Bruce Schneier: From Blowfish to the Human Side of Security

There's a website devoted to "Bruce Schneier facts," in the style of the Chuck Norris jokes. A sample: "Bruce Schneier knows your private key."

The joke works because the real Schneier wrote the book that taught a generation of programmers to implement cryptography, designed two ciphers that anyone could use for free, and then spent a quarter century explaining, in plain English, why security is a people problem.

The Economist calls him a "security guru." Lately he's pointed that expertise at a bigger target: what artificial intelligence will do to democracy.

Bruce Schneier at a Glance

• Schneier designed the Blowfish cipher in 1993 and gave it away unpatented; it's never been practically broken, though he now tells people to use its successor, Twofish, instead.
• Applied Cryptography (1994, second edition 1996) became "the bible of code hackers," the first popular book that handed working cryptographic code to ordinary programmers.
• Twofish, designed with a team of six in 1998, was one of five finalists for the Advanced Encryption Standard.
• He launched the Crypto-Gram newsletter in 1998, founded Counterpane Internet Security in 1999 and started the Schneier on Security blog in 2004; together they reach more than 250,000 readers.
• BT bought Counterpane in October 2006; he left BT at the end of 2013, joined the incident-response startup Co3 Systems as CTO and saw it, renamed Resilient Systems, sold to IBM in 2016.
• His books moved from code to people: Secrets & Lies (2000), Beyond Fear (2003), Liars and Outliers (2012), the bestseller Data and Goliath (2015) and A Hacker's Mind (2023).
• He left IBM in June 2019 and is now Chief of Security Architecture at Inrupt, a fellow and lecturer at Harvard's Kennedy School and a board member of the EFF.
• In October 2025 he and Nathan E. Sanders published Rewiring Democracy, on how AI will transform politics, and in 2026 he took the DEF CON stage to talk about hacking AI.

The Life of Bruce Schneier

Blowfish, Free for All

In 1993 Schneier presented a new block cipher at the first Fast Software Encryption workshop in Cambridge, England. He called it Blowfish, and he did something unusual for the time: he didn't patent it.

Blowfish was fast on the 32-bit processors of the day and free for anyone to use, and it ended up in countless products. More than 30 years later there's still no practical attack against it, although its 64-bit block size shows its age, and Schneier's own page now says, "I recommend that you use Twofish instead."

The Bible of Code Hackers

The next year, John Wiley & Sons published Applied Cryptography. It explained the algorithms, the protocols and the math, and then it did what no popular book had done before: it printed working source code.

Wired called it "the best introduction to cryptography I've ever seen," and Dr. Dobb's Journal "the definitive work on cryptography for computer programmers." The Millennium Whole Earth Catalog called it "the bible of code hackers."

The 1996 second edition grew to 784 pages, with seven new chapters and more than 1,600 new references, and a 20th-anniversary hardcover appeared in 2016. For a generation of programmers it was the first serious cryptography they ever read.

Twofish and the AES Race

When the US government held an open competition to replace DES with a new Advanced Encryption Standard, Schneier assembled a team: John Kelsey, Doug Whiting, David Wagner, Chris Hall and Niels Ferguson.

Their entry, Twofish, was published in 1998 and made the final five. It lost to Rijndael, but like Blowfish it was released unpatented and license-free, and it remains in use wherever people want a cipher with Schneier's name on it.

Counterpane

Schneier started writing Crypto-Gram, a monthly email newsletter, in 1998, and he still writes it today. In 1999 he formed Counterpane Internet Security, betting that the next big thing in security was detection: watching networks around the clock for signs of a break-in.

He was right about detection, and in 2004 he added a daily blog, Schneier on Security, to the newsletter. By then he'd become the press's favorite explainer of everything from airport screening to the latest worm.

On October 25, 2006, British Telecom announced it'd acquired Counterpane. "This is something I've been working on for about a year," Schneier wrote, "and I'm thrilled that it has finally come to pass."

From Code to People

Schneier's books had already changed subject. Secrets & Lies (2000) argued that cryptography alone couldn't save you, because security is a process built around people. Beyond Fear (2003) applied the same thinking to terrorism and airports, and popularized the phrase "security theater."

Liars and Outliers (2012) asked how societies produce enough trust to function. Data and Goliath (2015), on mass surveillance by governments and companies, became a New York Times bestseller, and Click Here to Kill Everybody (2018) warned that the internet of things was turning every software bug into a physical risk.

Leaving BT, Joining Co3

Schneier stayed at BT for seven years, writing the whole time, including about the NSA after the Snowden leaks. In December 2013 the Register reported he was leaving, and he confirmed it on his blog: "I spent seven years at BT, and seven years at Counterpane Internet Security, Inc., before BT bought us. It's past time for something new."

A month later he joined Co3 Systems, a Boston-area startup building software to coordinate incident response, as chief technology officer, reuniting with CEO John Bruce, a former Counterpane colleague. The company became Resilient Systems, and in February 2016 IBM announced it'd buy it.

Schneier stayed on at IBM with what he called "the nicely ambiguous title of 'Special Advisor,'" then left in June 2019 to be, in his words, "back on my own."

The Public-Interest Technologist

Schneier now describes himself as a public-interest technologist. He's a fellow and lecturer at Harvard's Kennedy School, a fellow at the Berkman Klein Center and the University of Toronto's Munk School, a board member of the Electronic Frontier Foundation and Access Now, and Chief of Security Architecture at Inrupt, the company Tim Berners-Lee co-founded to give people control of their own data.

A Hacker's Mind, published in February 2023, argued that hacking isn't a computer concept at all but the way the powerful bend tax codes, markets and laws to their advantage. Rewiring Democracy, written with Nathan E. Sanders and published by MIT Press on October 21, 2025, asks how AI will reshape elections, legislatures and citizenship, for better and for worse.

And he still turns up where hackers gather. His 2010 TED talk, "The security mirage," is a classic, and at DEF CON 34 in August 2026 he gave a talk titled "Hacking AI" that quickly passed 200,000 views online.

Bruce Schneier: Security's Explainer-in-Chief

Plenty of cryptographers can design a cipher. Schneier designed two, gave them away, and then realized the harder problem was the human on the keyboard.

For 25 years he's been the person reporters call when a breach makes the news, and the person a quarter of a million readers trust to tell them what actually matters.

Bruce Schneier doesn't really know your private key. He just knows what you're going to do with it.