Encryption is the process of converting data into ciphertext using a cryptographic algorithm and key, so authorized recipients can recover the original data.

It protects confidentiality when data is stored or transmitted. A customer document can remain unreadable to someone who obtains the storage media, provided that person cannot also obtain the decryption key. Encryption’s value therefore depends on how keys and access to decrypted data are controlled.

How encryption works

An encryption algorithm transforms plaintext into ciphertext under a key. Decryption uses the corresponding keying material to recover the plaintext. Established cryptographic libraries implement these operations and the surrounding requirements, including appropriate randomness where needed.

Symmetric encryption uses a shared secret key for encryption and decryption and is efficient for protecting large amounts of data. Asymmetric techniques use a public/private key pair. In many practical systems, asymmetric cryptography helps establish or protect a symmetric key, which then encrypts the actual content.

Confidentiality alone does not prove that data has not been changed. Authenticated encryption combines confidentiality with an integrity check. Applications should use a suitable established construction rather than assembling separate cryptographic operations without expert design.

Data at rest and data in transit

Encryption at rest protects stored data, such as files or database contents. Full-disk encryption addresses access to storage media, while application-level encryption can provide a different boundary around particular fields. Neither should be assumed to stop an application that already has authorized decryption access from exposing information.

Encryption in transit protects data moving between endpoints. HTTPS uses Transport Layer Security (TLS) for this purpose, together with endpoint authentication. If a reverse proxy terminates TLS, the connection from that proxy to the application needs its own protection decisions.

For an insurance portal, encrypted document storage can limit the impact of stolen disks. It does not prevent a compromised customer account from downloading documents the account is allowed to view. Authentication and resource-level authorization remain necessary.

Key management determines the protection boundary

Keys need restricted access and a managed lifecycle. A backup that stores readable data or exposes keys can undermine protection applied to the main system. Rotation and recovery procedures should be designed before an incident, including how older encrypted records remain available to authorized users.

Hashing serves a different purpose: it creates a digest without a decryption operation. Password verification normally uses dedicated password hashing. Tokenization substitutes another value for sensitive data and may use encryption within its implementation.

Frequently asked questions

Is encrypted data impossible to steal?

No. Attackers can copy ciphertext or obtain plaintext through compromised keys and authorized applications. Encryption reduces exposure within a defined threat model.

Should passwords be encrypted for storage?

Ordinary password verification should use an appropriate salted password-hashing function. Reversible encryption creates an unnecessary path to recovering every stored password if the key is compromised.

Does encryption replace access control?

No. Access control determines who may request or use data, including decrypted data. Encryption protects confidentiality under the assumptions of its design and key management.

Related: Data Breach · API Security · Credential Management · Man-in-the-Middle Attack · Authorization · Principle of Least Privilege