Encryption at rest is the practice of encrypting data while it is stored, for example on a disk, database, object storage or backup, as opposed to data in transit moving across a network.
Why it matters
If a laptop is lost, a disk is removed from a data center or a backup is copied, encrypted data stays unreadable without the key. Cloud providers usually offer it with a setting or by default. It does not protect against a logged-in attacker or a flawed application, since the system decrypts data for authorized use.
Example
A database server uses full-disk encryption with AES-256. The key is held in a separate key management service, so a stolen drive reveals only ciphertext.
Common mistakes
- Storing the key on the same server as the data.
- Believing it protects against SQL injection or stolen credentials.
- Encrypting production but leaving backups and logs unencrypted.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.