Apple can no longer help you recover it if you lose access. For a deeper look at storage options, see our phone backup guide.

Key takeaway: Encryption is only as strong as the way its keys are handled. Turn on device encryption, use a strong passcode, store recovery keys somewhere safe and separate, and know which of your cloud services hold a copy of your keys.

End-to-end encryption

End-to-end encryption (E2EE) means only the sender and recipient can decrypt the content. The service in the middle carries the scrambled data but doesn’t have the keys. Messaging apps such as Signal, WhatsApp and iMessage use end-to-end encryption for messages.

The difference matters when a service gets breached or receives a legal request. With standard encryption at rest, the provider can decrypt your data. With E2EE, the provider generally can’t, because it never had the key.

The trade-off is recovery. If you lose your devices and recovery key under an end-to-end system, nobody can restore your data for you. That is why it is wise to set up recovery contacts or keys before you need them.

Encryption in business: what laws and customers expect

Many US rules treat encryption as a baseline control. The Federal Trade Commission’s amended Safeguards Rule under the Gramm-Leach-Bliley Act, with most new requirements effective June 9, 2023, requires covered financial institutions, which includes many tax preparers, auto dealers and lenders, to encrypt customer information held or transmitted both in transit over external networks and at rest. The official text is in 16 CFR Part 314 on eCFR. Health data rules and state privacy laws also reward encryption, and many state breach notification laws treat properly encrypted data differently from unencrypted data. Our state data privacy laws guide covers the state picture. This is not legal advice.

Customers and partners increasingly expect it too. Cyber insurers commonly ask whether laptops are encrypted, and security questionnaires from larger clients almost always do.

Where to start: a 7-step encryption checklist

You don’t need a cryptography degree to get the basics right. Work through these steps this week:

1. Turn on device encryption on every company laptop and desktop (BitLocker or Device Encryption on Windows, FileVault on Mac).
2. Require phone passcodes of at least 6 digits on every phone that touches work email or files.
3. Save recovery keys safely. Store BitLocker and FileVault recovery keys in your management console or a business password manager, never on the same device.
4. Use HTTPS everywhere. Make sure your own website redirects all traffic to HTTPS and its certificate renews automatically.
5. Encrypt sensitive email. Use your email platform’s encryption or a secure file-sharing link for tax forms, contracts and health information.
6. Encrypt backups and USB drives. Backups are a full copy of your data, so they deserve the same protection.
7. Strengthen logins. Encryption won’t help if an attacker logs in as you. Add passkeys or two-factor authentication to email and cloud accounts.

What encryption can’t do

Encryption is powerful, but it isn’t a full security plan. It won’t stop:

• Phishing: if someone tricks you into entering your password, they get access to decrypted data.
• Malware on a signed-in device: once you sign in to a laptop, its files are readable to anything running on it.
• Ransomware: criminals use encryption against you by encrypting your files and demanding payment. See our guide to ransomware protection.
• Weak access controls: if everyone has access to everything, encryption at rest doesn’t limit what a compromised account can see. A zero trust approach helps here.

Layer encryption with strong logins, updates, backups and a firewall at the network edge.

The future: post-quantum encryption

Large future quantum computers could break some of today’s asymmetric encryption. To prepare, NIST approved its first 3 post-quantum cryptography standards on August 13, 2024: FIPS 203 (ML-KEM) for general encryption and key establishment, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures.

For most small businesses, this transition will arrive through software updates from browser, operating system and cloud vendors, not as a project you run yourself. Keeping systems updated is the main action item. If you want the bigger picture, read what businesses should know about quantum computing.

Conclusion

Encryption is the quiet lock behind nearly everything you do online. In transit, it keeps people on the network from reading your traffic. At rest, it keeps a lost phone or stolen laptop from becoming a breach. The basics are already built into the devices you own; your job is to make sure they are switched on, protected by strong passcodes and backed by recovery keys you can actually find. For more terms like TLS and AES, browse our glossary.

Sources

• NIST: FIPS 197, Advanced Encryption Standard (AES) — AES key sizes and standard history
• IETF: RFC 8446, The Transport Layer Security (TLS) Protocol Version 1.3 — TLS 1.3 publication and purpose
• NIST: Announcing approval of three FIPS for post-quantum cryptography — FIPS 203, 204 and 205 approval in August 2024
• Apple: iCloud data security overview — standard data protection vs Advanced Data Protection
• Microsoft: Device encryption in Windows — Device Encryption, BitLocker editions and recovery keys
• Google Gmail Help: Email encryption in transit — TLS, S/MIME and lock icons in Gmail