What Each Term Actually Means
Encryption is the process of scrambling data into an unreadable format so that only someone with the correct key can decode it. But where that scrambling happens — and when — is what separates these two concepts.
Encryption at rest applies to data that is sitting still: stored on a hard drive, a server, a smartphone, or in a cloud database. Think of it as a combination lock on a filing cabinet. Even if a thief walks off with the entire cabinet, they can't read what's inside without the code. This type of encryption is what a cloud storage service uses to protect your files when they're saved on its servers. If you're curious how those files get there in the first place, our guide to what cloud storage actually means explains the mechanics clearly.
Encryption in transit (sometimes called encryption in motion or in flight) protects data while it's actively moving from one point to another — between your browser and a website, between your email app and a mail server, or between two devices on a network. Imagine sending a letter inside a locked box that only the recipient can open. Even if someone intercepts the box mid-delivery, they can't access the contents. HTTPS — the padlock icon you see in your browser's address bar — is the most visible everyday example of this protection.
| Criterion | Encryption at Rest | Encryption in Transit |
|---|---|---|
| When it applies | Data stored on a device or server | Data actively moving between points |
| Main threat it counters | Server breaches, stolen hardware | Network interception, eavesdropping |
| Common example | Encrypted cloud database, FileVault | HTTPS, TLS email, secure messaging |
| Visible to users? | Rarely — check privacy policy | Yes — HTTPS padlock in browser |
| Protects against physical theft? | Yes | No |
| Protects on public Wi-Fi? | No | Yes |
The Threats Each Type Guards Against
These two layers of encryption exist because attackers can strike at very different moments in a data's life.
Encryption at rest defends against threats like data breaches targeting servers, stolen laptops or hard drives, and unauthorized physical access to storage infrastructure. If a company's database is hacked but the data inside is properly encrypted at rest, the attacker typically gets nothing usable — just scrambled text without the decryption key.
Encryption in transit defends against interception attacks — where someone positions themselves between you and the service you're communicating with to eavesdrop on the data stream. This is especially relevant on public Wi-Fi networks, where traffic can be more easily observed. Combining encryption in transit with other tools compounds your protection; VPNs and similar privacy tools can add another layer over the encrypted connection itself.
83%
Share of breaches involving stored data
According to Verizon's Data Breach Investigations Report, the vast majority of breaches target data at rest in databases and file systems.
~95%
Web traffic now encrypted in transit
Google's Transparency Report has consistently shown that the majority of web traffic loaded in Chrome uses HTTPS, reflecting widespread adoption of in-transit encryption.
A service can have one without the other. A website might use HTTPS to protect data as it travels to their server, but then store your information unencrypted in their database — leaving it vulnerable if that database is ever breached. Conversely, a system might store your data securely but transmit it over an unencrypted connection. The strongest services implement both.
How to Recognize Both in Services You Already Use
You don't need a technical background to spot these protections — or notice when they're missing.
Signs of encryption in transit:
- URLs that begin with
https://rather thanhttp:// - A padlock icon in your browser's address bar
- Email services that advertise TLS (Transport Layer Security) support
Signs of encryption at rest:
- A service's privacy or security policy explicitly states that stored data is encrypted
- References to AES-256 or similar encryption standards in documentation
- Device settings like FileVault (Mac) or BitLocker (Windows) applied to local storage
End-to-End Encryption Is a Separate Category
You may have seen the phrase end-to-end encryption (E2EE) used in messaging apps. This is a specific implementation that combines both concepts: data is encrypted on your device before it travels, and it can only be decrypted by the intended recipient — not even the service provider in between can read it. E2EE is generally considered a stronger standard for private communications than standard in-transit encryption alone, because it removes the service provider from the chain of trust entirely.
Neither type is visible in day-to-day use — which is the point. When encryption is working properly, you shouldn't notice it at all. The goal is to know what questions to ask and where to look when evaluating a new app or service. Building this habit pairs well with broader online privacy habits that reinforce your security over time.
It's also worth noting that encryption alone doesn't guarantee security. Weak passwords, phishing attacks, and unpatched software are all separate vulnerabilities. Encryption works best as one layer in a broader approach — alongside tools like two-factor authentication, which protects your account access regardless of how the underlying data is stored or transmitted.
When you're away from home — especially on trips where you rely on hotel or airport Wi-Fi — knowing that a service uses encryption in transit becomes particularly important. Our guide to protecting your devices and data while traveling covers practical steps for staying safer on the road.
