The basic idea
Encryption scrambles data using a mathematical process and a secret, called a key, so the data looks like meaningless noise to anyone who does not have the key. With the right key, the data can be turned back into the original. The goal is that a person who gets hold of your files or device but not the key cannot read what is inside.
You do not need to understand the math to use it. What matters is understanding what it protects against, and what it does not.
Two situations it protects
Data at rest is data stored on a device or drive. Encrypting a laptop’s drive, a phone or an external backup drive means that if the device is lost or stolen, the thief generally cannot simply read the files by connecting the drive to another computer. This is the most common reason ordinary users turn encryption on.
Data in transit is data moving across a network. When a website address begins with https, the connection between you and the site is encrypted, which stops others on the network from easily reading what you send. Messaging apps and many email services also use encryption in various ways, although the details differ between services. The risks of public Wi-Fi are reduced, though not eliminated, by this kind of encryption.
What encryption does not do
It helps to be clear about the limits.
- It does not protect an unlocked device. If your laptop is open and logged in, anyone using it can see your files.
- It does not stop malicious software running on your own computer, because that software acts with your permissions.
- It does not stop phishing. If you are tricked into giving away your password, the strongest encryption does not matter. The warning signs of phishing messages are worth knowing.
- It does not make a weak password strong. The protection is often only as good as the password or PIN guarding the key.
- It does not replace a backup. Encrypted files can still be lost, deleted or corrupted.
Common forms of everyday encryption
- Device encryption. Modern phones typically encrypt storage when you set a passcode, and major desktop operating systems include a tool to encrypt the whole drive. Check your settings to see if it is enabled, because defaults vary by device and version.
- Encrypted external drives. Many operating systems can encrypt a portable drive with a password. This is useful for backup drives that travel or sit in a bag.
- Encrypted folders or archives. Some tools create a protected container or archive for particularly sensitive files, such as scans of identification documents.
- Encrypted cloud storage or backup. Some services allow you to hold the key, so that even the provider cannot read the data. This offers more privacy, and also more risk if you forget the password.
The key is everything
Strong encryption means that without the key, recovery is typically impractical. That is the point, but it creates a risk of its own. If you forget the password and no recovery key exists, your files may be gone for good.
- Choose a long, hard-to-guess password or passphrase, and consider storing it in one of the password managers.
- When the system offers a recovery key, save it somewhere separate from the device, such as a printed copy kept with important papers.
- Make sure a trusted person can reach it in an emergency, as part of planning for a digital legacy.
- Do not keep the only copy of the recovery key on the encrypted drive itself.
Practical trade-offs
Encryption is usually quick enough on modern devices that most people will not notice any slowdown, though this can differ on older hardware. It can make some kinds of file recovery harder, because the damaged data is scrambled and may be unreadable even to recovery tools. This is another reason to keep reliable backups.
Encrypted files can also be harder for family members to open, so share your plan with someone you trust.
Where to start
- Check that your phone and computer have a passcode or password and that device encryption is on.
- Keep your software up to date, since updates fix security weaknesses.
- Encrypt any external drive that holds sensitive material or leaves the house.
- Save recovery keys safely and test that you can find them.
- Use two-factor authentication on accounts so a stolen password alone is not enough.
Encryption is one layer in a broader approach to personal data protection. It is useful, not magical, and no setup can offer a guarantee. Used with good passwords, updates and backups, it significantly reduces the harm if a device falls into the wrong hands.