Public vs Private Keys
Asymmetric and Symmetric Encryption Compared
A public key vs private key comparison describes the two halves of an asymmetric key pair. The public key can be shared with anyone, while the private key must stay secret with its owner. The two keys are mathematically linked, so data encrypted with one can be decrypted only with the other.
A simple way to picture this is a mailbox with a slot. Anyone can drop a letter through the slot, but only the owner, who holds the private key, can open the mailbox and read the letters. The public key is the slot; the private key is the lock on the box.
Symmetric encryption works differently. Both parties use the same secret key to encrypt and decrypt. It is fast and suits large amounts of data, but the parties must already share the key secretly. Asymmetric methods solve that problem by letting one side publish a public key that anyone can use to protect a secret for it.
TLS uses both. Asymmetric techniques help the parties verify identity and establish a shared secret during the handshake, and symmetric encryption then protects the bulk of the data. Key types such as RSA and ECC are compared in RSA vs ECC.
Why the Private Key Must Stay Secret
The private key is what proves a server is the legitimate holder of its certificate. Whoever has the private key can present the certificate and complete the handshake as that server. If the key is exposed, an attacker can impersonate the site, and visitors have no visible way to tell the difference.
Key exchange methods without forward secrecy add a second risk. An attacker who records encrypted traffic and later obtains the server's private key may be able to decrypt past sessions. TLS 1.3 requires temporary session keys, which prevents this for new connections. The mechanics are explained in the TLS handshake article.
Protecting the private key means restricting who can read the key file and keeping it off shared channels such as email and chat. If a key may have been exposed, the certificate should be revoked and replaced with one built on a new key pair. The public key, by contrast, is published inside the certificate and needs no protection.
Frequently asked questions
Is a public key a secret?
No. The public key is meant to be shared. It is published inside the certificate, and anyone who connects to the site can read it. Only the private key must be kept secret, because its secrecy protects the server's identity and the security of its sessions.
What happens if a private key is lost?
The server can no longer prove that it holds the key that matches its certificate, so that certificate can no longer be used for TLS. The owner needs to generate a new key pair and obtain a new certificate, which requires a certificate signing request. If the lost key may have been copied, the old certificate should also be revoked.