What encryption protects, and the exact point at which it stops

Encryption is described in consumer writing as though it were a single property a thing either has or lacks. In practice at least three distinct mechanisms share the name, they protect against different threats, and the most consequential fact about all of them is the same: encryption says nothing about who is at the other end. The FBI issued a public service announcement making exactly that point about HTTPS, and the FTC restates it in plainer terms. Here is what each layer covers.

Three mechanisms, one word

In transit. Data is scrambled while it travels between two points and readable at both ends. HTTPS is the everyday example, and a VPN is a second layer of the same kind.

At rest. Data on a device is scrambled while the device is locked. BitLocker, FileVault and the automatic encryption on modern phones are this.

End to end. Data is scrambled by the sender and only unscrambled by the intended recipient, so the service carrying it cannot read the contents. This definition is general explanation rather than a quotation from the sources cited here.

They are not stronger and weaker versions of the same thing. They are answers to different questions: who can read this on the wire, who can read this off a stolen laptop, and who can read this in the middle.

In transit: what the padlock attests to

HTTPS means the connection between your browser and a server is encrypted. That is a genuine protection and it is now close to universal — the FTC’s public Wi-Fi article says "Today, most websites do use encryption to protect your information", which is why it also says connecting through a public Wi-Fi network is usually safe.

What it does not do is vouch for the server. The FBI’s PSA I-061019 exists because criminals fit valid certificates to phishing sites, and its instruction is not to trust a site merely because it shows a lock icon or https. The FTC’s version is that scammers "create fake websites and encrypt them to make you think they’re safe when they’re not."

So the padlock answers "is this connection private?" and never answered "is this shop real?" Reading the address — the FBI’s check for misspellings or wrong domains, such as an address that should end in .gov ending in .com — is what addresses the second question.

At rest: your screen lock is the key

This layer protects against physical loss rather than interception, and on modern phones it is already on. CISA’s platform notes are specific: setting a passcode on iPhone enables encryption, and on newer Android versions "the device will be encrypted automatically once you set a screen lock". On Windows the feature is BitLocker, on macOS it is FileVault.

The practical consequence is that the screen-lock credential is the encryption credential. That reframes the FTC’s floor of at least a six-digit passcode — it is not just about someone glancing at your notifications.

One step is easy to skip: CISA specifies backing up the BitLocker recovery key separately. Encryption you cannot unlock is indistinguishable from data loss.

End to end: what it removes from the picture

The purpose of end-to-end encryption is to take the carrier out of the trust equation, so the company routing your messages cannot read them. That is a meaningful narrowing of who has access, and it is why the design is used for private messaging.

The exclusions are what matter for a reader. It does not protect the copies on each end — the messages on your phone and on the recipient’s are readable by anyone who can unlock those phones, which is why the at-rest layer is the one that backs it up. It does not conceal that a conversation happened, only its contents. And it offers no protection at all if the person you are talking to is not who you think they are.

That last exclusion is the same one that applies to HTTPS, stated at a different layer.

The gap all three share

Encryption is about channels and containers. Fraud is about people. Every mechanism above will faithfully and securely deliver your card number to a criminal, protect it from eavesdroppers along the way, and store it safely on both devices.

That is why the agencies’ consumer guidance spends so little time on encryption settings and so much on judgement: heed browser warnings, do not trust the padlock, type addresses directly rather than following links, and look up another way to contact an organisation rather than using the details in the message you received.

What to actually switch on

1. Set a screen lock on every device — at least a six-digit passcode, per the FTC. On phones this enables encryption at rest.
2. On Windows, turn on device encryption via BitLocker and back the recovery key up somewhere separate. On macOS, turn on FileVault.
3. Leave your browser’s default security settings alone and heed its warnings, including certificate warnings — NCSC treats the ability to click through those as something to remove, not a convenience.
4. Use end-to-end encrypted messaging where the conversation warrants it, while remembering it protects the channel and not the correspondent.
5. Stop reading the padlock as a safety indicator. Read the domain instead.

Sources: FBI IC3 — PSA I-061019 on the lock icon and HTTPS · FTC — Are public Wi-Fi networks safe? · CISA — How to protect data stored on your devices · FTC — How to protect your phone from hackers · NCSC UK — Managing web browser security

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from the FBI, the FTC, CISA and NCSC UK. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.