Encryption at Rest
Definition
Encryption at rest means that what is physically written to storage is ciphertext rather than the file itself. The usual algorithm is AES with a 256-bit key, applied per object in object storage or per volume on a disk. Keys are almost never used directly: a data key encrypts the object, and that data key is itself encrypted by a master key held in a key management service, an arrangement called envelope encryption that makes rotating keys practical without rewriting every file. Most cloud storage now does this by default, transparently, so a file uploaded today is encrypted without anyone choosing it. What it defends against is narrow and specific: someone obtaining the physical medium or a raw copy of it — a stolen drive, a decommissioned disk, a misplaced backup — not someone who has a valid credential or a public link.
Why It Matters
The value is in the failure cases you cannot otherwise cover. Data centres retire thousands of drives; backups get copied to secondary locations; a snapshot ends up in the wrong bucket. Encrypted, those events are an inventory problem; unencrypted, they are a breach with notification duties attached. Under the GDPR, encryption is named as one of the measures that can make a personal data breach less likely to require telling the individuals affected, which is a concrete difference in what a bad week looks like. What it does not do is more important to state plainly, because people confuse it constantly: a file served at a public address is decrypted by the storage layer and handed to anyone who asks. Encryption at rest is not access control and never has been.
How It Works
On upload, the storage service generates a data key, encrypts the object with it, encrypts the data key with a master key, and stores the wrapped key beside the object's metadata. On download it reverses that, decrypts the object in memory and streams the plaintext out over the connection — which is why encryption in transit has to cover the second half of the journey. Keys live in a managed service with their own access rules and audit trail, and can usually be rotated on a schedule, which re-wraps data keys rather than re-encrypting terabytes. Some providers let you supply your own master key, which gives you a switch: destroy the key and the objects become unreadable, which is a useful form of deletion when the same bytes exist in several backups. Everything in this chain is invisible to a visitor, since nothing about the stored form changes what a browser receives.
Real-World Example
A clinic uploads a patient information leaflet and a staff handbook, publishing only the leaflet at clinic-info.99helpers.site while the handbook stays unpublished in the account. Both sit encrypted on disk, so a drive leaving the data centre carries no readable content. The leaflet is still public to anyone with the address, because encryption at rest changed nothing about who may fetch it — the handbook is private because it was never published and sits behind a password-protected link when shared. On 99helpers those are two separate decisions, and only the second one controls access.
Common Mistakes
- ✕Believing encrypted storage makes a public file private — the server decrypts on the way out and serves it to whoever asked
- ✕Encrypting the primary store and forgetting the backups, snapshots and the export bucket, which is where copies actually go missing
- ✕Keeping the key in the same place as the data, or in the application's configuration file — at that point it is a lock with the key taped to it
Related Terms
Encryption in Transit
Protecting data while it moves across a network, so that anyone between the two ends sees scrambled bytes. On the web this is TLS, which is what the S in HTTPS refers to.
Data Residency
Where data physically sits — which country's disks hold it, and therefore whose laws reach it. Buyers ask about it because a storage location carries a jurisdiction with it.
Two-Factor Authentication
Requiring a second proof of identity alongside the password, so that a stolen password on its own is not enough to get in. The second proof is usually a code from an app or a key held on a device.
Object Storage
Object storage keeps each file as a self-contained object — its bytes, its metadata and a key that names it — inside a flat container reached over HTTP. There is no directory tree and no file handle to open, seek and write.
Password-Protected Link
A hosted address that asks for a shared secret before it will show the file or site behind it. One password covers everyone who has the link; there are no individual accounts.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →