Understanding Encryption
Consider the following numbers:
8 5 12 12 15 (space) 23 15 18 12 5
If you can’t read it, try replacing the numbers with their corresponding letter, starting with A=1 (B=2, C=3, so on). The result is:
H E L L O (space) W O R L D
That simple, schoolyard-style code is - by definition - a type of encryption.
Modern encryption protocols, like Signal and AES, are significantly more complicated but at the core the concept is the same: replacing easily understood data with substitutes that can only be understood with a “key.“
In the example I gave earlier, the key is knowing that A=1, B=2, and so forth. In more advanced software encryption, the key is derived mathematically your password. The field of encryption is part of the larger field of cryptography.
Please note that this is a tremendously oversimplified explanation.
Encryption is a central concept in cybersecurity, as well as privacy. Depending on how something is encrypted (if it is encrypted at all) your data can be exposed to a myriad of threats.
Most internet traffic is “encrypted in transit” - meaning it is encrypted when it leaves your device and travels across the internet.
However, that data is decrypted and stored once it reaches the provider’s server, meaning content is easily visible to anyone who has access to that server for any reason. Not just physical access, either: any attacker who gains access to the server can also gain access to your content. This can include not just DMs, but “private” content like a locked social media page, unlisted YouTube videos, invite-only Discord servers, and files stored in the cloud.
End-to-End Encryption (E2EE)
For maximum privacy and security, it is imperative to use a specific type of encryption called “End-to-End Encryption” (also known by other names such as “e2ee,” “zero-knowledge encryption”, “zero-access encryption,” or “client-side encryption”). This means that data is encrypted in transit from sender to reciever without being decrypted at the provider’s servers. (See the caveat under “Tips & Tricks”)
Not all services are able to function with end-to-end encryption. For example, an “encrypted social media platform” makes no sense since the very foundation of social media is that your posts are meant to be broadly visible to the audience you desire. However, direct communcations - such as DMs, email, and cloud storage - can and should be end-to-end encrypted.
Don’t Lose Your Password!
Perhaps the biggest drawback of end-to-end encryption is that - if done correctly - the provider has no access to your encryption keys.
Put simply, the provider cannot reset your password (or other access methods) without permanently encrypting all of your data.
In some cases, there are workarounds or recommended recovery solutions, however these are often user-unfriendly or come with risks the user should be aware of.
The simplest solution is to never lose your password. For more information on how to safely store passwords, see this page.
I also recommend taking advantage of most or all recovery methods, as long as you have researched the risks and they fit your threat model. These often include things like a backup code, recovery contacts (such as a secondary email address or other users who can verify you), a file you can download, or something similar.
Hashing
As you go through your privacy journey, you may sometimes come across the term “hashing.”
Hashing is a one-way encryption that cannot be reversed. Hashing is useful for a variety of situations. For example, passwords should be hashed before being stored on the server to ensure they cannot be decrypted if the service suffers a data breach. Hashes of programs can also be generated to verify integrity before installing - that the program was not modified or corrupted during download. These days that process is largely automated in most situations - such as downloading and installing updates or apps, but sometimes can (and should) be done manually.
Hashing isn’t a concept you need to worry about too much, but it is useful information to have as you may see the word pop up from time to time.
Tips & Tricks
Don’t be swayed by jargon like “military grade encryption” or “bank grade encryption” These are meaningless marketing terms that have no value or information in it. Check the privacy policy to see what data the service can really access.
Be aware that terms like “zero access” or “zero knowledge” can sometimes be misleading as these services may not always necessarily be truly zero access/knowledge. While the content itself may be encrypted, there may still be metadata or other data that is accessible. Be sure to check the privacy policy carefully - and contact the service if necessary - to understand what’s truly protected and what isn’t.
Remember to be mindful of metadata. Even if the content itself is safely encrypted, the metadata may be just as revealing. Check the privacy policy to see what data isn’t encrypted. Contact the service with questions if you’re unsure.
Be wary of terms like “warant-proof encryption” or other similar terms. This may indicate a “bulletproof” provider - that is, a provider who ignores law enforcement requests. While this may seem like a good thing at first, these services often attract and cater specifically to criminals, meaning it’s only a matter of time before they get shut down by law enforcement and your data ends up in an evidence locker.
Be aware that there are many encryption and hashing algorithms available today. Many of them are old and have been deprecated because weaknesses were found (such as MD5 or DES). While it would be impossible for me to list every currently acceptable standard, some of the common ones to look for include AES, RSA, ECC, SHA256 (or better), TLS 1.3 (or better), and Argon2. ML-KEM, ML-DSA, and SLH-DSA should become more common in coming years as post-quantum encryption standards.