Public-key cryptography

Public-key cryptography uses a mathematically linked key pair. What the public key locks, only the private key opens, and the public key cannot be used to work out the private one. So you can publish your public key anywhere, and anyone can send you something only you can read. The older kind, symmetric encryption, uses one shared key for both directions, which leaves a hard problem: how do two strangers agree on a secret over a network everyone can listen to?

That is the problem it solves, and it is why the internet works. When your browser opens an HTTPS site, it uses the server's public key (delivered inside its TLS certificate) to agree on a fresh symmetric key, and the rest of the session runs on that faster key. The same idea protects your ssh login to a server (your public key sits on the server, your private key never leaves your laptop), the messages in end-to-end encryption apps, cryptocurrency wallets and passkeys.

The pair also works backwards, as a digital signature: something locked with your private key can be opened by anyone with your public key, which proves it came from you and was not changed. Software updates, Git commits and certificates are signed this way. Common algorithms are RSA and elliptic-curve ones like Ed25519; the latter are smaller and faster and are now the default.

The one rule that matters in daily life: the private key is the whole secret. Whoever has the file (or the seed phrase of a crypto wallet) is you, as far as the math is concerned.