A lock that can be shared openly
A public key works like a lock anyone can use but only its matching private key can open. The two keys are generated as a pair through mathematical operations designed to be easy to perform in one direction and impractical to reverse without secret information. That lets a sender transform a message using the recipient’s public key without learning the private key.
The security depends on the private key remaining secret. If someone copies it, they may be able to decrypt messages intended for its owner; if it is lost, the owner may lose access to data encrypted for that key.
Why encrypted messages are usually hybrid
Public-key operations are useful for safely establishing a secret, but they are relatively slow for encrypting large amounts of data. In practice, software commonly creates a temporary symmetric key—one secret used both to encrypt and decrypt—and encrypts the message with it. It then uses the recipient’s public key to protect that temporary key.
The recipient uses the private key to recover the temporary key, then uses that key to decrypt the message. This combines the convenience of sharing a public key with the speed of ordinary encryption.
Encryption is not the same as proving who sent it
Public-key encryption protects a message from being read by outsiders, but by itself it does not prove who created it. A separate technique, called a digital signature, uses the sender’s private key to produce a check that others can verify with the sender’s public key. So the same key-pair idea can support two distinct jobs: keeping information confidential and checking its origin.
