Public-Key Cryptography
Imagine you want to receive a secret message, but the only mailbox you have is one everybody can see into. Public-key cryptography solves exactly that puzzle: it lets a stranger send you something only you can read, without the two of you ever meeting to agree on a secret first. It's the quiet engine behind HTTPS, encrypted messaging, and the little padlock in your browser. Here's how it actually works.
Two keys instead of one
Older encryption used a single shared key: the same secret both scrambled a message and unscrambled it. That works fine if both people already know the secret — but on the open internet, how do you share it without someone intercepting it along the way?
Public-key cryptography sidesteps the problem with a clever twist. Instead of one key, everyone gets a pair: a public key you hand out freely, and a private key you never share with anyone. The two are mathematically linked. What one key locks, only the other can unlock. Crucially, knowing the public key tells you almost nothing about the private one.
Locking with one key, unlocking with the other
Say Alice wants to send Bob a private message. She looks up Bob's public key — it's meant to be public, so it's easy to find — and uses it to encrypt her message. Once locked with Bob's public key, the message can only be opened by Bob's matching private key. Not even Alice, who just encrypted it, can undo it.
That's the magic: encryption and decryption use different keys. Anyone can lock a box using the public key, but only the holder of the private key can open it. So Bob's public key can be posted on a billboard for the whole world to see, and his messages stay safe as long as his private key stays secret.
Why an eavesdropper is stuck
The security rests on a piece of math that's easy to do one way and brutally hard to reverse. A common example: multiplying two large prime numbers together is quick, but taking the result and figuring out which two primes produced it can take even the fastest computers longer than the age of the universe. The public key is built from the easy direction; recovering the private key would mean solving the hard one.
So an attacker watching the network sees the encrypted message and the public key used to lock it — and neither helps. Without the private key, there is no shortcut. This is the whole reason you can safely publish a public key: it gives away nothing an eavesdropper can use.
Signatures: proving who sent it
The same key pair does a second, equally useful job — in reverse. If Bob encrypts a small piece of data with his private key, anyone can decrypt it with his public key. That sounds pointless until you notice what it proves: only someone holding Bob's private key could have produced it. That's a digital signature. It lets you confirm a message really came from Bob and wasn't altered in transit — the foundation of the certificates that vouch for websites.
Where you meet it every day
You rarely see public-key cryptography directly, because it's usually the handshake, not the whole conversation. It's slower than single-key encryption, so HTTPS uses it just once at the start: to verify the server's identity and to safely agree on a temporary shared key. After that, both sides switch to faster single-key encryption for the actual data. Encrypted messaging apps, software update signing, and SSH logins all lean on the same two-key idea.
The takeaway
Public-key cryptography works because it splits one secret into two linked keys: a public one that locks, and a private one that unlocks. That small asymmetry lets strangers exchange secrets over a network full of onlookers, and lets you prove who you are without revealing anything. It's a rare case where giving something away publicly is exactly what keeps it safe.
This explainer was made with LineLapse — type a topic, get a hand-drawn video. Make your own →