The old problem with secrets
For most of history, secret communication used a shared secret. Two people agreed on a code or password beforehand, and both used it to lock and unlock messages. This approach, called symmetric encryption, works well, but it has a practical catch: you must get the secret to the other person safely before you can start. That is difficult to do with a stranger across the internet.
Public key cryptography, developed publicly in the 1970s, offers a way around this. Instead of one shared secret, each person has two related keys.
The key pair idea
The two keys are generated together and are mathematically linked:
- The public key can be given to anyone. You can publish it freely.
- The private key is kept secret by its owner and never shared.
What one key does, only the other can undo. This single feature supports two different uses.
Use 1: keeping a message private
If someone wants to send you a confidential message, they lock it using your public key. Once locked, the message can only be opened with your private key. Even the sender cannot reopen it, and anyone who intercepts it sees only scrambled data.
A helpful analogy is a mailbox with a slot. Anyone can drop a letter in, but only the person with the key to the box can take letters out. The slot is the public key and the box key is the private key.
Use 2: proving who sent something
Reversing the roles gives a digital signature. The owner uses the private key to create a signature tied to a particular message. Anyone with the public key can verify that:
- The signature matches the message, and
- It could only have been produced by the holder of the matching private key.
If the message changes by even one character, the signature stops matching. This relies on a fingerprint of the message, as described in cryptographic hashes: the signature is usually made over the hash rather than the full text, which is faster.
Signing is the essential function in blockchains. A transaction is valid because it carries a signature that anyone can check against the sender’s public key, with no password ever being transmitted. The practical side of holding keys is covered in digital wallets.
Why sharing the public key is safe
The security rests on a hard mathematical problem. Going from a private key to its public key is easy, but going backward, working out the private key from the public one, is believed to be practically infeasible with current computing. Widely used systems rely on problems such as factoring very large numbers or on the mathematics of elliptic curves. Elliptic curves allow similarly strong security with smaller keys, and are used by many blockchain systems.
This assumption is a belief based on decades of study, not a mathematical proof. Researchers also discuss whether large future quantum computers could weaken some of today’s methods. The topic is active, and work on alternative methods designed to resist such attacks is ongoing. Timelines are uncertain.
Where you already use this
You use key pairs daily without noticing:
- HTTPS. When a browser connects to a secure website, the site proves its identity with a certificate that relies on public keys, and the two sides use key techniques to set up an encrypted session. The padlock is explained further under HTTPS encryption.
- Messaging. Apps with end-to-end protection use key pairs so only the sender and recipient can read content, a topic in message encryption.
- Software signing. Operating systems check that updates were signed by the real publisher, one reason software updates matter for security.
- Passkeys. The newer sign-in method described in passkey sign-in stores a private key on your device and gives the website only a public key, so a stolen website database does not reveal a reusable password.
- Secure shell and code tools. Developers use key pairs to log in to servers instead of passwords.
Practical points about private keys
Because the private key is the identity, a few consequences follow:
- Anyone who obtains it can act as you, and signatures cannot easily be disowned afterward.
- Losing it can mean losing access permanently, particularly where no central party can reset it.
- It should be stored carefully, ideally in hardware or protected storage, and never typed into unfamiliar sites.
- Keys are often protected further with a passphrase or biometrics.
The key pair also does not prove who a person is in the real world. It proves that someone with the private key signed. Linking a key to a real identity takes extra steps, such as certificates issued by trusted organizations, which is part of the idea behind digital identity.
A compact summary
Public key cryptography replaces “we both know a secret” with “I can show you something that only I could have produced.” The public key lets others lock messages for you and check your signatures. The private key lets you open those messages and create the signatures. The first can be shared with everyone; the second must stay with you.