How Encryption Works: The Technology Guarding Your Data

Every time you send a WhatsApp message, pay someone through UPI, or notice the little padlock icon next to a web address, a piece of math is working overtime in the background to make sure nobody else can read what's passing through. That math has a name: encryption. Most people trust it without ever knowing what it actually does.

What Encryption Actually Does

Strip away the jargon and encryption is just a way of scrambling information so it looks like nonsense to anyone who doesn't have the right key to unscramble it. The readable version of your data — a message, a photo, a bank balance — is called plaintext. Run it through an encryption algorithm and it becomes ciphertext: a string of characters that means nothing on its own. The "key" is a piece of code, usually generated randomly, that either locks (encrypts) or unlocks (decrypts) that data.

This isn't new technology dressed up for the internet age. Militaries and diplomats have used ciphers for centuries. What's changed is the scale: encryption now runs silently behind almost every digital interaction you have, from a phone call to a UPI transfer.

Two Flavours of Encryption You Use Every Day

There are really two approaches doing the heavy lifting, and understanding the difference clears up a lot of confusion.

• Symmetric encryption uses one key for both locking and unlocking the data. It's fast and efficient, which is why it's used for bulk data like files on your laptop's encrypted drive. The catch: both sides need the same key, so getting that key to the other person safely is a problem in itself.
• Asymmetric encryption solves that problem with a pair of keys — a public key anyone can see and share, and a private key that never leaves your device. Data locked with the public key can only be opened with the matching private key. This is what lets your browser and a website (say, your bank's) agree on a secure connection without ever having met before.

That padlock you see in your browser's address bar means the site is using HTTPS — a version of the standard web protocol (HTTP) wrapped in an encrypted layer called TLS. In practice, most secure systems use both types together: asymmetric encryption to safely exchange a temporary key, then symmetric encryption to actually move the data quickly.

Encryption doesn't make data unreadable forever — it makes reading it without the key so slow and expensive that, for all practical purposes, nobody bothers trying.

Why This Matters More for Indian Users Right Now

India runs an unusually large share of daily life through digital rails — UPI alone processes billions of transactions a month, and apps like WhatsApp are the default way families and small businesses communicate. End-to-end encryption, where even the app provider can't read your messages, is the reason a WhatsApp chat with your bank's customer care or a UPI PIN entry isn't sitting somewhere in plaintext waiting to be leaked.

This is also why encryption has become a live policy question in India. The Digital Personal Data Protection (DPDP) Act, which governs how companies must handle Indian users' personal data, leans heavily on the assumption that firms are securing that data properly — encryption is one of the baseline expectations regulators and security auditors look for when a company claims it's protecting user information. If you want the fuller picture of what that law requires from companies handling your data, we've covered it in our DPDP Act explainer. For everyday users, the practical upshot is simple: an app or bank that can't explain how it encrypts your data in transit and at rest is one you should be cautious about trusting with anything sensitive.

What You Can Actually Do With This

You don't need to understand elliptic curves to benefit from encryption, but a few habits make a real difference:

1. Check for HTTPS (the padlock) before entering a password or card number on any site.
2. Turn on device encryption in your phone's security settings — most modern Android and iOS phones do this by default, but it's worth confirming.
3. Prefer apps that clearly state they use end-to-end encryption for anything sensitive — banking, health, or messaging.
4. Be wary of any service that stores your password in a way that lets customer support "read it back" to you — that's a sign it isn't properly hashed or encrypted at all.

Encryption is one of the rare pieces of technology that works best when you never notice it. The goal isn't to become a cryptographer — it's to recognise the signals that tell you it's actually switched on, and to be a little suspicious of the services where it clearly isn't.