Cybersecurity Foundations (Grades 6–8) · lesson 46 of 48 · 8 min
Encryption: The Invisible Shield Protecting Everything You Do Online
Every time you send a message, make a payment, or log into a website, encryption is working invisibly to protect your data. Without encryption, every piece of information you send over the internet would be readable by anyone who intercepts it — your ISP, your school’s network administrator, attackers on the same Wi-Fi, and governments.
Understanding encryption helps you recognise when you are protected and when you are not — and make informed decisions about the tools and services you use.
By the end of this lesson you will be able to explain how encryption works conceptually, identify where encryption is used in everyday life, distinguish symmetric, asymmetric, and end-to-end encryption, and understand what hashing is and why it differs from encryption.
Encryption is everywhere
Right now, encryption is protecting: the connection between your browser and this website (HTTPS/TLS), your WhatsApp and iMessage conversations (end-to-end encryption), your stored passwords in a password manager (hashing), your phone’s data (full-disk encryption), and your bank transactions. Without encryption, the internet as we know it could not function securely.
What Is Encryption?
Encryption is the process of transforming readable data (plaintext) into an unreadable scrambled form (ciphertext) using a mathematical algorithm and a key. Only someone with the correct key can decrypt it back to readable form.
Encryption is not just for spies and governments — it protects your messages, passwords, banking transactions, and files every single day. Understanding where encryption is used helps you recognise when you are protected and when you are not.
Types of Encryption
Encryption in Your Daily Life
How HTTPS protects your data in transit
What Encryption Does NOT Do
Encryption is powerful but not a complete solution. It is important to understand its limits:
Knowledge Check
Encryption in Everyday Life
What does HTTPS indicate about a website connection?
- The website is safe and trustworthy
- The connection between your browser and the website is encrypted
- The website has been verified by the government
- Your data is stored encrypted on the server
Answer: The connection between your browser and the website is encrypted
HTTPS means the data in transit between your browser and the server is encrypted using TLS. It does not guarantee the website itself is trustworthy or that your data is stored securely.
What is end-to-end encryption?
- Encryption that only protects data on your device
- Encryption where only the sender and recipient can read the messages
- Encryption used only for financial transactions
- Encryption that requires both parties to use the same password
Answer: Encryption where only the sender and recipient can read the messages
E2EE means the messaging provider cannot read your messages — only the sender and recipient hold the keys. WhatsApp, Signal, and iMessage use E2EE.
What is the difference between symmetric and asymmetric encryption?
- Symmetric is stronger; asymmetric is weaker
- Symmetric uses the same key to encrypt and decrypt; asymmetric uses a public key to encrypt and a private key to decrypt
- Symmetric is used for files; asymmetric is used for passwords
- There is no practical difference
Answer: Symmetric uses the same key to encrypt and decrypt; asymmetric uses a public key to encrypt and a private key to decrypt
Symmetric encryption is fast but requires secure key sharing. Asymmetric solves the key sharing problem — you can share your public key openly.
Full-disk encryption protects your data if malware is already running on your device.
- True
- False
Answer: False
Full-disk encryption protects data at rest — if the device is stolen and powered off. Malware running on an unlocked device can read data before it is encrypted.
A one-way transformation used to verify file integrity and store passwords securely — but not to keep data confidential — is called _____.
Answer: hashing
Hashing produces a fixed-length output from any input. It cannot be reversed, making it ideal for password storage and integrity checks, but not for confidentiality.
Real-World Case Studies
Case 1: The LinkedIn Password Breach — Why Hashing Matters
In 2012, LinkedIn suffered a breach that exposed 6.5 million password hashes. The passwords were hashed with SHA-1 but without salting — a critical omission. Within days, security researchers had cracked 90% of the hashes using rainbow tables. In 2016, it emerged the breach was actually 117 million accounts. The lesson: hashing alone is not sufficient for password storage. Passwords must be hashed with a slow, salted algorithm (bcrypt, Argon2) specifically designed for password storage — not general-purpose hash functions like SHA-1 or MD5.
Case 2: Signal vs. Telegram — End-to-End Encryption Matters
Signal uses end-to-end encryption by default for all messages. Telegram uses E2EE only in “Secret Chats” — regular chats are stored on Telegram’s servers in a form Telegram can read. In 2021, Telegram’s servers were subpoenaed by German authorities investigating a criminal case. Telegram provided user data. Signal, by design, has no user data to provide — they cannot read messages even if compelled. The lesson: E2EE is not just a feature — it is a fundamental architectural choice that determines whether a service can be compelled to hand over your communications.
Previous lesson: Threat modeling for students
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Authentication review