You Sent a Secret This Morning. You Just Didn't Notice.

You woke up, rolled over, and sent a text. Maybe you checked your bank balance. Maybe you sent a photo you would not exactly frame and hang in the hallway.

Every one of those moments quietly used encryption — the hardest-working security tool on your phone, and the one nobody ever thinks about.

So what is it actually doing?

Encryption means scrambling with a key

Encryption encodes — scrambles — information so that unauthorized people can't read it, according to the Canadian Centre for Cyber Security. The scrambled version is nonsense until a key turns it back into something readable.

Picture it with three people, the way the Cyber Centre explains it. Alice wants to send Bob a message only he can read, so she encrypts it with a secret key. An eavesdropper — the Cyber Centre calls her Eve — intercepts a copy on its way across.

Eve is stuck. She has the message, but without the key, it's gibberish.

That's the whole trick: the message can cross networks nobody fully controls and still arrive a secret.

One key, or two? The padlock problem

The simplest version uses one shared key. NIST, the U.S. standards body, defines a symmetric key algorithm as one that uses the same secret key for an operation and its reverse — the same key encrypts and decrypts.

Think of it as a house key. You and your sister each hold a copy. Either copy locks the door, and either copy opens it.

But there's a catch. How do you get your sister her copy in the first place? Mail it, and anyone along the way could copy it.

That problem is exactly why a second system exists.

Asymmetric encryption uses a pair of keys instead: a public key and a private key. NIST describes the pair this way: the private key is kept secret, and given the public key, it is computationally infeasible to work out the private one.

The everyday picture: a mailbox. The mail slot is your public key — anyone can drop a letter in. The key that opens the box is your private key, and only you hold it. Anyone can send you something private. Only you can open it and read it.

No shared secret has to travel first. That's the breakthrough that makes secure communication between strangers — you and a website you've never visited — possible.

What "end-to-end" really means in your chat app

Not all messaging encryption is equal, and the Cyber Centre draws a line worth knowing.

In some apps, messages are encrypted between your device and the messaging company's cloud storage. Private on the road — but the company sits in the middle of the conversation.

In others, messages are encrypted from your device straight to the recipient's device. That's end-to-end encryption, and the Cyber Centre is blunt about what it means: not even the messaging service provider can read your encrypted messages.

Moving data, sitting data — both get scrambled

Encryption guards your information in two states.

In transit means while it's moving. When you connect to your bank's website from your laptop or phone, the data exchanged between your device and the bank is encrypted, the Cyber Centre notes.

At rest means while it's stored. Information in an encrypted database is kept in an unreadable format — so even if someone gets into the database, there's an additional layer of security between them and your data.

The padlock, honestly explained

You've seen it a thousand times: the little padlock beside a web address that starts with HTTPS.

Here is what it actually certifies, per the Cyber Centre: if a site has the padlock icon and HTTPS in front of its address, the communication — the data exchanged between your device and that website's servers — is encrypted.

That's it. The padlock vouches for the connection — nothing more.

What it does not do is vouch for the honesty of whoever is on the other end. Encryption protects the trip your information takes. It was never designed to judge the destination.

What encryption cannot save you from

This is the part the padlock can't fix. The Cyber Centre is clear that encryption is just one of many security controls needed to protect data — and three gaps matter most:

  • Phishing. A scammer texts, calls or emails you pretending to be a brand you trust, hoping you'll click a malicious link, download malware, or hand over sensitive information. Type your password into the fake page yourself, and encryption faithfully protects it — all the way to the criminal.
  • Weak or reused passwords. The Cyber Centre warns that threat actors can easily get into accounts protected by easy-to-guess passwords, or the same password used on different accounts. Encryption can't rescue a password like that. Multi-factor authentication can help — it protects your account even if your password is compromised.
  • A compromised device. Encryption guards messages on the journey and files in storage. Malware already on your phone operates where messages are written and read — in plain form. That's why the Cyber Centre pairs encryption with basics like keeping systems updated and patched.

The Twikup Take

Encryption is why your texts, logins and card numbers can cross the open internet as gibberish to everyone except the person they were meant for. Respect the padlock — but remember it only promises a private trip, not an honest destination. The lock is math. The judgment is still yours.

The strongest setup is boring: end-to-end encrypted apps, a unique passphrase for every account, and multi-factor authentication turned on.

Image: AI-generated illustration.

Sources