Public key cryptography is one of the most elegant ideas in computing, and it quietly secures almost everything: HTTPS, SSH, signed software, encrypted messaging and cryptocurrencies. The concept sounds paradoxical at first — a key you publish to the world — but the logic is beautifully simple once it clicks.
Two keys, not one
Traditional (symmetric) encryption uses one shared secret key for both locking and unlocking — which raises the hard problem of sharing that key safely. Public key cryptography uses a pair: a public key you can hand to anyone, and a private key you keep secret. What one key does, only the other can undo.
Encryption: anyone can lock, only you can open
If someone wants to send you a private message, they encrypt it with your public key. From that point, only your private key can decrypt it — even the sender cannot reverse it. You never had to share a secret in advance, which solves the key-distribution problem that plagued earlier cryptography.
Signatures: only you can sign, anyone can verify
The pair also works in reverse for authenticity. You sign data with your private key, and anyone can verify the signature with your public key. A valid signature proves the data came from you and was not altered. This is how signed software, certificates and JWTs prove their origin.
Where you meet it
Every HTTPS handshake uses public key cryptography to agree on a session key. SSH uses it so you can log in without a password. Git commits can be signed with it. Understanding the public/private split demystifies all of these at once — they are the same idea applied in different places.
Guarding the private key
The entire system rests on one rule: the private key must stay private. A leaked private key lets anyone impersonate you or read your messages. This is why private keys are protected with passphrases, stored carefully, and rotated if there is any chance of exposure.