Windows Security · BitLocker & Encryption · Lesson 4 of 5

Encryption Everywhere

See where else encryption guards your data, and who holds each key.

At rest and in transit

Your data spends its life in two states, and each one needs its own lock.

Data at rest is stored somewhere and sitting still. Files on your laptop's drive, photos on a USB stick and documents in a cloud folder are all at rest. BitLocker, device encryption and BitLocker To Go protect data at rest.

Data in transit is moving from one place to another. When you load a web page, send an email or upload a photo, your data travels across Wi-Fi and the internet. Along the way, it passes through many computers you don't own.

You've already met the main lock for data in transit: HTTPS. The padlock in the address bar means the connection between your browser and that site is encrypted. Someone on the same café Wi-Fi sees scrambled traffic, not your password.

The two locks cover different moments, so you need both.

• An encrypted laptop sending a password over a plain, unencrypted web page still leaks the password on the way.
• A website with HTTPS still leaves your downloaded files unprotected on an unencrypted laptop.

Remember the padlock lesson too. HTTPS only means the trip is private. It doesn't prove the site is honest. A fake bank site can have a padlock.

Other in-transit locks work quietly in the background. Your home Wi-Fi uses WPA2 or WPA3 to encrypt traffic between your devices and your router. Windows Update downloads updates over encrypted connections. Most email services encrypt messages as they travel between servers.

A simple way to remember it: at rest is the safe, in transit is the armored truck. Your data needs a lock in both places.

Phones, clouds and who holds the keys

Your phone is already ahead of many laptops. Recent iPhones and most recent Android phones encrypt their storage by default once you set a screen lock. As you learned in the Mobile tracks, your passcode is part of what unlocks the data. A strong passcode means a strong lock.

Cloud storage is a bit different. Cloud storage means your files live on a company's computers, like OneDrive, Google Drive or iCloud. Big providers encrypt your files at rest on their side and in transit to you. The real question is who holds the key.

• The company holds the key. This is the usual setup. It's convenient. The company can help you get back in if you forget your password, and you can open files from any browser. But it also means the company could open your files if it chose to, or if a court ordered it.
• Only you hold the key. This is called end-to-end encryption. Your files are locked on your device before they leave, and only your devices can unlock them. The company stores scrambled data it can't read. Apple's Advanced Data Protection for iCloud works this way, as do chats in apps like Signal.

End-to-end encryption has a price. If you lose every device and every recovery method, nobody can help you. It's the recovery key lesson again.

Neither choice is wrong. Many people keep most files in normal cloud storage, and use end-to-end options for the most private ones.

Whichever you choose, your cloud account is the front door. Protect it with a strong password, two-step verification or a passkey. Encryption can't help if a thief signs in as you.