What Is Cryptography? Encryption, Keys, Hashes, and Everyday Examples

Cryptography is the set of mathematical methods used to protect information. Those methods keep data private, show when data has been changed, confirm who sent a message, and let two parties trust each other over a network they do not control. You use it every time a browser opens an HTTPS site, when a software update is signed, or when a website checks your password without storing it in plain text.

Encryption is one tool inside cryptography, and the field is larger than that.

#Encryption turns readable data into unreadable data

Encryption takes plaintext and a key, runs them through an algorithm, and produces ciphertext. Someone who holds the right key can reverse the process. Someone who does not should get nothing useful from the ciphertext.

A lock makes a useful comparison. The mechanism is the algorithm, and the key is the one object that opens it. The comparison breaks down quickly, because a software key is a number, not a piece of metal. It still separates two things people often mix up: the method, which can be public, and the secret value, which must stay private.

Kerckhoffs's principle, written in the nineteenth century, says a system should remain secure even when everything about it except the key is known. Modern cryptographic designs follow that rule. If a design only works while the algorithm stays hidden, treat it with suspicion.

#Symmetric and asymmetric encryption

With symmetric encryption, one secret key both encrypts and decrypts. AES is the standard symmetric block cipher, specified by NIST in FIPS 197. Symmetric encryption is fast, so it handles most of the bulk data in a system. The hard part is getting both sides to hold the same key without an attacker seeing it.

Choosing AES is only the first decision. The mode of operation, the handling of nonces, and whether the ciphertext is authenticated all change whether the design is safe. "We use AES" is a starting point, not an explanation.

With asymmetric cryptography, each party has a key pair: a public key that anyone may see and a private key that stays with its owner. Asymmetric schemes let two parties agree on a shared secret over an open channel and let a signer prove that they hold a private key. TLS 1.3 uses asymmetric operations in its handshake to agree on keys and check the server's identity, then switches to symmetric encryption for the data. RFC 8446 describes this design.

#Hashing is not encryption

A cryptographic hash function takes input of any length and returns a digest of fixed length. SHA-256, specified in FIPS 180-4, always returns 256 bits. A good hash makes it infeasible to find two inputs with the same digest, and it makes it infeasible to recover the input from the digest. There is no key and no decryption step.

Hashes are useful for integrity checks. If the digest of a downloaded file matches the value published by its vendor, the file is very likely the one the vendor published. Hashes also appear inside signatures and many other protocols.

Passwords need more than a plain hash. A fast function such as SHA-256 lets an attacker test a huge number of guesses per second on suitable hardware. The OWASP Password Storage Cheat Sheet recommends a deliberately slow, memory-hard function such as Argon2id, with a unique salt for each password and parameters set for your hardware. RFC 9106 defines Argon2.

#Encoding is not encryption

Base64 turns binary data into text characters so it can pass through systems that expect text. The transformation needs no secret, so anyone can reverse it. Encoding exists to make data portable, not to hide it. The three ideas solve different problems:

• Encoding changes the format, and anyone can reverse it.
• Encryption hides the content, and only the key holder can reverse it.
• Hashing produces a fingerprint of the content, and it is not meant to be reversed.

#The Caesar cipher: a good lesson, a poor lock

The Caesar cipher shifts every letter by the same amount. With a shift of three, A becomes D, H becomes K, and so on. It is a substitution cipher, and it already contains the core vocabulary: plaintext, key, ciphertext and algorithm.

It fails on real data for a simple reason. The alphabet has 26 letters, so only 25 shifts change the text. A computer tries all of them instantly, and a person can test them on paper. Letter frequencies in a long message give the shift away even faster. That is why the cipher is a classroom exercise and not a protection.

The commands below ran in Git Bash on Windows 11, using its tr, sha256sum and base64. Run them yourself on your own machine. Do not paste real passwords or confidential text into any website to test them.

#Shift a message forward and back

printf 'HELLO' | tr 'A-Z' 'D-ZA-C'

Output:

KHOOR

Reverse the shift:

printf 'KHOOR' | tr 'D-ZA-C' 'A-Z'

Output:

HELLO

#See how a hash reacts to one changed letter

printf 'HELLO' | sha256sum | cut -d' ' -f1
printf 'HELLP' | sha256sum | cut -d' ' -f1

Output:

3733cd977ff8eb18b987357e22ced99f46097f31ecb239e878ae63760e83e4d5
d37f1f826f924dcd23aacbdc875edd4808b9e118d35adb9dce1c80cb23c4a9c1

Changing one letter changes the whole digest. Nothing in the output lets you recover HELLO. To check a guess, you hash the guess and compare the result.

#Encode without encrypting

printf 'HELLO' | base64

Output:

SEVMTE8=

Anyone who sees SEVMTE8= can decode it. Treat it as a format, not as a secret.

#Common mistakes

• Calling encoded data "encrypted". Base64 provides no confidentiality.
• Treating a hash as a reversible container. A hash cannot give you the original password back. You can only test candidates against it.
• Storing passwords with a fast hash, or with no salt.
• Writing your own cipher or protocol. Use well-reviewed libraries and standard protocols, and follow their guidance on modes and parameters.
• Assuming that encryption alone makes data safe. Key storage, access control and the software around the cipher often decide the outcome.

#What to learn next

Start with the basic goals of security, confidentiality, integrity and availability, from the article on cybersecurity basics. After that, read the article on the Caesar cipher, which goes deeper into substitution and frequency analysis. Then study hashing, symmetric keys and TLS, using the primary sources listed with this article instead of summaries.

Practice on your own machine, with synthetic data, or in a lab you own or have written permission to test.