Encryption Explained Without the Math

Encryption is one of the most important security technologies in modern life.

It protects online banking, business email, cloud storage, messaging, passwords, Wi-Fi connections and the information stored on phones and laptops. Yet it is often explained using formulas, keys, algorithms and technical terminology that make it sound far more mysterious than it needs to be.

At its simplest, encryption changes readable information into a scrambled form that should be useless to anyone who is not authorised to read it.

You do not need to understand the mathematics behind encryption to understand what it does, where it helps and where its limits are.

What Encryption Actually Does

Imagine writing a confidential message and placing it inside a locked box.

The message can still be transported, stored or handed to someone else, but anyone without the correct key sees only the locked container.

Encryption works in a similar way.

Readable information is often called plaintext. After it has been encrypted, it becomes ciphertext—a scrambled version that should not reveal the original information without the appropriate key.

For example, encryption can protect:

• A document stored on a laptop
• A message travelling across the internet
• A database containing customer records
• A backup stored in the cloud
• A password vault
• A mobile phone that has been lost

The information has not disappeared. It has been transformed into a protected form.

Encryption Is Not the Same as Hiding Something

Hiding a file in an unusual folder is not encryption.

Changing a filename is not encryption.

Putting information inside a compressed ZIP file is not necessarily encryption.

Making a folder invisible does not protect its contents from someone who knows where to look.

Encryption is different because the information itself is transformed. Even when an attacker finds or copies the encrypted data, they should not be able to understand it without the key.

What Is an Encryption Key?

An encryption key is the secret or controlled information used to lock or unlock encrypted data.

The key is not normally a small metal key or a password written directly into the file. It is a digital value used by the encryption process.

A useful comparison is a hotel safe:

• The encryption system is the safe mechanism.
• The data is what is placed inside.
• The key or code controls who can open it.

Strong encryption can be undermined when the key is poorly protected.

For example, encrypting a laptop offers limited protection if the password is written on a label attached to the device.

Encryption and Passwords Are Related but Different

A password may be used to unlock access to an encryption key, but the password itself is not necessarily the encryption.

When you unlock a phone, the device may use your PIN, password, fingerprint or face to authorise access to an encryption key stored securely inside the hardware.

The encryption key may be far longer and more complex than the password you type.

This means a short, predictable password can still become the weakest part of an otherwise strong encryption system.

Encryption at Rest

Encryption at rest protects information while it is stored.

Examples include:

• Files on a laptop
• Data on a phone
• A server database
• A USB drive
• A cloud backup
• An external hard drive

Full-disk encryption protects the contents of an entire storage device.

Common examples include:

• BitLocker on Windows
• FileVault on macOS
• Device encryption on Android
• Data protection on iPhone and iPad

When the device is switched off and locked, the stored information should be unreadable without the authorised unlock process.

Why Full-Disk Encryption Matters

Suppose a laptop is stolen.

Without encryption, the thief may remove the storage drive, connect it to another computer and read the files without knowing the normal Windows or macOS password.

With properly configured full-disk encryption, the files remain scrambled until the correct key is provided.

This protects against someone bypassing the ordinary login screen by accessing the drive directly.

It does not make the laptop impossible to steal, but it can make the data far less useful to the thief.

Encryption in Transit

Encryption in transit protects information while it moves between systems.

Examples include:

• Visiting a secure website
• Sending email between servers
• Joining a business VPN
• Using an encrypted messaging service
• Uploading a file to cloud storage
• Connecting to secure Wi-Fi

When you visit a website using HTTPS, encryption helps protect the information travelling between your browser and the website.

This can include:

• Passwords
• Payment details
• Form submissions
• Account information
• Page content

Without transport encryption, someone able to observe the connection may be able to read or alter the traffic more easily.

What the Padlock in a Browser Means

A browser’s secure-connection indicator means the connection between your device and that website is encrypted.

It generally confirms two things:

• The traffic is protected in transit.
• The website has presented a valid digital certificate for the address you visited.

It does not prove that:

• The business is trustworthy
• The website is not fraudulent
• The product is genuine
• The company will protect your data after receiving it
• The page contains no malware

A phishing website can also use HTTPS.

Encryption protects the connection to the site. It does not guarantee that the site deserves your trust.

End-to-End Encryption

End-to-end encryption is designed so that only the communicating endpoints can read the content.

For example, in an end-to-end encrypted conversation:

1. Your device encrypts the message.
2. The encrypted message passes through the provider’s servers.
3. The recipient’s device decrypts it.

The service provider should not hold the ordinary key needed to read the message content during transit.

This is stronger than simply encrypting the connection between you and the provider.

Transport Encryption vs End-to-End Encryption

These terms are often confused.

Transport encryption

The message may be encrypted between your device and the service provider. The provider can then potentially decrypt, process and re-encrypt it before sending it onwards.

End-to-end encryption

The content remains encrypted from the sender’s device to the recipient’s device.

A useful comparison is:

• Transport encryption is like using secure armoured vehicles between several trusted warehouses.
• End-to-end encryption is like placing the message in a locked box that only the final recipient can open.

Both are useful, but they provide different levels of control.

Symmetric Encryption

Symmetric encryption uses the same secret key to encrypt and decrypt information.

Imagine a locked box where both the sender and recipient have copies of the same key.

This approach is efficient and well suited to encrypting large amounts of data.

It is commonly used for:

• Full-disk encryption
• File encryption
• Database protection
• VPN traffic
• Secure network sessions

The challenge is sharing the secret key safely. If someone intercepts the key, they may be able to unlock the protected data.

Asymmetric Encryption

Asymmetric encryption uses a pair of related keys:

• A public key
• A private key

The public key can be shared openly. The private key must remain secret.

Information encrypted for the public key can be unlocked only with the corresponding private key.

A useful analogy is a public post box:

• Anyone can place a letter through the slot.
• Only the person holding the private key can open the box and retrieve the letters.

This approach is used in areas such as:

• Secure websites
• Digital certificates
• Email encryption
• Software signing
• Secure key exchange
• Identity verification

Why Systems Use Both Types

Modern secure systems often combine symmetric and asymmetric encryption.

Asymmetric encryption helps the two systems establish trust and exchange secret information safely. Symmetric encryption then protects the larger volume of data because it is more efficient.

For example, when connecting to a secure website:

1. Your browser verifies the website’s certificate.
2. The systems securely agree on temporary session keys.
3. Those session keys protect the rest of the connection.

The detailed process is complex, but the principle is simple: one method helps establish trust, and another efficiently protects the conversation.

What Is a Digital Certificate?

A digital certificate helps prove that a public key belongs to a particular website, system or organisation.

Without certificates, an attacker could present their own public key while pretending to be your bank or cloud provider.

A certificate connects:

• A public key
• A website or organisation identity
• A trusted certificate authority
• A validity period
• A digital signature

Your browser checks whether the certificate is valid for the website you are visiting.

When the certificate is expired, invalid or issued for a different address, the browser may display a warning.

Do not bypass certificate warnings casually.

What Is a Digital Signature?

A digital signature helps verify:

• Who signed the information
• Whether it has been changed since it was signed

It is not the same as a handwritten signature image added to a document.

Digital signatures are commonly used for:

• Software updates
• Application installers
• Documents
• Email
• Code
• Certificates

When software is digitally signed, the operating system can check whether the package still matches what the publisher signed.

A valid signature does not automatically mean the software is safe, but it helps establish origin and integrity.

Encryption and Hashing Are Not the Same

Hashing transforms information into a fixed-looking result, often called a hash or digest.

Unlike encryption, hashing is designed to be one-way. It is not normally intended to be reversed.

Hashing is useful for:

• Checking whether a file changed
• Storing password verifiers
• Verifying downloads
• Detecting duplicate data
• Supporting digital signatures

For example, a system should not need to store your original password in readable form. It can store a protected hash and compare that with the result produced when you sign in.

Why Password Hashing Matters

If a company stores passwords in plain text and its database is stolen, attackers may immediately read every password.

A well-designed system stores password hashes instead.

When you sign in:

1. The system processes your password using the same hashing method.
2. It compares the result with the stored value.
3. It does not need to retrieve the original password.

Additional protections such as salts and intentionally slow password-processing methods make large-scale password cracking more difficult.

Users do not need to understand those mechanisms to follow the important rule: use long, unique passwords and multi-factor authentication.

Encryption Does Not Make Weak Passwords Strong

Strong encryption can still be defeated through weak authentication.

If a phone uses excellent encryption but is protected by 1234, an attacker may simply guess the PIN.

If an encrypted backup is protected by a reused password that was exposed in another breach, the attacker may try that password.

Encryption should be combined with:

• Long, unique passwords
• Multi-factor authentication
• Secure recovery methods
• Login-attempt limits
• Hardware-backed protection
• Good key management

What Is Key Management?

Key management covers how encryption keys are:

• Created
• Stored
• Distributed
• Used
• Rotated
• Backed up
• Revoked
• Destroyed

This is one of the most important and difficult parts of using encryption properly.

A business may use excellent encryption but expose its keys through:

• Shared spreadsheets
• Unprotected configuration files
• Email
• Source code
• Public cloud storage
• Excessive administrator access

The security of encrypted data depends heavily on the security of the keys.

What Happens If the Key Is Lost?

Encryption is designed to prevent access without the correct key.

That includes preventing the legitimate owner from gaining access when the key is lost.

Possible causes include:

• A forgotten password
• A lost recovery key
• A damaged security chip
• An employee leaving without handing over credentials
• Deleted cloud key records
• Failed key backups

When no recovery method exists, the data may be permanently inaccessible.

That is not a flaw in encryption. It is evidence that the protection is working.

Recovery Keys Are Extremely Important

Full-disk encryption systems often provide a recovery key.

This key can unlock the device when:

• The user forgets the password
• The hardware changes
• The security chip detects a change
• The normal login process fails
• The device enters recovery mode

Store recovery keys securely and separately from the encrypted device.

Suitable storage may include:

• A managed business directory
• A secure password-management platform
• A protected administrative system
• A controlled offline copy

Do not keep the only recovery key in a file stored on the encrypted laptop itself.

Encryption and Backups

Encrypting the original device does not automatically encrypt every backup.

Backups may exist on:

• External drives
• Network storage
• Cloud platforms
• Portable media
• Another server

Each backup location needs its own security assessment.

An encrypted laptop offers limited protection when its unencrypted backup drive is left in the same bag.

Good backup security includes:

• Encryption
• Access controls
• Separate credentials
• Tested recovery keys
• Off-site storage
• Retention policies
• Restore testing

Client-Side Encryption

Client-side encryption means information is encrypted on your device before it is uploaded to a service.

The provider stores only the encrypted version and may not possess the key needed to read it.

This can improve confidentiality, but it introduces trade-offs.

The provider may be unable to:

• Recover forgotten passwords
• Search the content
• Scan files for certain threats
• Generate previews
• Help recover lost data

Client-side encryption gives the customer more control and more responsibility.

Server-Side Encryption

Server-side encryption means the service provider encrypts stored data within its infrastructure.

This can protect data from risks such as stolen storage media or unauthorised access to underlying disks.

However, the provider usually controls the keys and may be able to decrypt the information when required for normal service operation.

Server-side encryption is valuable, but it is different from a system where only the customer controls the key.

Encryption Does Not Protect Data While You Are Using It

When you unlock an encrypted laptop and open a document, the system must make the document readable to you.

At that point, malware running under your account may also be able to access it.

Encryption is strongest when data is:

• Stored on a locked device
• Travelling through a protected connection
• Held by a service without the necessary key

It does not prevent every threat after an authorised session has been opened.

This is why encryption must be combined with:

• Endpoint security
• Access control
• Patching
• User training
• Monitoring
• Least privilege

Encryption Does Not Stop Phishing

Encryption protects information from unauthorised reading. It does not prevent you from voluntarily giving information to the wrong person.

A phishing site may use a perfectly encrypted HTTPS connection.

When you enter your password, the connection protects it from outside interception—but delivers it securely to the criminal operating the site.

Always verify the destination, not just the padlock.

Encryption Does Not Stop Someone Using an Unlocked Device

If a laptop is encrypted but left unlocked in a public place, another person may be able to access its files normally.

Similarly, a stolen phone may expose data when:

• It was already unlocked
• The screen-lock delay is too long
• The PIN is easy to guess
• Notifications reveal sensitive information
• The attacker knows the password

Use automatic locking, strong authentication and theft-protection features alongside encryption.

Encryption Does Not Replace Permissions

Encrypting a shared drive does not decide which employees should be allowed to open each folder.

Permissions and encryption perform different jobs.

Encryption

Protects the data from someone who lacks the key or authorised system.

Permissions

Control what an authenticated user is allowed to access or change.

A member of staff may legitimately unlock the encrypted business system but still require access to only their department’s data.

Both controls are necessary.

Encryption Does Not Prevent Data Deletion

An attacker may be unable to read encrypted data but still be able to:

• Delete it
• Corrupt it
• Encrypt it again with ransomware
• Damage the storage
• Deny access to the owner

Backups and resilience are still required.

Confidentiality, integrity and availability are separate security goals.

Ransomware Also Uses Encryption

Encryption itself is neither good nor bad. It is a tool.

Ransomware uses encryption maliciously by locking files with a key controlled by the attacker.

Legitimate encryption protects data for the owner. Ransomware removes the owner’s access and demands payment.

Defences include:

• Offline or protected backups
• Endpoint security
• Patch management
• Restricted administrator access
• Application control
• Monitoring
• Staff awareness

Do not assume that already-encrypted files are immune to ransomware. Attackers can encrypt the encrypted data again.

Encryption and Wi-Fi

Modern Wi-Fi encryption protects traffic between a wireless device and the access point.

Current systems should use:

• WPA2 where necessary for compatibility
• WPA3 where supported

Avoid obsolete standards such as:

• WEP
• Original WPA
• Open Wi-Fi without another secure access method

A strong Wi-Fi password protects the local wireless connection, but internet traffic may still rely on application-level encryption such as HTTPS.

Guest networks should also be separated from internal business systems.

Encryption and VPNs

A VPN creates an encrypted connection between your device or network and a VPN endpoint.

It can protect traffic across:

• Public Wi-Fi
• Home broadband
• Mobile connections
• Untrusted local networks

Business VPNs can provide secure access to internal systems.

A VPN does not automatically make everything anonymous or trustworthy.

The VPN provider or organisation operating the endpoint may still be able to observe aspects of the traffic. The security depends on:

• The VPN protocol
• The endpoint
• Account security
• Configuration
• Logging policies
• Device security

Encryption and Email

Email security can involve several different types of encryption.

Connection encryption

Protects the message as it travels between email systems.

Storage encryption

Protects mail stored on devices or servers.

Message-level encryption

Protects the content so that only authorised recipients can open it.

Ordinary email may be encrypted during transport but readable by the email providers involved.

For highly sensitive messages, organisations may use dedicated secure-message platforms or message-level encryption.

Encryption and Cloud Services

Cloud platforms commonly encrypt data:

• In transit
• On underlying storage
• In backups
• Between internal services

Businesses should still ask:

• Who controls the keys?
• Can the provider decrypt the data?
• Are customer-managed keys supported?
• How are keys recovered?
• What happens when an employee leaves?
• Is data encrypted in backups?
• Are downloads protected?
• How is access monitored?

The phrase “encrypted in the cloud” is not a complete security explanation.

What Are Customer-Managed Keys?

Some cloud services allow the customer to control or manage the keys used to protect data.

This may provide:

• Greater control
• Easier revocation
• Separation from the provider
• Support for compliance requirements
• Central key-management policies

It also creates additional responsibility.

Misconfiguring or deleting the key may make business data inaccessible.

Customer-managed keys should be implemented with careful access control, backup and recovery planning.

Hardware-Backed Encryption

Modern devices often include dedicated security hardware for protecting keys.

Examples include:

• Trusted Platform Modules
• Secure elements
• Hardware security modules
• Secure enclaves

These components can help prevent keys from being copied easily from the device.

They may also verify whether the system has been altered before releasing the key.

Hardware-backed protection is stronger than storing a key in an ordinary readable file, but it still depends on secure configuration and recovery planning.

What Is a Hardware Security Module?

A hardware security module, often shortened to HSM, is a specialised device or cloud service designed to generate, store and use encryption keys securely.

HSMs are commonly used by:

• Banks
• Certificate authorities
• Cloud providers
• Payment systems
• Large enterprises

The goal is to perform sensitive key operations without exposing the raw keys unnecessarily.

Most small businesses do not need to purchase a physical HSM, but they may indirectly use one through a managed cloud or security service.

Can Encryption Be Broken?

No security control is absolute.

Encryption may be defeated through:

• Weak passwords
• Stolen keys
• Flawed software
• Incorrect configuration
• Malware
• Social engineering
• Outdated algorithms
• Poor random-number generation
• Implementation mistakes
• Enormous computing resources

Modern, well-implemented encryption is generally attacked through the surrounding system rather than by directly solving the mathematics.

It is usually easier to steal a password than to break a strong encryption algorithm.

Old Encryption Standards Become Unsafe

Encryption methods that were once considered adequate can become weak because:

• Computers become faster
• Researchers discover flaws
• Attack techniques improve
• Key sizes become insufficient
• Implementations are found to be insecure

This is why software and network equipment need updates.

Examples of outdated or weak technologies should be removed from active use rather than kept indefinitely for convenience.

A system should not rely on encryption that the vendor no longer supports.

Quantum Computing and Encryption

Quantum computing is often described as an immediate threat to all encryption.

The reality is more measured.

Powerful future quantum computers could threaten some widely used public-key systems. They would not affect every encryption method in exactly the same way.

Governments, researchers and technology providers are developing and adopting post-quantum cryptographic standards intended to resist those future attacks.

For most organisations, the practical actions today are:

• Maintain an inventory of systems using encryption
• Keep platforms supported
• Follow vendor migration guidance
• Avoid building long-term systems around obsolete algorithms
• Plan for cryptographic upgrades

There is no need to stop using modern encryption while waiting for future technology.

What Does “Military-Grade Encryption” Mean?

“Military-grade encryption” is mainly a marketing phrase.

It does not provide enough information to assess security.

A better description should identify:

• The standard or algorithm used
• How keys are protected
• Whether data is encrypted at rest and in transit
• Who controls the keys
• How authentication works
• How recovery is handled
• Whether the implementation has been independently reviewed

Strong-sounding language does not guarantee strong security.

What Does “Zero Knowledge” Mean?

A zero-knowledge service generally claims that the provider does not possess the information needed to decrypt customer content.

This is often associated with password managers and encrypted storage services.

The exact meaning varies between vendors.

Check:

• What information remains visible
• Whether metadata is encrypted
• How account recovery works
• Whether browser or mobile apps can access plaintext
• Whether sharing features change the model
• Whether the design has been independently reviewed

A provider can minimise access to content while still retaining information about accounts, billing, device use or connection times.

Metadata May Not Be Encrypted

Even when message content is encrypted, surrounding information may remain visible.

Metadata can include:

• Who communicated
• When communication occurred
• File sizes
• Device information
• IP addresses
• Message frequency
• Login times

Metadata can reveal significant patterns without exposing the content itself.

Encryption claims should therefore be assessed carefully rather than interpreted as complete invisibility.

Encryption in Businesses

Businesses should identify where sensitive information exists and how it is protected.

Important areas include:

• Laptops
• Mobile phones
• Servers
• Backups
• USB devices
• Cloud storage
• Email
• Databases
• Remote access
• File transfers

A business encryption policy should define:

• Which devices must be encrypted
• Which systems manage the keys
• How recovery keys are stored
• Who can access them
• What happens when equipment is replaced
• How encrypted data is backed up
• How compliance is verified

Encrypt Removable Media

USB drives and portable disks are easily lost.

When they carry business or personal data, they should use appropriate encryption.

Risks include:

• Loss during travel
• Theft from vehicles
• Being left at customer sites
• Accidental sharing
• Unauthorised copying

Do not rely on the drive being physically small or hidden.

Use centrally managed encrypted media where possible and restrict ordinary removable storage when it is not needed.

Encrypt Business Laptops

Portable computers carry a particularly high risk because they regularly leave the office.

Full-disk encryption should be combined with:

• Strong screen locks
• Multi-factor authentication
• Remote-management capability
• Supported operating systems
• Recovery-key storage
• Automatic locking
• Remote wipe where appropriate
• Regular backups

Verify that encryption is active. Do not assume it is enabled merely because the device offers the feature.

Encryption and Device Disposal

Deleting files or formatting a drive may not immediately remove every recoverable copy.

Before disposing of equipment:

• Confirm whether the drive was encrypted
• Remove business accounts
• Follow a secure-erasure process
• Destroy storage where required
• Record the disposal
• Use an approved recycling provider

Strong encryption can simplify disposal risk when the keys are securely destroyed, but disposal procedures still need to be followed.

Common Encryption Mistakes

Avoid these errors:

• Enabling encryption without storing the recovery key
• Using weak passwords
• Sharing keys through email
• Keeping keys beside the encrypted device
• Encrypting laptops but not backups
• Assuming HTTPS means a website is trustworthy
• Treating a VPN as complete anonymity
• Using outdated encryption standards
• Giving every administrator access to every key
• Failing to test recovery
• Deleting keys before confirming data is no longer needed
• Believing encryption replaces backups or permissions

A Practical Encryption Checklist

For individuals:

• Use a strong device passcode.
• Enable full-disk or device encryption.
• Keep recovery information secure.
• Use encrypted websites.
• Keep software updated.
• Use a reputable password manager.
• Enable multi-factor authentication.
• Encrypt sensitive backups and removable drives.
• Lock devices when unattended.

For businesses:

• Enforce encryption through device management.
• Store recovery keys centrally.
• Restrict access to key-management systems.
• Encrypt portable devices and backups.
• Review cloud key ownership.
• Protect sensitive data in transit.
• Replace obsolete encryption protocols.
• Test recovery procedures.
• Document disposal and key revocation.
• Monitor encryption compliance.

Encryption Is Powerful, but It Is Not Magic

Encryption protects information by turning it into a form that unauthorised people should not be able to read.

It can protect data on a stolen laptop, information moving across the internet and backups held outside the office. End-to-end encryption can prevent service providers from reading message content, while digital signatures can help prove that software or documents have not been altered.

But encryption does not prevent every threat.

It does not stop phishing, protect an unlocked device, replace backups or correct weak access permissions. Its effectiveness depends on passwords, key management, software quality and recovery planning.

The most useful way to think about encryption is not as complicated mathematics, but as controlled access to information. The data remains useful to authorised people and systems while becoming unreadable to everyone else.

Hamilton Group can help businesses enable device encryption, protect backups, manage recovery keys and build secure systems around Microsoft 365, cloud services and modern endpoints.

Call 0330 043 0069 or visit hgmssp.com to speak with one of our experts.