Does encryption still help?

Yes — in 2026 encryption is still one of the most useful things you can do to protect data. What has changed is that we should not treat it as a spell against every threat. Encryption of a path or a disk is strong against someone in the middle and against a thief who picks up a locked device. It does not protect an unlocked phone, malware on that same device, or someone who can make you open the screen.

The right question is not “is encryption dead”; it is which layer you have turned on for which threat, and what else remains beside it, such as a screen lock, updates and a tested backup. Do not confuse three layers with one another. HTTPS encrypts the connection to a website. End-to-end encryption keeps the text between the parties’ devices so the provider does not read it. Disk encryption makes files unreadable on a powered-off or locked device. Each one answers a different question.

What path encryption still solves

When a website uses HTTPS, someone on café Wi-Fi cannot easily read the page or change it in transit. The lock next to the address only says that: the connection to that domain is encrypted. It does not say who owns the site or whether the page is honest. Read the domain name itself before you type a password.

1. If the browser warns about a certificate, do not bypass the warning unless you have a clear technical reason you yourself understand.
2. Do not confuse HTTPS with an end-to-end messenger. Webmail with a lock is encrypted to the server; the provider’s inbox can usually see the text. Account hardening is in the guide to safer email accounts.
3. Free, automated certificates are now normal; a missing lock should raise a question. The history of that change is on the Let’s Encrypt page.

End-to-end encryption of a conversation

When a messenger’s conversation mode itself is end-to-end, the provider should not see the text. That means as much in 2026 as it did a decade ago — more, because more coordination now travels those paths. How to choose a tool and tell the modes apart is in safer encrypted messaging.

1. Before you rely on a chat, see that that conversation — not only the app’s marketing — is end-to-end.
2. Verify the other person through a path outside that chat if the topic is sensitive.
3. Ask separately about the cloud backup; some apps encrypt the conversation end to end and not the cloud copy, unless a separate setting is on.
4. Metadata — who talks to whom — may still remain. The limits are in the guide to anonymity in communication.

Disk encryption and a locked device

When a disk is protected with BitLocker or Device Encryption on Windows, FileVault on a Mac, LUKS on Linux, or the phone’s own encryption, losing a locked or powered-off device does not mean the files are easy to read. This layer weakens a thief, or someone who takes the device from a bag, provided the screen is locked, the PIN or fingerprint is not weak, and the recovery key is kept separately. A device that is on and unlocked no longer benefits from this layer.

1. On Windows open Settings > Privacy & security and look at Device encryption or BitLocker. Do not leave the recovery key only in a Microsoft account if that same account is your only way back in; keep a separate copy too.
2. On a Mac turn on System Settings > Privacy & Security > FileVault and write the recovery key down off that same Mac.
3. On a phone, encryption is usually active once a screen lock is set. A weak lock, or no lock, makes this layer useless.
4. Before you sell a device, encryption alone is not enough; sanitize it separately.

Why encryption is still fought over

Debates about lawful access, on-device scanning or proposed back doors for messengers are themselves a sign that encryption still works well enough to be contested. Until such a door is opened in a tool you use, the encryption layer keeps doing its job.

This page does not take sides on a particular bill. The practical point for you is: do not treat a service that says “we hold a golden key behind the door” as the same thing as a tool that opens the text only on the parties’ devices. If a law or a service’s policy changes, review your assumptions then — rather than declaring encryption useless in advance.

1. See whether the service you use says it reads the text, scans on the device for safety, or keeps a key of its own.
2. If those assumptions do not match your sensitive work, change the channel; you do not have to give up on encryption as a whole.

What it does not solve

If someone has access to a session you already unlocked — a phone without a lock on the table, a computer that is on, or an open browser profile — path encryption will not help. The data is visible there in the clear.

If the other person takes a screenshot or their device is infected, end-to-end protection of the path will not save the text. Encryption does not promise how the other person will behave.

Malware on the same device can read the screen, record it or take a key from memory before or after encryption. For untargeted threats see the guide to responding to malware and phishing. A home scan is also not enough for very advanced spyware.

If someone can make you unlock the screen, or can guess a weak lock, the disk layer falls away in that moment. Encryption is not a substitute for deciding what data you carry with you.

1. Set a screen lock you will actually use.
2. Do not leave the device unlocked in a gathering, and limit lock-screen notification previews for sensitive apps.
3. If physical inspection is a real risk for you, carry less data; encryption is not a miracle.

Losing the key locks you out too

If you lose the recovery key, the same protection can make the files unreadable to you as well. That is not encryption failing; it is the job it was built for. So treat encryption together with a screen lock, updates and a backup you can restore, not as a replacement for them.

1. Write the disk recovery key, a messenger recovery phrase or a container password down off that same device.
2. Once, in calm conditions, test opening the backup or the container.
3. Do not keep the key in the same folder as the encrypted file.

Service-side cloud encryption is not the same as encryption on the device

Many cloud folders say the data is “encrypted.” Often that means the path to the server and storage on the service’s own disks are encrypted. In the ordinary case the service can still open the file to sync it and show a preview. That is different from a container whose key is only yours.

1. Before you put a sensitive document in the cloud, ask whether the key is only yours or whether the service can see the content too.
2. If the key is only yours, losing it means the service cannot help you either. Test the backup and the key separately.
3. Do not confuse “anyone with the link” sharing with encryption; the link itself is a weak key.

When people say encryption was broken

Do not treat news about an old algorithm being broken, or a weakness in one implementation, as the end of encryption as a whole. Most incidents people actually face come from a weak guessed password, phishing, an unlocked device or an unencrypted backup — not from breaking AES at home.

1. See which layer the news is about: one site’s certificate, one app’s implementation, or the algorithm itself.
2. If a specific app needs an update, update it from the official path; do not abandon every tool overnight.
3. Change short and reused passwords. That helps you more than chasing every security headline.

Talk with the other person, and with yourself, about what to expect

Encryption holds in practice when both sides understand what is hidden and what is not. If one person copies the chat into ordinary mail or leaves it open on a shared device, the layer ends there.

1. Tell your main contact once which channel you will use for sensitive material.
2. Say that screenshots and an unlocked device are part of the threat, so nobody assumes “because it is end-to-end, anything goes.”
3. If someone cannot install the same tool, agree a fallback channel in advance, not in the middle of an incident.

Common mistakes

• Assuming that an HTTPS lock means the site is trustworthy.
• Assuming that every app that puts the word encryption in its advertising hides the text from the provider.
• Turning on disk encryption without keeping the recovery key.
• Leaving the phone unlocked and relying on the idea that “the messages are end-to-end.”
• Declaring that encryption no longer has any use only because malware or screenshots exist. Those threats belong to entirely different layers and are never a reason to turn encryption off.

What to do today

1. Turn on disk encryption on your main devices and store the recovery key separately.
2. For sensitive conversations, use a messenger whose mode is end-to-end encrypted and verify the other person.
3. Read the HTTPS domain before you type a password; the lock does not mean the site is trustworthy.
4. Keep the other layers — a screen lock, updates and two-factor authentication — beside encryption.
5. Test restoring the key or the encrypted backup once in calm conditions so you are not locked out of your own data on the day of an incident.