Every secure system you use — HTTPS, email encryption, VPNs, file encryption, messaging apps — relies on one of two cryptographic approaches. Some use both. The distinction between symmetric and asymmetric encryption is the most fundamental concept in practical cryptography, and getting it wrong leads to either broken security or unusable performance.
What Is Symmetric Encryption
Symmetric encryption uses a single key for both encryption and decryption. You encrypt a message with a key, and the recipient uses the same key to decrypt it. The key is the shared secret — if anyone else obtains it, the encryption is compromised.
The analogy is a physical lockbox with one key. You lock the box, hand it to a courier, and the recipient uses an identical copy of the key to open it. The security depends entirely on keeping that key private.
### Symmetric Encryption Algorithms
The dominant symmetric algorithms in use today:
AES (Advanced Encryption Standard) — The modern standard, adopted by NIST in 2001 as FIPS 197. AES operates on 128-bit blocks and supports key sizes of 128, 192, or 256 bits. AES-256 is the current default for serious applications and is approved by the NSA for Top Secret data. You can try it directly with the AES text encryptor.
DES (Data Encryption Standard) — The predecessor to AES, adopted in 1977 with a 56-bit key. DES is now obsolete and was officially withdrawn by NIST in 2005. Its 56-bit key space can be brute-forced in hours. For the full history, read DES Encryption Explained: Why It's Obsolete.
3DES (Triple DES) — A stopgap that applies DES three times with two or three different keys. 3DES extended DES's life but is being deprecated by NIST, with disallowance for new applications and full withdrawal planned. It is slow and has a 64-bit block size that creates birthday-bound vulnerabilities at high data volumes.
Blowfish — A 1993 algorithm by Bruce Schneier with a variable key length up to 448 bits. Blowfish is unbroken but has a 64-bit block size and was superseded by Twofish, which was a finalist in the AES competition. Neither is recommended for new systems when AES is available.
ChaCha20 — A stream cipher designed by Daniel J. Bernstein. ChaCha20-Poly1305 is an authenticated encryption scheme used in TLS and many modern protocols. It is faster than AES in software-only implementations and is the default in some mobile and IoT contexts.
### Properties of Symmetric Encryption
| Property | Details | | --- | --- | | Key count | One shared key | | Speed | Very fast (hardware AES: several Gbps) | | Key distribution | Must share key securely before communication | | Use case | Bulk data encryption, data at rest | | Key sizes | 128, 192, or 256 bits (AES) | | Standards | FIPS 197 (AES), RFC 7539 (ChaCha20-Poly1305) |
What Is Asymmetric Encryption
Asymmetric encryption, also called public-key cryptography, uses a pair of keys: a public key and a private key. The public key can be shared freely. The private key is kept secret. Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa.
The analogy is a mailbox with a slot. Anyone can drop a message in (encrypt with your public key), but only you have the key to open the mailbox and read it (decrypt with your private key). The critical innovation is that you never need to share a secret with the person sending you encrypted data.
### Asymmetric Encryption Algorithms
RSA — The most widely deployed asymmetric algorithm, invented by Rivest, Shamir, and Adleman in 1977. RSA's security relies on the difficulty of factoring large integers. Current recommendations call for at least 2048-bit keys, with 3072-bit or 4096-bit preferred for long-term security. NIST SP 800-57 projects that 2048-bit RSA provides approximately 112 bits of security. Try it yourself with the RSA encrypt/decrypt tool, and read our RSA encryption explainer for the mathematical details.
ECC (Elliptic Curve Cryptography) — A newer family of algorithms that achieves equivalent security with much smaller keys. A 256-bit ECC key provides roughly the same security as a 3072-bit RSA key. ECC is used in Bitcoin, Signal, Apple's iMessage, and modern TLS. Common curves include NIST P-256, Curve25519, and secp256k1.
Diffie-Hellman — Not an encryption algorithm per se, but a key exchange protocol that allows two parties to establish a shared secret over an insecure channel. Diffie-Hellman is the foundation of forward secrecy in TLS. The elliptic curve variant (ECDH) is what most modern systems use.
### Properties of Asymmetric Encryption
| Property | Details | | --- | --- | | Key count | Two keys (public and private) | | Speed | Slow (100-1000x slower than symmetric) | | Key distribution | Public key can be shared openly | | Use case | Key exchange, digital signatures, authentication | | Key sizes | 2048-4096 bits (RSA), 256-521 bits (ECC) | | Standards | PKCS#1, RFC 8032 (EdDSA), SEC 2 (ECC curves) |
Key Differences: Symmetric vs Asymmetric
| Dimension | Symmetric | Asymmetric | | --- | --- | --- | | Keys | One shared secret | Public/private pair | | Speed | Very fast (Gbps) | Slow (thousands of ops/sec) | | Key distribution | Must be shared securely beforehand | Public key shared openly | | Primary use | Bulk data encryption | Key exchange, signatures | | Key sizes | 128-256 bits | 2048-4096 bits (RSA) | | Computability | O(n) with data size | O(n^2) or worse with key size | | Example | AES-256-GCM | RSA-2048, Ed25519 |
The key distribution problem is the defining difference. With symmetric encryption, you need a secure way to share the key before you can communicate securely. This creates a chicken-and-egg problem: you need a secure channel to share the key, but you need the key to create a secure channel. Asymmetric encryption breaks this cycle by allowing secure communication without a pre-shared secret.
The performance difference is equally fundamental. RSA encrypting 1 MB of data takes roughly 1000 times longer than AES encrypting the same data. On modern hardware, AES-256-GCM can encrypt at 5+ Gbps, while RSA-2048 manages about 1000 operations per second. This is not a gap that better hardware will close — it is structural to the mathematics involved.
When to Use Each
### Use Symmetric Encryption When
You are encrypting data at rest — files, databases, disk images, backups. There is no key distribution problem because the same entity encrypts and decrypts. Use AES-256 in GCM mode for authenticated encryption. The file encryptor handles this for any file type, and our guide to encrypting any file type covers the specifics for PDFs, Word, Excel, and ZIP archives.
You are encrypting large volumes of data. Symmetric encryption is the only practical choice for streaming video, database fields, or anything measured in megabytes or more.
You already have a secure channel for key exchange. If you are handing someone a USB drive with encrypted files, or if you have already established a secure connection, symmetric encryption is sufficient and faster.
### Use Asymmetric Encryption When
You need to exchange keys with someone you have never communicated with before. This is the primary use case. HTTPS does this every time you visit a new website.
You need digital signatures. Asymmetric encryption enables signatures because the private key holder can create a value that anyone with the public key can verify. This is the basis of digital signatures, code signing, and certificate authorities.
You need non-repudiation. Symmetric encryption cannot prove who sent a message, because both parties share the same key. Asymmetric signatures can.
You are building a system with many participants. Managing a unique symmetric key with each of 1000 users requires 999,000 keys (one per pair). With asymmetric encryption, each user has one key pair, and anyone can encrypt to anyone else using their public key.
Hybrid Encryption: How Real Systems Work
No serious system uses symmetric or asymmetric encryption alone. They use both, in a pattern called hybrid encryption. The asymmetric algorithm solves the key distribution problem, and the symmetric algorithm handles the actual data encryption at speed.
### How TLS Combines Both
When you connect to a website over HTTPS, the TLS protocol runs a hybrid encryption scheme:
1. The server presents its certificate, which contains its public key (typically RSA or ECDSA). 2. The client and server perform a key exchange — either RSA key transport (legacy) or ECDH (modern). This establishes a shared symmetric key. 3. Both sides derive session keys from the shared secret using a key derivation function. 4. All subsequent traffic is encrypted with a symmetric cipher, usually AES-256-GCM or ChaCha20-Poly1305.
The asymmetric phase takes a few milliseconds and handles a few hundred bytes of key exchange data. The symmetric phase handles all the actual web traffic at gigabit speeds. This is why HTTPS feels instant despite the cryptographic overhead.
For a deeper look at how this combination works, read our hybrid encryption guide.
### How PGP Combines Both
PGP (Pretty Good Privacy) uses the same hybrid pattern for messages. When you encrypt a message to someone's PGP key, PGP generates a random symmetric session key, encrypts your message with that key using AES, then encrypts the session key with the recipient's RSA public key. The recipient uses their RSA private key to decrypt the session key, then uses that key to decrypt the message. Read the full breakdown in PGP Encryption Explained.
A Decision Guide
| Your Situation | Use | | --- | --- | | Encrypting a file on your disk | Symmetric (AES-256-GCM) | | Encrypting a file to send to someone | Symmetric + out-of-band key sharing, or hybrid (PGP) | | Securing a website connection | Hybrid (TLS: ECDH key exchange + AES) | | Signing a document | Asymmetric (RSA-PSS or Ed25519) | | Encrypting a database column | Symmetric (AES-256-GCM) | | Authenticating API requests | Asymmetric (HMAC with shared key, or JWT with RS256) | | Building a messaging app | Hybrid (Signal protocol: X3DH + AES) | | VPN tunnel | Symmetric (AES or ChaCha20 for bulk, handshake with asymmetric) |
Common Misconceptions
One persistent myth is that asymmetric encryption replaced symmetric encryption. It did not. Asymmetric encryption solved the key distribution problem that symmetric encryption could not, but symmetric encryption remains the workhorse for all bulk data. The two are complementary, not competitive.
Another misconception is that longer keys always mean more security. A 256-bit AES key provides more security than a 2048-bit RSA key, because the security levels are computed differently. AES-256 provides approximately 256 bits of security. RSA-2048 provides approximately 112 bits. The key lengths are not comparable across algorithm families.
A third misconception is that hashing is encryption. Hashing is a one-way function — you cannot recover the input from the hash. Encryption is a two-way function — you can recover the plaintext with the key. They serve different purposes and are not interchangeable.
Try It Yourself
You can experiment with both approaches without installing anything:
- Encrypt text with AES using the AES text encryptor. Generate a key, encrypt a message, and observe how the same key decrypts it. - Encrypt text with RSA using the RSA encrypt/decrypt tool. Generate a key pair, encrypt with the public key, and decrypt with the private key. Notice the speed difference.
For file encryption, the file encryptor uses AES-256-GCM to encrypt any file type — PDFs, documents, images, archives — entirely in your browser. And for understanding how token-based systems use these cryptographic primitives, read our token-based authentication guide.
The Bottom Line
Symmetric encryption is fast and secure for bulk data but requires a pre-shared key. Asymmetric encryption solves the key distribution problem but is too slow for bulk data. Every practical system uses both: asymmetric encryption to establish a shared key, symmetric encryption to protect the data. Understanding this division of labor is the foundation for understanding how AES-256-GCM works, how DES became obsolete, and how hybrid encryption powers the internet.
