Cryptography is the practice of protecting information by transforming it into a form that unauthorized parties cannot read, alter or misuse. In modern computing, cryptography is based on mathematical algorithms, cryptographic keys and security protocols that help protect data in storage, data in transit and digital identities.
A practical way to understand cryptography is to start with a readable message. The original message is called plaintext. A cryptographic algorithm uses a key to transform that plaintext into ciphertext, which appears unreadable without the correct key or verification process. Depending on the method used, the recipient may decrypt the ciphertext, verify a digital signature or compare a hash value to confirm that data has not changed.
Cryptography is not limited to secret messages. It supports secure web browsing, password protection, online banking, card payments, software updates, messaging apps, blockchain systems, digital certificates and many authentication workflows. IBM describes modern cryptography as a cybersecurity tool for protecting sensitive information, while ISO connects it directly with information security for data at rest and data in transit.
Before reviewing the main types and uses of cryptography, it is useful to define the core terms that appear throughout the topic. These terms explain how information moves from readable data to protected data and how systems verify trust.
Plaintext: Plaintext is data in its readable form before cryptographic protection is applied. It can be a message, file, password, transaction, API request or any other data that a system needs to protect.
Ciphertext: Ciphertext is the unreadable output created after encryption. It is designed to be unusable without the correct cryptographic key or decryption process.
Cryptographic key: A cryptographic key is a value used by an algorithm to encrypt, decrypt, sign or verify data. Key strength depends on factors such as length, randomness, protection and correct use.
Algorithm: A cryptographic algorithm is a mathematical procedure that performs a security function. Examples include AES for symmetric encryption, RSA and ECC for public key cryptography, and SHA-family algorithms for hashing.
Hash: A hash is a fixed-length output generated from input data. Hash functions are commonly used to verify integrity, store password-derived values and support digital signatures.
Cryptography is the science and practice of securing information and communication through mathematical techniques. Its purpose is not only to hide information, but also to help verify identity, detect tampering and provide evidence that a message or transaction was created by a specific party.
In cybersecurity, cryptography is used to protect confidentiality, integrity, authentication and non-repudiation. IBM identifies these as central principles of modern cryptography: confidentiality limits access to intended recipients, integrity helps detect unauthorized changes, authentication confirms identity or origin, and non-repudiation prevents a sender from later denying an action.
Cryptography is broader than encryption. Encryption is one cryptographic technique, but cryptography also includes hashing, digital signatures, key exchange, message authentication codes, certificates and protocols. For example, a secure website may use public key cryptography to establish a secure session, symmetric encryption to protect data during the session, hash functions to verify integrity and digital certificates to authenticate the server.
Modern cryptography combines computer science, mathematics, engineering and information security. Fortinet describes it as a practice that uses algorithms, mathematical concepts, cryptographic keys and digital signing to protect data privacy, credit card transactions, email and web browsing.
Cryptography works by applying a defined algorithm and one or more keys to data. The exact process depends on whether the system uses symmetric encryption, asymmetric encryption, hashing, signatures or a hybrid protocol.
A common encryption workflow has the following stages:
For example, when a browser connects to a secure website, cryptography helps establish an encrypted channel between the browser and the server. Public key cryptography can support secure key exchange, while symmetric encryption can protect the actual data transferred after the secure session is established. IBM notes that SSL/TLS protocols rely on public key cryptography to protect data sent between web servers and clients.
This layered structure is important because modern systems rarely depend on a single cryptographic operation. They usually combine different techniques: one for exchanging keys, another for encrypting bulk data, another for verifying integrity and another for authenticating identities.
Cryptography has several security goals. These goals explain why cryptography appears in web security, financial systems, identity management, cloud platforms, messaging applications and software distribution.
Confidentiality means that only authorized parties can read protected information. Encryption is the main technique used for confidentiality. If an attacker intercepts encrypted traffic or steals an encrypted file without the necessary key, the protected data should remain unreadable.
Examples include HTTPS sessions, encrypted databases, protected backups, VPN tunnels and encrypted messaging systems. ISO explains that cryptographic techniques such as encryption can protect confidentiality by making data unreadable to parties without the proper decryption key.
Integrity means that data has not been changed in an unauthorized way. Cryptographic hash functions, message authentication codes and digital signatures can help detect whether data was modified during transmission or storage.
This is important for software downloads, payment records, legal documents, API messages and system logs. ISO identifies data integrity as one of the principles cryptography helps preserve, and it references message authentication codes as one method for detecting modification or corruption.
Authentication confirms that a person, device, server or system is who it claims to be. Cryptographic authentication can use certificates, digital signatures, shared secrets, challenge-response mechanisms and protocols based on public/private key pairs.
In practice, authentication helps a browser verify that it is communicating with the intended website, helps an API verify that a request came from an authorized client and helps a user prove identity without exposing a password directly.
Non-repudiation provides evidence that a specific party performed an action, such as signing a document or approving a transaction. Digital signatures are commonly used for this purpose because they can bind a private key holder to a signed message or document.
ISO explains that cryptographic techniques such as digital signatures can support non-repudiation by helping ensure that parties cannot deny sending or receiving a message.
Cryptography is commonly grouped into several categories based on how keys are used and what security function is provided. The most important categories are symmetric cryptography, asymmetric cryptography, hash functions and digital signatures.
Symmetric cryptography uses the same secret key to encrypt and decrypt data. The sender and recipient must both have access to the same key, and that key must remain confidential.
Symmetric encryption is widely used because it is efficient for protecting large volumes of data. It is commonly applied to disk encryption, database encryption, VPN traffic and encrypted web sessions after a secure session key has been established.
AES is a common symmetric algorithm. NIST FIPS 197 specifies AES-128, AES-192 and AES-256, each using 128-bit data blocks with key lengths of 128, 192 and 256 bits respectively.
Asymmetric cryptography, also called public key cryptography, uses a mathematically related key pair: a public key and a private key. The public key can be shared, while the private key must remain protected.
This design solves an important problem: two parties can establish secure communication without first sharing the same secret key through a private channel. ISO explains that in asymmetric-key cryptography, a sender can use the recipient’s public key to encode a message, while only the recipient’s private key can decode it.
Asymmetric cryptography is used in TLS, digital certificates, secure email, digital signatures, key exchange, software signing and blockchain wallets.
A cryptographic hash function converts input data of any length into a fixed-length output, often called a digest. A small change in the input should produce a very different output.
Hash functions are not encryption because they are not designed to be reversed. Their purpose is to support integrity checks, password verification, digital signatures, message authentication and indexing. ISO describes cryptographic hash functions as techniques that convert data into a fixed-length hashed output and notes their use in digital signatures, MACs and checksums.
A digital signature uses cryptography to verify authenticity and integrity. In a typical workflow, a sender signs data with a private key, and others verify the signature with the corresponding public key.
Digital signatures are used in electronic documents, code signing, software updates, online payments, certificates and blockchain transactions. ISO states that digital signatures verify that data originated from the signer and has not been changed.
| Type | Main purpose | Key structure | Common examples |
|---|---|---|---|
| Symmetric cryptography | Encrypt and decrypt data efficiently | Same secret key | AES, ChaCha20 |
| Asymmetric cryptography | Secure key exchange, encryption, authentication | Public/private key pair | RSA, ECC |
| Hash functions | Integrity verification and fixed-length digests | No decryption key | SHA-2, SHA-3 |
| Digital signatures | Authenticity, integrity, non-repudiation | Private key signs, public key verifies | RSA signatures, ECDSA, EdDSA |
Cryptography, encryption, hashing and encoding are related terms, but they do not mean the same thing. Confusing them can lead to weak designs, especially in password storage, API security and data protection workflows.
Cryptography is the broader field. It includes encryption, hashing, digital signatures, key exchange, message authentication and secure protocols.
Encryption transforms readable data into ciphertext so it can later be decrypted by an authorized party. Encryption is reversible when the correct key is available. It is used when data must be recovered in its original form, such as files, messages or database records.
Hashing creates a fixed-length digest from input data. It is designed to be one-way, meaning it should not be possible to reconstruct the original input from the digest. Hashing is used for integrity checks and password storage workflows. OWASP states that passwords should not be stored using reversible encryption and should instead use secure password hashing algorithms.
Encoding changes data into another format for compatibility, transmission or storage. It is not a security control. Base64, URL encoding and character encoding are examples. Encoded data can usually be decoded without a secret key, so encoding should not be treated as encryption.
Cryptography is embedded in many digital systems. Users often interact with cryptography indirectly through browsers, payment systems, mobile apps, operating systems and cloud services.
HTTPS uses cryptographic protocols to protect communication between browsers and websites. This helps prevent eavesdropping and tampering when users submit passwords, payment data, search queries or personal information.
Secure systems do not need to store plaintext passwords. Instead, they store password-derived hash values using password hashing methods designed for that purpose. When the user logs in, the system computes a new hash from the submitted password and compares it with the stored value.
End-to-end encrypted messaging uses cryptography to protect messages so that only the intended participants can read them. Cryptography can also help authenticate participants and detect message tampering.
Cryptography protects card data, financial transactions, authentication flows and communication between users, merchants, payment processors and banks. ISO notes that secure e-commerce uses asymmetric-key encryption and that cryptography protects credit card information, personal details, purchasing history and transactions.
Operating systems, browsers and applications use digital signatures to verify that updates come from a trusted publisher and have not been altered. This helps reduce the risk of installing tampered software.
Cloud platforms use cryptography to protect stored data, backups, secrets, API traffic and administrative access. Key management becomes especially important because encrypted data is only as protected as the keys and policies that control access to it.
Blockchain systems use cryptographic hash functions, digital signatures and public/private key pairs. ISO notes that cryptocurrencies use cryptographic techniques to secure transactions and that blockchain records are linked together using cryptography.
A cryptographic algorithm is a mathematical process used to perform encryption, decryption, hashing, signing, verification or key exchange. Algorithms are usually implemented inside protocols and libraries rather than used directly by end users.
AES, or Advanced Encryption Standard, is a symmetric block cipher used to protect electronic data. NIST specifies AES-128, AES-192 and AES-256, with the suffix indicating key length.
AES is commonly used for disk encryption, database encryption, VPNs, secure sessions and file protection. Its security depends not only on the algorithm, but also on correct mode selection, key management, randomness and implementation quality.
RSA is an asymmetric algorithm historically used for encryption, key exchange and digital signatures. It is based on mathematical properties related to large prime numbers. RSA remains important in legacy systems, though many modern systems use elliptic curve cryptography for performance and smaller key sizes.
ECC, or elliptic curve cryptography, is a family of public key techniques based on elliptic curves. ISO describes ECC as an asymmetric-key technique with applications in encryption and digital signatures and notes that it can create faster, smaller and more efficient cryptographic keys.
ECC is common in mobile devices, TLS, cryptocurrencies and systems where performance and key size matter.
Diffie-Hellman is a key exchange method that allows two parties to establish a shared secret over an untrusted channel. It is not primarily used to encrypt bulk data directly; instead, it helps create shared keys that other symmetric algorithms can use.
SHA algorithms are cryptographic hash functions used to generate fixed-length digests. They are used in integrity checks, digital signatures, certificates, password workflows and many security protocols. Fortinet lists SHA-1, SHA-2 and SHA-3 as examples of hash function types.
Digital signature algorithms are used to prove that data was signed by a holder of a private key and has not changed since signing. They are commonly used in certificates, electronic documents, code signing, blockchain systems and secure software distribution.
Cryptographic keys are often the most sensitive part of a cryptographic system. Strong algorithms cannot protect data if keys are weak, exposed, reused incorrectly or stored beside the data they protect.
Key management covers the full life cycle of a key: generation, distribution, storage, use, rotation, revocation, backup, destruction and recovery. ISO states that cryptographic key management includes the life cycle of generation, exchange, distribution, storage, use, safe destruction and replacement.
Keys should be generated using secure random number generation. Predictable keys can undermine otherwise strong algorithms. Weak randomness has historically caused serious cryptographic failures because attackers can guess or reproduce keys.
Keys should be stored separately from the data they protect. Depending on the context, this may involve a key management service, hardware security module, secure enclave, vault or operating-system-level secret store.
Key rotation replaces keys according to policy, risk level or operational events. Rotation can reduce exposure when a key has been used for too long, when personnel changes occur or when there is reason to suspect compromise.
When a key is no longer needed, it should be destroyed according to a controlled process. If old keys remain accessible, they may continue to expose historical data.
Key use should be restricted to authorized systems and accounts. Logs should record key creation, access, rotation and deletion events. OWASP’s key management guidance identifies life cycle management, compromise handling, recovery, zeroization, storage and key agreement as important areas to document and harmonize.
Cryptography failures often occur because of implementation mistakes rather than the mathematical weakness of a well-established algorithm. Many failures involve poor key handling, weak randomness, outdated protocols or incorrect assumptions about what a technique does.
A cryptographic key should be sufficiently strong for the data it protects and the time period during which that data must remain protected. Fortinet notes that key strength and length should be relative to the value of the data and the length of time it needs protection.
Using the same key for too many purposes can increase risk. A key used for one function should not automatically be reused for another. Separation of duties is a common cryptographic design principle.
If encryption keys are stored beside encrypted data, a breach can expose both the ciphertext and the means to decrypt it. Fortinet identifies inappropriate storage of keys as a risk, especially when keys are stored on systems that may also be breached.
Algorithms and protocols can become unsafe as research advances and computing power changes. DES, outdated TLS versions and weak hash functions are examples of technologies that modern systems generally avoid.
Designing new cryptographic algorithms or protocols without expert review creates significant risk. Secure implementation usually depends on vetted algorithms, reviewed protocols and maintained libraries.
Passwords generally should not be stored with reversible encryption. If the encryption key is compromised, passwords may be recovered. OWASP states that passwords should use secure password hashing algorithms rather than reversible encryption.
Encryption alone does not always prove that data came from the expected sender or that it was not modified. Authenticated encryption, message authentication codes or digital signatures may be required depending on the system.
Quantum computing affects cryptography because some public key systems depend on mathematical problems that sufficiently capable quantum computers may solve more efficiently than classical computers. This does not mean all cryptography becomes obsolete, but it does create migration pressure for systems that rely on vulnerable public key algorithms.
Quantum cryptography uses principles of quantum mechanics to support secure communication. ISO describes quantum cryptography as a method that applies quantum mechanics to generate a secret key in a way that makes eavesdropping difficult without altering the communication.
Quantum cryptography is different from post-quantum cryptography. Quantum cryptography uses quantum properties in communication systems. Post-quantum cryptography uses mathematical algorithms designed to resist attacks from both classical and quantum computers.
Post-quantum cryptography focuses on algorithms that can run on conventional computers while resisting known quantum attacks. NIST released the first three finalized post-quantum encryption standards in August 2024: FIPS 203 for ML-KEM, FIPS 204 for ML-DSA and FIPS 205 for SLH-DSA.
NIST states that organizations should begin applying these standards to migrate systems to quantum-resistant cryptography. For organizations with data that must remain confidential for many years, post-quantum planning is relevant because encrypted data can be captured now and attacked later when stronger computing capabilities exist.
