Encryption at Rest vs in Transit, Explained Without Jargon
Encryption in transit protects data while it moves; encryption at rest protects it while it sits. You need both, and neither protects you from a stolen password.
Every software vendor says "your data is encrypted". The honest follow-up question is: encrypted when? Data has two states that matter. It is either moving between two places, or it is sitting somewhere waiting to be used. Encryption in transit protects the first; encryption at rest protects the second. They defend against different threats, and a system that does only one has left a door open.
In transit: the sealed envelope
When you open a web page, upload a file or send an email, the data crosses networks you do not control: the café Wi-Fi, your internet provider, a dozen routers in between. Encryption in transit scrambles it for that journey so anyone listening in sees noise. On the web this is TLS, the padlock in the address bar and the https at the start of the link.
What it protects against: someone intercepting the connection. What it does not protect against: anything that happens once the data arrives. The envelope is opened at the other end.
At rest: the locked cabinet
Once the file lands on a server, a laptop or a backup drive, it is "at rest". Encryption at rest means it is stored scrambled, and only readable with a key held separately. If someone walks off with the disk, copies a backup, or a storage provider's staff browse the raw drives, they get unreadable data.
What it protects against: theft or exposure of the storage itself. What it does not protect against: someone who signs in as you. The system decrypts data for any authorised user, and a stolen password makes the thief an authorised user.
A quick comparison
| In transit | At rest | |
|---|---|---|
| Protects | Data moving across networks | Data stored on disks and backups |
| Typical threat | Eavesdropping on a connection | Lost laptop, stolen drive, leaked backup |
| You can check it by | The padlock and https | Asking the vendor, and checking your own devices |
| Does not stop | Misuse after arrival | A signed-in attacker |
The part people forget: their own devices
Small firms often have excellent encryption on their cloud tools and none on the laptop that syncs a copy of everything. Turn on full-disk encryption on every laptop and phone; modern operating systems include it, and it is usually one setting. The same goes for USB sticks and external backup drives, which are lost far more often than servers are breached.
Questions to ask a vendor
- Is all traffic encrypted in transit, including between your own services?
- Are stored files and database contents encrypted at rest, and are backups encrypted too?
- Who holds the keys, and who on your side can access decrypted data?
- If I export my data, is the export protected, and how long is it available?
Where encryption stops
Encryption protects data from people who should never see it. It does nothing against people who can sign in. That is the job of strong passwords, second factors and tight access rules: see password hygiene for small offices. And for especially sensitive items, the question is also whether you should be holding them at all, as covered in storing identity documents securely.
The short version: in transit and at rest are both table stakes. Ask for both, check your own devices, and then spend your real effort on who can sign in.
