---
title: "What Is Encryption? Symmetric vs Asymmetric Explained"
description: "Encryption turns readable data into ciphertext that only the holder of the right key can read. How it works, symmetric vs asymmetric, and where you use it."
url: https://proxynet.io/blog/what-is-encryption
date: 2026-11-15
author: "Acar Diveroli"
category: "Proxies"
lang: en
---

# What Is Encryption? Symmetric vs Asymmetric Explained

You pay for a pair of shoes on your phone in a café. The card number crosses the café's Wi-Fi, its internet provider and several networks you will never hear of, and any of them could copy the data passing through. What stops them from reading the number is encryption, the same idea that protects a voice message to a friend and the files on a laptop left behind on a train.

This post explains what encryption is, how a key turns text into ciphertext and back, and how symmetric and asymmetric encryption differ. It then separates encryption from hashing and encoding, shows where your data is encrypted in transit, at rest and end to end, how to check a site in your browser, and what a proxy can see.

> **Note: Short answer**
>
> Encryption turns readable data (plaintext) into unreadable data (ciphertext) with an algorithm and a key, so that only someone holding the right key can turn it back. Symmetric encryption, such as AES, uses one shared secret key and protects the bulk of your data. Asymmetric encryption, such as RSA and elliptic-curve cryptography, uses a public key anyone may have and a private key only its owner keeps; it lets two strangers agree on a secret key and prove who they are. HTTPS combines both. Hashing and encoding are different things: a hash cannot be reversed, and an encoding such as Base64 can be reversed by anyone.

## What is encryption?

Encryption is the process of changing plaintext into ciphertext with a cryptographic algorithm and a key; that is how NIST, the US agency that publishes cryptography standards, defines it. **Plaintext** is any readable data: a message, a photo, a password. **Ciphertext** is the scrambled result, which looks like random bytes. **Decryption** turns it back into plaintext.

The **algorithm**, or cipher, is the method, and it is usually public. The **key** is the secret value that makes each result different. Modern security assumes an attacker knows the algorithm and lacks only the key, which is why millions of people can use the same cipher without reading each other's data.

The idea is old. The Roman historian Suetonius wrote that Julius Caesar replaced each letter of his private letters with the one three places further down the alphabet, D for A, so `HELLO` becomes `KHOOR`. With only 25 possible shifts, this "Caesar cipher" is a puzzle today, not protection.

## How does encryption work?

Encryption mixes the plaintext with a key through mathematical steps that are quick to run with the key and impractical to undo without it:

1. **You start with plaintext,** for example "Meet at 6".
1. **A key is created:** for a modern cipher, a random number of 128 or 256 bits generated by the device.
1. **The algorithm combines plaintext and key.** In a quick test with AES-256, "Meet at 6" came out as the bytes `cfdde2cd1a3e1d8c0d`; a new key gives entirely different bytes.
1. **The ciphertext travels or is stored.** Networks, servers and disks in between handle only scrambled bytes.
1. **The recipient decrypts it** with the right key. A wrong key gives noise or an error.
1. **Tampering is detected.** Current schemes add a check value, so ciphertext changed on the way fails to decrypt instead of producing an altered message.

The hard part is usually the key: who has it, where it is kept and how it reached the other side. That last question splits encryption into two families.

## What is symmetric encryption?

Symmetric encryption uses the same secret key to encrypt and to decrypt. Both sides need an identical copy of the key, and anyone else who obtains it can read everything.

The standard example is AES, the Advanced Encryption Standard, which NIST published as [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) in 2001. It works on 128-bit blocks and comes as AES-128, AES-192 and AES-256, the number being the key length in bits. Symmetric ciphers are fast, so they encrypt nearly all real data: web pages, video calls, disks. Their weak point is the handover: you cannot simply send a website a secret key over the very network you are trying to protect.

## What is asymmetric encryption?

Asymmetric encryption, also called public-key cryptography, uses two related keys: a **public key** anyone may have and a **private key** its owner never shares. NIST's definition names the property everything rests on: working out the private key from the public key is computationally infeasible.

That solves the handover. A website publishes its public key; your browser uses it to set up a shared secret that only the site, holding the private key, can complete. The same pair makes **digital signatures**: the owner signs with the private key and anyone can check the signature with the public key, which is how a site proves it is the site in the address bar.

The best-known algorithms are RSA, named after Rivest, Shamir and Adleman, and elliptic-curve cryptography (ECC), whose key exchange is one of the methods TLS 1.3 uses. Asymmetric operations are much slower than symmetric ones, so they handle short jobs: agreeing on keys and signing.

## Symmetric vs asymmetric encryption: what is the difference?

Symmetric encryption shares one secret key, while asymmetric encryption uses a public and a private key. In practice they work as partners.

| Feature | Symmetric | Asymmetric |
|---|---|---|
| Keys | One shared secret key | Public key + private key |
| Examples | AES | RSA, ECC |
| Speed | Fast, suits large data | Slow, suits short tasks |
| Main job | Encrypting the data | Key agreement, signatures |
| Weak point | Getting the key across safely | Keeping the private key private |

When your browser opens an HTTPS site, asymmetric cryptography checks the site's certificate and lets both sides agree on a fresh session key; from then on, symmetric encryption protects the page and everything you send. Messaging apps follow the same pattern.

## Encryption, hashing and encoding: what is the difference?

Encryption can be reversed with the key, hashing cannot be reversed at all, and encoding can be reversed by anyone. People mix them up because all three turn text into strings that look random.

| Method | Reversible? | Needs a key? | Used for |
|---|---|---|---|
| Encryption (AES, RSA) | Yes, with the key | Yes | Keeping data secret |
| Hashing (SHA-256) | No | No | Passwords, file checks |
| Encoding (Base64) | Yes, by anyone | No | Fitting data into text |

A **hash function** turns any input into a fixed-length fingerprint and is one-way: finding an input that produces a given hash is computationally infeasible. One changed letter changes the whole fingerprint; the SHA-256 hash of `hello` begins `2cf24dba`, that of `Hello` begins `185f8db3`. That is why NIST's password guidance requires services to store passwords salted and hashed: the site can check what you type without keeping the password.

**Encoding** only changes the format. Base64 turns `user:pass` into `dXNlcjpwYXNz`, and any computer turns it straight back. The Base64 standard itself says it hides information visually but provides no confidentiality.

## Encryption in transit, at rest and end to end: what is the difference?

The three terms say where your data is protected: on the way (in transit), on a storage device (at rest), or along the whole path from sender to recipient, with nothing in the middle able to read it (end to end).

| Type | Protects | Who can read it | Example |
|---|---|---|---|
| In transit | Data on the network | You and the server | HTTPS |
| At rest | Data on a disk or phone | Whoever unlocks the device | BitLocker, FileVault |
| End to end | Messages between people | Only sender and recipients | WhatsApp chats |

### In transit: HTTPS and TLS

Encryption in transit protects data between your device and a server; on the web, TLS (Transport Layer Security) does it for every `https://` address. TLS 1.3 is specified in [RFC 9846](https://www.rfc-editor.org/rfc/rfc9846), which replaced RFC 8446 in July 2026 without changing the version number. It promises that the server is always authenticated, that data after the handshake is visible only to the two ends, and that nobody can change it unnoticed. Each connection also gets its own keys, so a server key stolen later cannot decrypt traffic recorded earlier; this is called forward secrecy.

Authentication rests on the site's certificate, a digital ID signed by a certificate authority your browser trusts. When that check fails, the browser stops before sending anything; what its warning codes mean is in [Your Connection Is Not Private Error: Causes and Fixes](/blog/your-connection-is-not-private).

### At rest: BitLocker, FileVault and phones

Encryption at rest protects stored data, so a lost or stolen device gives a stranger only ciphertext. Your sign-in unlocks the key: a laptop that is shut down is protected, one left open and signed in is not.

- **Windows:** according to Microsoft's page on [device encryption in Windows](https://support.microsoft.com/en-us/windows/device-encryption-in-windows-cf7e2b6f-3e70-4882-9532-18633605b7df), device encryption turns BitLocker on automatically, Windows Home included; Pro, Enterprise and Education also offer full BitLocker Drive Encryption. Check **Settings > Privacy & security > Device encryption**.
- **Mac:** a Mac with Apple silicon or a T2 Security Chip encrypts its data automatically, and FileVault adds the requirement of your login password. Apple's [FileVault guide](https://support.apple.com/guide/mac-help/mh11785/mac) uses **Apple menu > System Settings > Privacy & Security > FileVault**.
- **iPhone and Android:** setting a passcode on an iPhone turns on Apple's Data Protection; current Android devices use file-based encryption.

Encryption has no spare key for the owner, so know where your **recovery key** is. Microsoft attaches the device-encryption recovery key to the Microsoft account you sign in with; FileVault creates a recovery key or lets you unlock with your iCloud account.

### End to end: WhatsApp and other messengers

End-to-end encryption means a message is encrypted on the sender's device and decrypted only on the recipients' devices, so the service in the middle carries ciphertext it cannot read. Encryption in transit alone ends at the company's server.

WhatsApp's help page [About end-to-end encryption](https://faq.whatsapp.com/820124435853543) lists messages, photos, videos, voice messages, documents, live location, status updates and calls as protected by the Signal encryption protocol, automatically and with no setting to turn on; no one outside the chat, "not even WhatsApp", can read them. To check a chat, open the contact's info screen and tap **Encryption**: both phones should show the same QR code and 60-digit security code. It protects the trip, not the ends: anyone holding your unlocked phone can still read the messages.

## How do you check that a website's connection is encrypted?

Look at the symbol to the left of the web address: Chrome's default symbol means the page came over encrypted HTTPS, while **Not secure** means plain HTTP that anyone on the path could read.

1. Select the symbol to the left of the address.
1. **Connection is secure** means TLS is working.
1. Select that line, then **Certificate is valid**, to see who the certificate belongs to, who issued it and when it expires.
1. If the bar says **Not secure**, do not type passwords or card numbers on that page.

Other browsers place a similar symbol in the same spot. It proves the line to the site is private, not that the site is honest: a fake shop can hold a valid certificate for its own look-alike address.

## Does a proxy see your encrypted traffic?

A proxy sees which site you connect to and how much data passes, but not the content of an HTTPS page. For a secure site, the browser sends the proxy a `CONNECT` request naming only the host and port; the HTTP standard, RFC 9110, then limits the proxy to blind forwarding in both directions, and TLS runs through that tunnel between your browser and the site.

We checked this with a small logging proxy on our Windows test machine. For `https://example.com` it recorded `CONNECT example.com:443`, 659 bytes out and 5,806 bytes back, and not a word of the page. For `http://example.com` the log held the full address, the request headers and the page's HTML.

- **HTTPS through an HTTP proxy:** the proxy sees the host name, timing and byte counts, never the page, cookies or form data. Proxynet's [HTTPS Proxy](https://proxynet.io/https-proxy) works this way, with no certificate to install.
- **SOCKS5:** the protocol relays the connection without encrypting it; the TLS inside does the encrypting, so a [SOCKS5 Proxy](https://proxynet.io/socks5-proxy) carries HTTPS just as sealed.
- **Plain HTTP through any proxy:** readable by the proxy and every network on the way.

The SOCKS5 handshake itself is explained in [What Is a SOCKS5 Proxy?](/blog/socks5-proxy-101) One more detail: with username and password authentication, an HTTP client sends the proxy password as Base64 in a `Proxy-Authorization` header, which is encoding, not encryption. On a network you do not trust, an IP whitelist avoids sending a password at all.

## Where you meet encryption

- Websites and apps over HTTPS, including online banking and card payments.
- Messaging apps with end-to-end encryption.
- Laptop, phone and external drive storage.
- Password managers, which keep saved logins encrypted.
- VPNs and remote work connections.

## Common mistakes

- **Calling Base64 or a hash "encryption".**
- **Clicking past certificate warnings** on login or payment pages.
- **Turning off certificate checks in code** (`verify=False`, `curl -k`) to silence an error.
- **Losing the recovery key** of an encrypted disk.
- **Reading the padlock as "safe site".** It only means the connection is encrypted.
- **Assuming a proxy encrypts traffic.** It relays it; HTTPS encrypts it.
- **Writing your own cipher** instead of using standard libraries and TLS.

## Decision guide

| Your need | What to use |
|---|---|
| Protect a lost laptop's files | Device encryption or BitLocker; FileVault on a Mac |
| Private chats | End-to-end encrypted messenger, security code checked |
| Know a login page is genuine | Connection is secure, plus the right address |
| Route HTTPS through a proxy | HTTP (CONNECT) or SOCKS5 proxy; TLS stays intact |
| Hide visited sites from public Wi-Fi | A VPN you trust |
| Store user passwords in your app | Salted password hash, never Base64 |
| Proxy login on an untrusted network | IP whitelist instead of a password |

## Frequently asked questions

### Can encryption be broken?

Not by guessing the key: a 128-bit key has 2¹²⁸ possible values, far more than any computer can try. Real failures come from around the cipher: weak passwords, stolen keys, malware, outdated protocols and bugs. The long-term risk is quantum computing, which could break today's public-key algorithms; NIST published its first post-quantum standards, including FIPS 203 for key exchange, in August 2024.

### Is HTTPS enough to keep me safe online?

It is necessary but not enough. HTTPS keeps the connection private and tamper-proof, but it does not show whether a site is honest, does not hide from the network which sites you visit, and cannot protect a device that already has malware. [What Is a VPN and How Does It Work?](/blog/what-is-a-vpn) explains what a VPN adds on public Wi-Fi.

### What is end-to-end encryption?

Encryption that only the people in a conversation can undo. Messages are encrypted on the sender's phone and decrypted on the recipients' phones, so the service's servers only store and forward ciphertext. WhatsApp applies it automatically and lets you compare a security code to confirm it.

### What is the difference between AES and RSA?

AES is symmetric: one secret key, very fast, used for the data itself. RSA is asymmetric: a key pair, much slower, used for signatures and, in older systems, for carrying the session key. TLS 1.3 removed that older method, so in HTTPS today RSA mostly appears in certificate signatures.

### Is Base64 a form of encryption?

No. Base64 is an encoding that rewrites bytes as letters, digits and a few symbols so they fit into text formats. It uses no key, and anyone can decode it instantly.

### What happens if I lose my encryption key?

The data stays unreadable, to you as well. That is why disk encryption gives you a recovery key: Windows stores it in the Microsoft account you signed in with, and FileVault shows you the key or ties recovery to your iCloud account. Find it before you need it.

## Summary

Encryption turns plaintext into ciphertext with an algorithm and a key, and only the right key turns it back. Symmetric encryption such as AES uses one shared key for the data; asymmetric encryption such as RSA and ECC uses a key pair to agree on keys and sign, and HTTPS combines the two. Hashing is one-way and Base64 is only a format. TLS 1.3 encrypts data in transit, BitLocker and FileVault at rest, and messengers such as WhatsApp end to end. A proxy carries an HTTPS connection without reading it, while plain HTTP stays readable on any route; to choose a proxy type, compare the options on our [proxy products page](/proxy).