How to Encrypt a Message (and What Encryption Does Not Do)

October 17, 2026 • NOFYI Editorial Team

Encryption in Plain Language

Encryption is a way to turn a readable message into an unreadable form, so that only someone with the right key can turn it back. The original readable message is called plaintext. The unreadable result is called ciphertext. The process of converting plaintext to ciphertext is encryption. The process of converting ciphertext back to plaintext is decryption. The key is the secret value that controls both processes.

You already use encryption every day, even if you never think about it. When you visit a website whose address starts with https, your browser and the site use encryption to protect what you send and receive. When you use a messaging app that offers end-to-end encryption, your messages are encrypted on your device and decrypted only on the recipient’s device. When you unlock a phone with a passcode, encryption helps protect the data stored on that phone. Encryption is not an exotic tool for specialists. It is part of the ordinary infrastructure of the modern internet.

Still, encryption is widely misunderstood. Many people assume that anything described as encrypted is fully private, or that encryption alone makes a service trustworthy. That is not true. Encryption protects content, but it does not protect everything, and it does not fix problems such as a weak password, a compromised device, or a service that mishandles your data. This guide explains how to encrypt a message, how the two main types of encryption differ, and what encryption does not do.

Symmetric Versus Asymmetric Encryption

There are two broad families of encryption, and they differ in how keys work.

Symmetric Encryption

In symmetric encryption, the same key is used to encrypt and to decrypt. The sender and the recipient must both have that key, and they must keep it secret. A common modern symmetric algorithm is AES, the Advanced Encryption Standard, which is widely used to protect data in transit and at rest.

Symmetric encryption is fast and efficient, which makes it suitable for encrypting large amounts of data, such as files, messages, and web traffic. Its main challenge is key sharing. If you need to send an encrypted message to someone, you must first get the shared key to them without letting anyone else see it. If you send the key through the same insecure channel as the message, an eavesdropper could intercept the key and then decrypt the message. That key distribution problem is why asymmetric encryption is often used alongside symmetric encryption.

Asymmetric Encryption

In asymmetric encryption, each person has a pair of keys that are mathematically related. One is a public key, which can be shared openly. The other is a private key, which must be kept secret. A message encrypted with someone’s public key can only be decrypted with that person’s private key. This means you can send an encrypted message to someone using only their public key, without ever sharing a secret in advance.

Asymmetric encryption also enables digital signatures. A signature proves that a message came from the holder of a particular private key and that it has not been changed. That is different from encryption, which hides content. A signed message may still be readable, but its origin and integrity can be checked.

Asymmetric encryption is slower than symmetric encryption, so in practice the two are often combined. A common pattern is to use asymmetric encryption to agree on a temporary symmetric key, and then to use that symmetric key for the bulk of the communication. That hybrid approach gives you the key-sharing benefit of asymmetric encryption and the speed of symmetric encryption. Messaging apps, browsers, and many other tools use some version of this pattern behind the scenes.

How to Encrypt a Message

You do not need to implement encryption yourself to use it. For ordinary messages, the safest approach is to use a reputable tool that already provides encryption, and to follow these steps.

Choose a tool that provides end-to-end encryption. Look for a messaging app or email tool that clearly states it uses end-to-end encryption. End-to-end means the message is encrypted on your device and decrypted only on the recipient’s device, so the service in the middle cannot read it. Do not rely on a vague claim that messages are encrypted without checking whether that encryption is end-to-end.
Verify the recipient. Make sure you are sending to the right person or the right account. Check the contact details, the displayed name, and any safety number or key fingerprint the app shows. If the app warns you that a contact’s key has changed, pause and verify through a separate channel before you continue.
Write the message normally. You do not need to encrypt the text yourself. The app encrypts it when you send it. Write the message as you normally would, and avoid including sensitive information that does not need to be in the message at all.
Send it through the encrypted channel. Send the message in the app that provides the encryption. Do not copy an encrypted-looking block of text into an unencrypted channel and assume it stays protected. The protection comes from the channel and the tool, not from the appearance of the text.
Protect the devices at both ends. Use a strong passcode or password on your device, keep the app updated, and turn on screen lock. If either device is unlocked, compromised, or shared, the encryption does not prevent someone with access to that device from reading the decrypted message.
Manage backups and copies. Check whether the app backs up messages to a cloud service, and whether those backups are encrypted in the same way as the messages. A message that is encrypted in transit may be readable in a backup if the backup is not protected. Review the backup settings and turn off unencrypted backups for sensitive conversations.

If you need to encrypt a file rather than a message, use a reputable file encryption tool or the encryption built into your operating system, such as an encrypted disk image or an encrypted archive. Choose a strong password for the archive, share that password through a separate secure channel if someone else needs to open the file, and do not send the password in the same message as the file. For most people, using a trusted tool is far safer than trying to build a custom method.

Worked Example: Sending a Sensitive Message to a Colleague

Imagine you need to send a colleague a message containing a confidential project detail. You both already use the same end-to-end encrypted messaging app. Before you send anything, you confirm that you are writing to the correct contact and that the app shows the conversation as end-to-end encrypted. You do not send the detail by ordinary email or by an unencrypted chat tool, because those channels do not offer the same protection.

You write the message in the encrypted app and send it. On your device, the app encrypts the plaintext with a key that only your colleague’s device can use to decrypt. While the message travels across the internet, anyone who intercepts it sees only ciphertext. When it reaches your colleague’s device, the app decrypts it with the private key stored there, and your colleague reads the original message.

After the conversation, you both consider what remains. The message may still exist in the app’s history, in a notification preview, in a backup, or in a screenshot. If the colleague’s device is later lost or shared, the decrypted message could be visible there. Encryption protected the message while it travelled, but it did not erase copies after delivery. That distinction matters, and it leads directly to the limitations of encryption.

What Encryption Does Not Do

Encryption hides content, not metadata. Metadata is information about the message, such as who sent it, who received it, when it was sent, how large it was, and which devices or addresses were involved. Even when the content is fully encrypted, much of this metadata may still be visible to the service provider, the network, or an observer. Metadata can reveal patterns, relationships, and habits, even without revealing a single word of content. Do not assume that an encrypted message is an invisible message.

Encryption does not verify that the recipient is trustworthy. It ensures that only the holder of the right key can decrypt the message, but it does not tell you whether that holder will keep the message private, forward it, or act on it responsibly. Encryption does not stop a recipient from taking a screenshot, copying the text, or telling someone else what you wrote. Once a message is decrypted, its secrecy depends on the person who received it.

Encryption does not protect a compromised device. If malware is running on your phone or computer, it may read messages before they are encrypted or after they are decrypted. It may capture keystrokes, take screenshots, or copy files. Keeping devices updated, using reputable software, and being cautious about links and attachments matter as much as encryption itself.

Encryption does not make a service trustworthy on its own. A service can offer encryption and still collect metadata, store unencrypted backups, share information with third parties, or have weak account security. Read the service’s privacy policy in plain terms, check whether encryption is end-to-end rather than only in transit, and look for independent audits or clear documentation. A padlock icon is not a guarantee that a service handles your data well.

Encryption also does not protect you from being compelled to reveal a password or a key, and it does not hide the fact that you are using an encrypted tool. In some contexts, the mere use of encryption may draw attention. Those legal and social considerations are outside the scope of a technical guide, but they are worth remembering when you decide what to send and where.

Key Management: The Part People Forget

Encryption is only as strong as its keys. If a key is lost, the data it protects may become unreadable. If a key is leaked, the data may become readable by anyone who has the key. Key management means generating keys safely, storing them securely, backing them up where appropriate, and replacing them when they may have been exposed.

For ordinary users, the practical rules are simple. Use tools that manage keys for you, rather than handling raw keys yourself. Keep your device passcode strong, because it often protects the keys stored on that device. Do not share private keys, recovery phrases, or key files through messages or email. If a tool offers a recovery code, write it down and store it somewhere safe, such as on paper at home, rather than in an unprotected note. If you believe a key has been exposed, treat the messages or files it protected as exposed and replace the key promptly.

Don’t Roll Your Own Crypto

A well-known rule in security is: do not roll your own crypto. That means do not invent your own encryption algorithm, do not combine standard algorithms in improvised ways, and do not write your own implementation unless you are a specialist working with expert review. Encryption is easy to get subtly wrong. A scheme can look secure, produce unreadable output, and still fail in ways that are invisible until an attacker finds them.

Instead, use standard, well-tested algorithms and libraries, such as AES for symmetric encryption and established protocols such as TLS for data in transit. Keep those libraries updated, follow their documentation, and avoid disabling security checks to make something work. If you are a developer, use the high-level encryption functions provided by your platform rather than assembling low-level pieces yourself. If you are not a developer, use reputable apps that have been reviewed and that follow these standards.

Limitations

Encryption is a powerful tool, but it is not a complete privacy solution. It does not hide metadata, it does not control what a recipient does with a decrypted message, and it does not protect a compromised device. It does not replace strong passwords, two-factor authentication, software updates, or careful judgement about what to send. It also depends on correct implementation. A tool that claims to use encryption but implements it poorly may offer little real protection.

Encryption also creates responsibility. If you lose the only key to an encrypted file or backup, you may lose access to that data permanently. If you forget a password that protects an encrypted archive, the contents may be unrecoverable. Plan for recovery before you encrypt something important, and test that you can decrypt it before you rely on encryption alone.

Frequently Asked Questions

Does encryption mean nobody can read my message?

Encryption means that people without the key cannot read the content while it is encrypted. The intended recipient can read it after decryption, and the service may still see metadata. If a device is compromised or a backup is unencrypted, the message may be readable through those routes.

What is the difference between encryption and hashing?

Encryption is reversible with a key, so it protects data you need to read back later. Hashing is one-way, so it is used to verify something, such as a password, without storing the original. You encrypt messages and files. You hash passwords for storage.

Is end-to-end encryption the same as encryption in transit?

No. Encryption in transit protects data while it travels, but the service may decrypt it on its servers. End-to-end encryption means only the sender and recipient devices hold the keys, so the service in the middle cannot read the content. When privacy matters, look for end-to-end encryption.

Should I use encryption for everything?

Use encrypted tools by default where they are available, such as https websites and end-to-end encrypted messaging. For highly sensitive information, consider whether you need to send it at all, and whether a different method, such as a phone call or an in-person conversation, would be more appropriate. Encryption helps, but reducing what you share helps more.

Conclusion

Encryption turns readable messages into unreadable ciphertext that only the right key can reverse. Symmetric encryption uses one shared key. Asymmetric encryption uses a public and private key pair, and the two are often combined in practice. Use reputable tools that provide end-to-end encryption, verify your recipient, protect your devices, and manage keys carefully. Remember what encryption does not do: it does not hide metadata, control recipients, or protect compromised devices. Used with those limits in mind, it is one of the most valuable tools for protecting your privacy online.