01. Encryption in transit
Encryption in transit protects data while it travels between systems. HTTPS uses TLS to protect browser-to-website connections and helps prevent intermediaries from reading or modifying traffic in transit.
02. Encryption at rest
Encryption at rest protects stored data, such as files on a device or information held by a service. Its protection depends on key management and the state of the device when data is accessed.
03. Authentication and trust
Encryption does not automatically prove who is on the other end. Authentication mechanisms, certificates, trusted key fingerprints, and verified communication channels help reduce impersonation risks.
04. Key management
Private keys and recovery codes should be protected from disclosure. Store recovery information securely, use reputable password managers, and maintain backups that are protected against unauthorized access.
05. Endpoint limitations
If a device is compromised, attackers may access information after it has been decrypted for use. Keep operating systems and applications updated, use device locks, and avoid untrusted software.
06. Encryption in transit, at rest, and end to end
In transit encryption protects data while it moves between endpoints, as HTTPS does between a browser and a website. At rest encryption protects stored data on a device or server, subject to how keys are managed and when data is unlocked. End-to-end encryption is designed so that only communicating endpoints hold the keys needed to read message content; the service may still observe metadata such as timing or account identifiers.
07. Public keys, private keys, and trust
Public-key cryptography allows parties to establish secure communication without first sharing a secret over the same channel. A public key can be distributed; its corresponding private key must remain protected. Certificates and trust stores help browsers associate a public key with a domain name. Encryption without authentication can still leave users vulnerable to communicating with an impostor.
08. Common misconceptions
- Encryption does not make a weak password strong.
- Encryption does not prevent malware or a person with access to an unlocked endpoint from reading data.
- HTTPS does not hide all metadata from the network, nor does it prove a website is honest.
- Strong cryptography can be undermined by poor key storage, insecure recovery, or implementation defects.
09. Practical key hygiene
Use reputable, maintained software; protect account recovery channels; enable device encryption; keep backups; and understand what happens if a device or recovery key is lost. For organizational systems, define key ownership, rotation, revocation, and incident procedures before a crisis occurs.
Primary reading: MDN: Transport Layer Security and NIST Cryptographic Standards. Last substantive review: 11 November 2026.