Glossary Security

Encryption

Encryption is the process of scrambling data with a key so that only someone with the right key can read it.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

Symmetric encryption (AES, ChaCha20) uses one shared key and is fast, so it protects the bulk of data. Asymmetric encryption (Public-key cryptography) uses a public/private pair and solves how to share keys. Data can be encrypted at rest (on disk) and in transit (over TLS). Encryption is reversible with the key; a Hash is not. Modern schemes also add a random salt or nonce so the same message encrypts differently each time, and authenticated modes such as AES-GCM detect any change to the ciphertext.

Why it matters

The algorithm is rarely what fails; keys are. A strong cipher protected by a weak password, a key stored next to the data, or a reused nonce undoes the protection. A 128-bit key has 2^128 ≈ 3.4 × 10^38 possible values, far beyond brute force, so attackers go after the password or the endpoint instead. Use well-reviewed libraries, never home-made schemes.

Example

Encrypting the same text twice with AES-256 and a password-derived key (PBKDF2) in OpenSSL:

$ openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -a -pass pass:correct-horse -in m.txt
U2FsdGVkX19UVs27lySi5uBEaxXmFEdmWexV+HTlitw=
$ openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -a -pass pass:correct-horse -in m.txt
U2FsdGVkX1/6eiLwNOsiisq58lFoUI4SM+qLHn4xyhI=

The outputs differ because each run picks a new random salt (U2FsdGVkX1 is Base64 for Salted__). Decrypting with the wrong password ends in bad decrypt. Try it in the browser with the AES Text Encryption.

Common confusion

Base64 and other encodings are not encryption: anyone can reverse them without a key.

AdSense Placeholder
Slot: footer_leaderboard