The Security Feature That’s Both Everywhere and Misunderstood
Encryption is referenced constantly in security discussions — end-to-end encryption in messaging apps, HTTPS encryption in browsers, full-disk encryption on devices, encrypted email, VPN encryption — and is widely understood to mean ‘secure’ without most users understanding specifically what each type of encryption protects against and what it doesn’t. The consequence of this vague understanding is that people sometimes feel protected when they’re not, and sometimes don’t use available encryption that would protect them in their specific situation.
Encryption is a specific technical protection against a specific threat: an adversary who can observe or access data in transit or at rest. It doesn’t protect against every category of threat, and the specific protection it provides depends on which type of encryption is in use and at which point in the data’s journey. Understanding these specifics helps evaluate which privacy and security tools are relevant to your actual situation.
What Encryption Actually Does
Encryption transforms readable data (plaintext) into an unreadable form (ciphertext) using an algorithm and a key. Only someone who has the correct key can reverse the transformation and read the original data. The strength of encryption depends on the algorithm used and the length of the key — modern standard algorithms (AES-256, ChaCha20) are computationally infeasible to break by brute force with current technology.
The type of encryption determines what it protects: encryption in transit (HTTPS, TLS) protects data while it moves between your device and a server — it protects against someone intercepting data on the network between those endpoints, but not against the server itself. Encryption at rest protects stored data if the storage medium is physically stolen or accessed without authorization. End-to-end encryption protects data such that only the sender and recipient can read it — even the service provider in the middle cannot.
Where HTTPS Protects You (and Where It Doesn’t)
The HTTPS padlock in your browser means the data transmitted between your browser and the web server is encrypted — a network observer monitoring your internet traffic can see that you’re communicating with a particular server but can’t read the content of that communication. This protects against a network-level attacker (someone at the coffee shop Wi-Fi intercepting packets, a poorly configured network router logging traffic) from seeing what you’re browsing, typing into forms, or submitting.
What HTTPS doesn’t protect: the server receiving your data still has it in readable form after receiving it. Your username, password, credit card number, and personal information that you submit to a website are visible to that website — HTTPS protects the path, not the endpoint. The website’s privacy practices, data retention, third-party sharing, and security of their own systems determine what happens to your data after it arrives.
End-to-End Encryption: The Strongest User Protection
End-to-end encryption (E2EE) in messaging apps (Signal, WhatsApp, iMessage when messaging other iMessage users) means that messages are encrypted on the sender’s device and can only be decrypted on the recipient’s device. The messaging service in between — the app’s servers that route messages — cannot read the content. Even if the company receives a legal demand for the content of E2EE messages, they can only provide encrypted ciphertext that’s meaningless without the keys that only exist on the users’ devices.
The practical implication: when you send a Signal message, Signal cannot read it. When you send a standard SMS or a non-E2EE messaging app message, the service provider can read it and may provide it to third parties under appropriate legal processes. For communications where the content of the communication is sensitive — conversations you wouldn’t want subpoenaed, messages to journalists or lawyers, personal communications you consider private — E2EE messaging provides meaningfully stronger protection than alternatives.
Full-Disk Encryption: Protection at the Physical Layer
Full-disk encryption (FileVault on Mac, BitLocker on Windows, encryption enabled by default on modern iPhones and Androids) protects the data on a device’s storage if the device is stolen, lost, or physically accessed by someone without the encryption key (typically your login password or biometric). Without the key, the storage contents are unreadable — a stolen encrypted laptop’s files cannot be accessed by reading the storage directly, even by extracting the drive and connecting it to another system.
What full-disk encryption doesn’t protect: once the device is unlocked (you’ve logged in), the encryption is transparently decrypted for normal use — at that point, any application running on the device, any malware present, and any remote attacker who has established access can read the data. Full-disk encryption is protection against physical theft and physical access; it’s not protection against attacks that occur while the device is in normal use.