Encryption at rest vs in transit
Also known as: at-rest and in-transit encryption, encryption at rest and in transit
Encryption at rest scrambles data while it's stored, on a laptop drive, phone, server, or cloud storage, so a stolen device or disk is unreadable without the key.
Encryption in transit protects data while it travels across networks, such as through HTTPS, TLS, or VPNs, so eavesdroppers can't read it. Most modern services use both. While encryption is essential, it only protects data from people without keys, so it won't stop someone who logs in with stolen credentials.
Encryption at rest vs in transit, explained at three levels
At home
Encryption at rest is like keeping your documents in a locked safe at home: anyone who breaks in and carries off the safe still can't read them. Encryption in transit is like sending documents in a locked armoured truck, so nobody can read them on the road. Your data needs both, scrambled while it sits on a device and while it travels across the internet.
At work
Encryption at rest scrambles data stored on laptops, phones, servers and cloud storage, so a stolen device or disk is unreadable without the key. Encryption in transit scrambles data moving across networks, using tools such as HTTPS and VPNs, so eavesdroppers cannot read it. Businesses care because both reduce the damage from lost devices and network snooping, and many regulations expect them.
At home
Encryption at rest protects data where it is stored. Your phone's storage is scrambled with a key that unlocks only with your passcode, so a thief who removes the storage chip sees nothing readable. Encryption in transit protects data as it travels. When you see the padlock in your browser, your connection uses TLS, so anyone on the same Wi-Fi sees only scrambled traffic. Each protects against different threats, so you need both.
At work
At rest, full-disk tools such as BitLocker and FileVault encrypt devices, while databases and cloud storage encrypt data with keys managed by the provider or customer. In transit, TLS protects websites, APIs and email between servers, VPNs protect network links, and SSH protects remote administration. Key management decides who can decrypt: the strongest algorithms mean little if keys sit next to the data or many people can read them.
At home
Encryption protects data from people who do not have the key, but you are the one holding it. If someone learns your password, signs in as you and opens your files, encryption unlocks for them just as it does for you, because they look like you. Phishing and stolen passwords therefore bypass encryption entirely. In my view, MFA and encryption work best as a team: one protects the data, the other protects the key.
At work
Enforce device encryption through MDM and store recovery keys centrally in Entra ID or Active Directory. Require TLS 1.2 or higher, disable legacy protocols, and enforce TLS between mail servers with MTA-STS. Consider customer-managed keys or hardware security modules for sensitive cloud data, accepting the added responsibility for key availability. End-to-end encryption goes further by keeping even the service provider from reading content, which affects compliance, search and eDiscovery.
Real-world examples
At home
Carlos left his laptop on a bus. Because BitLocker encrypted the drive, he knew his files were safe even though the laptop was gone.
At work
Aisha's Vancouver MSP enforced BitLocker on every client laptop and stored recovery keys in Entra ID, making lost-device incidents far less serious.
How it compares
| feature | Encryption at rest | Encryption in transit |
|---|---|---|
| Protects | Stored data | Data moving over networks |
| Guards against | Stolen devices or disks | Eavesdropping, interception |
| Examples | BitLocker, FileVault | HTTPS, TLS, VPN |
| Doesn't stop | Logged-in attackers | Compromised endpoints |
At rest guards stored data. In transit guards moving data.
For analysts
In vendor security questionnaires, I'd ask about both kinds of encryption and who controls the keys. 'We encrypt data' alone doesn't say enough.
History & origin
Encryption in transit became widespread on the web through SSL in the mid-1990s and its successor TLS, with HTTPS becoming the default for most websites by the late 2010s, encouraged by free certificates from Let's Encrypt from 2015. Full-disk encryption tools such as Microsoft's BitLocker, introduced with Windows Vista in 2007, and Apple's FileVault 2 in 2011 made encryption at rest practical for laptops. Smartphones encrypted storage by default from the mid-2010s. Cloud providers began encrypting stored data by default, and Amazon S3 applied default encryption to new objects in 2023. In my view, encryption has gone from specialist tool to background default, which is exactly where it belongs.