Glossary

Encryption at rest

Also called: Data-at-rest encryption, Storage encryption

Encryption at rest means data is stored in encrypted form on disks or in databases, so anyone who obtains the stored files without the key sees scrambled data instead of readable content.

Reviewed September 24, 2026

Where it fits: the three states of data

Security people talk about data in three states. In transit is data moving across a network, protected by TLS (the padlock in your browser). At rest is data sitting in storage — a database, a disk, a backup. In use is data being processed in memory. Encryption at rest covers the second state only.

A database backup is leaked or stolen — the attacker gets ciphertext.
An old disk is thrown away or lost — the data on it is unreadable.
Someone gets access to raw storage but not the application's keys.

Encryption at rest can happen at different layers: the whole disk, the database, or individual fields such as message bodies. Field-level encryption is the narrowest and the most targeted — even someone who can query the database sees scrambled text in the encrypted columns unless they also have the key.

What it does not protect against

The service that encrypts the data also holds the keys, because it needs to decrypt the data to use it — to deliver a message, show it on a new device or review a report. So encryption at rest does not stop the service itself, anyone who compromises the running application, or a legal demand made to the provider. That is the core difference from end-to-end encryption, where only the users' devices hold the keys.

Encryption at rest compared with end-to-end encryption

Question	At rest	End-to-end
Who holds the keys?	The service	Only the participants' devices
Can the service read content?	Yes, when it decrypts it	No
Protects a stolen database?	Yes	Yes
Server-side search, previews, review of reports	Straightforward	Hard or impossible

Who holds the keys?: At rest:The service; End-to-end:Only the participants' devices

Can the service read content?: At rest:Yes, when it decrypts it; End-to-end:No

Protects a stolen database?: At rest:Yes; End-to-end:Yes

Server-side search, previews, review of reports: At rest:Straightforward; End-to-end:Hard or impossible

Common confusion

On Asyncbit

Asyncbit messages are encrypted at rest on the server using Fernet (AES-128-CBC with HMAC-SHA256 authentication), so message bodies are not sitting in plain text in the database. It is not end-to-end encryption: the server can decrypt messages to deliver them, and moderators can review messages that are reported. Push notification previews stay generic (“New message”) instead of showing the text. See messaging and safety and privacy.

See it for yourself

Asyncbit is free, with no paid tier and no ads. Everything described here is available from the first day.

Create your free account