When a service promises your data is “encrypted at rest,” it is making a specific promise: even if someone walks off with the hard drive, what is on it stays unreadable. It is one of two places your data gets protected, and knowing the difference helps you judge how safe a service really is. Our GetMyPassword team explains what encryption at rest means in plain terms.
What “at rest” means
Your data exists in two main states, and each can be encrypted. At rest means stored somewhere — on a disk, a server or your phone. In transit means moving across a network, like when a page loads over HTTPS. Encryption at rest scrambles stored data so it is useless without the key. Copy the drive, steal the server, grab the backup — without the key it is just noise.
Why it protects you
Not every breach is a clever hack; sometimes a laptop is lost or a backup drive is stolen. Encryption at rest is the safety net for exactly those moments. If a thief gets the physical storage but not the key, your data stays locked. It is why a lost phone with device encryption on is far less of a disaster than one without — the finder sees a brick, not your life.
Where you meet it every day
- Your phone and laptop encrypt their storage, so a lock screen actually protects what is inside.
- Reputable services encrypt their databases, so a stolen copy is not an instant leak.
- Encrypted backups keep your files safe even if the backup itself is lost.
- Password managers store your vault encrypted at rest, locked by your master password.
Encryption at rest guards the data; your password guards the door. A service can encrypt every disk perfectly, and a weak, reused password still hands an attacker the key by simply letting them log in as you.
What it does not do
Encryption at rest protects stored data from someone who grabs the storage — not from someone who simply logs in as you. If an attacker has your password or your unlocked device, the system decrypts everything for them, because to it they look like you. That is why the encryption only pays off when it sits behind a strong, unique password from our password generator and two-factor authentication. Turn on device encryption, choose services that encrypt at rest, and guard the password that unlocks it all.
Frequently asked questions
What is encryption at rest?
It is encryption of data while it is stored — on a disk, server or phone — so the data is unreadable without the key. If someone steals the drive or copies the database, they get only scrambled noise.
How is it different from encryption in transit?
At rest protects data while it is stored; in transit protects data while it moves across a network, like a page loading over HTTPS. Strong services use both — one for the database, one for the connection.
Does encryption at rest make my account unhackable?
No. It protects stored data from someone who steals the storage, but not from someone who logs in as you. If an attacker has your password or unlocked device, the system decrypts everything for them, so a strong, unique password and two-factor authentication still matter.