IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Keys, signatures & the padlock — crypto basics
Last lesson we said encryption needs a key. But how do two strangers agree on a key while a thief listens? Your goal: explain what the padlock in your browser really promises.
- Symmetric encryption uses one shared key. Sharing it safely is the hard part.
- Asymmetric encryption uses a pair: a public key and a private key.
- A signature proves who wrote a message and that it did not change.
- The padlock means a private line, not an honest site.
One key, or two?
The oldest idea is symmetric encryption. There is one shared key that locks and unlocks. It is fast and simple. But it has a big problem. Before you can talk in secret, you must get the key to the other person. If you mail the key, a thief can copy it on the way.
The two-key trick
The fix is asymmetric encryption. Instead of one key, you have a pair, called a key pair. The public key is for everyone. You can give it to the whole world. The private key never leaves you. A message locked with the public key opens only with the private key. Nobody can work out the private key from the public one.
a letter box on the street. The slot is your public key. Anyone can drop a letter in. But only your private key opens the box. Giving out the slot never puts the mail at risk.
Run it backwards: signing
Now use the keys the other way round. Priya signs with her private key. Anyone can check the signature with her public key. It works like a wax seal that only she can press, but everyone can recognize. It proves she wrote the message and that not one letter has changed. The same trick seals a JWT (next lesson). It also stands behind the padlock.
The little padlock
The padlock means the connection uses TLS. Two things happen.
- The site proves who it is with a certificate. This is a public key that someone your browser trusts has vouched for.
- Your browser and the site agree on a fresh, temporary shared key.
After that, they use fast symmetric encryption for the real traffic. So asymmetric keys say hello, and symmetric encryption does the heavy work. Certificates and chains of trust get their own lesson later.
| Symmetric | Asymmetric | |
|---|---|---|
| Keys | One shared secret | A public key and a private key |
| Speed | Very fast | Slower, so used only a little |
| Good for | Lots of data, once a key is shared | Agreeing on that first key, signing, and proving identity |
Go deeper: signing is not exactly "encrypting backwards"
We said signing is like using the keys the other way round. That picture is a good start. In real systems, signing is its own math step. It does not lock the message. A signed message is still readable by everyone. The signature only proves who made it and that it was not changed.
Also, the temporary key in TLS is never sent over the wire. The two sides work it out together with a special exchange. You do not need the details now.
The padlock does not mean "safe" or "the real company". It only promises a private line to whoever owns this exact domain. A scam site can get a padlock for its own look-alike domain in minutes. The padlock protects the line, not the person at the other end. Always read the domain itself, not just the lock. Lesson 9 shows how.
🧪 Interactive lab — enable JavaScript to play with this one.
See the ID card behind any real padlock with Cert Lint. See the public keys a real login server shares with JWKS Check.