Encryption at rest and in transit
Scrambling data twice: once while it sits on disk, once while it crosses the network. A stolen drive or a sniffed connection gets noise.
See it
What it is
Two different jobs with one word. In transit means the data is scrambled while it moves: HTTPS/TLS between browser and server, TLS between your app and its database, encrypted connections to every third-party API. At rest means the data is scrambled while it sits: disk-level or column-level encryption on the database, the object store, the backups, and the log archives everyone forgets.
In practice both are mostly a config switch now. Force HTTPS with a redirect plus HSTS, keep TLS 1.2 as the floor and prefer 1.3, and turn on the AES-256 storage encryption your provider ships (RDS, Cloud SQL, S3, Supabase all have a box to tick). Keys live in a managed KMS or vault, never in the repo. Encrypt the backups too, because a backup is just your database with worse access control.
Gotcha: know what at-rest encryption is actually covering. It defends the stored copy, which is a real list: a stolen disk, a leaked snapshot, a backup file, decommissioned or resold media, and some low-level storage exposure underneath the database. What it does not touch is access through an authorized application or database session. Your app queries with valid credentials, so a leaked connection string or a SQL injection reads plaintext no matter how encrypted the volume is. If you need protection from yourself and your host, that is end-to-end or application-layer encryption, and it costs you search, sorting, and analytics.
Ask AI for it
Audit and fix encryption in this project for both states. In transit: force HTTPS with a 301 redirect, add a Strict-Transport-Security header with a one-year max-age in production only, and add includeSubDomains only after you have verified that every subdomain already serves TLS. Require TLS 1.2 minimum (prefer 1.3). For database and cache connections require full certificate and hostname verification (sslmode=verify-full with a CA bundle, not sslmode=require, which encrypts without proving who answered). At rest: enable AES-256 storage encryption on the database, object storage, and automated backups. Encrypt columns holding secrets we must be able to read back (OAuth refresh tokens, third-party API keys), and hash rather than encrypt anything we only ever compare (passwords with argon2 or bcrypt, password reset and one-time verification tokens). Move all keys into a managed KMS or secret store with rotation, and remove any key committed to the repo. Output a checklist of what was already on, what you changed, and what still needs a provider console click.