SECURITY
Encryption in transitProtecting data as it moves across a network
Encryption in transit protects data while it moves across a network, so that anyone able to observe the traffic cannot read or alter it. TLS is the dominant mechanism, securing HTTPS, mail and many other protocols; VPNs and SSH provide it at other layers. It is distinct from encryption at rest, which protects stored data.
What it protects against
When data crosses a network, it passes through equipment and links you do not control: Wi-Fi access points, switches, routers, ISPs. Anyone with access to that path can, in principle, read or modify unprotected traffic. Encryption in transit prevents both: an observer sees only ciphertext, and any tampering is detected.
It provides three things, depending on the mechanism:
- Confidentiality: the content cannot be read.
- Integrity: changes are detected and rejected.
- Authentication: with certificates, the client verifies it is talking to the right server (and optionally vice versa).
The main mechanism: TLS
TLS secures most encrypted traffic. It underlies HTTPS on port 443, and the secure mail ports 465, 587, 993 and 995, as well as LDAPS, DNS over TLS, and database and messaging protocols. TLS 1.2 and 1.3 are current; earlier versions are obsolete.
Other layers
| Mechanism | Layer | Typical use |
|---|---|---|
| TLS | Transport/application | Web, mail, APIs |
| SSH | Application | Remote shell, SFTP, tunnels |
| VPN (IPsec, WireGuard, OpenVPN) | Network | Site-to-site and remote-access tunnels |
| WPA2/WPA3 | Link | Wi-Fi between device and access point |
These can stack: HTTPS inside a VPN inside Wi-Fi encryption. Each protects a different segment.
What it does not cover
- Data at rest. Once data is stored, in-transit encryption no longer applies; that needs disk or database encryption.
- The endpoints. After the server decrypts a request, the plaintext is processed and possibly logged. Encryption in transit protects the journey, not the destination.
- Metadata. TLS hides content but not the fact that a connection happened, the destination address, or (usually) the server name. See HTTP vs HTTPS.
Getting it right
- Use current TLS versions and valid certificates; expiry is the most common failure.
- Prefer implicit-TLS ports or enforce STARTTLS so encryption cannot be silently skipped.
- Validate certificates; skipping validation (for example curl's
-k) defeats the authentication that makes the encryption trustworthy. - Combine with encryption at rest for sensitive data.
Encryption relies on hashing and key exchange internally; see hashing explained and authentication basics.
Frequently asked questions
What is the difference between encryption in transit and at rest?
In transit protects data while it travels across a network (TLS on the wire). At rest protects stored data (disk encryption such as BitLocker, database encryption). They address different threats and are complementary; sensitive data usually needs both.
Does HTTPS mean my data is completely private?
It protects the data between your browser and the server: nobody on the path can read or change it. It does not protect the data once the server decrypts it, and it does not hide which server you connected to. See HTTP vs HTTPS.
Is a VPN the same as encryption in transit?
A VPN is one way to provide it: it encrypts traffic between your device and the VPN endpoint. Beyond that endpoint, traffic travels normally, protected only by its own encryption (such as HTTPS). A VPN protects the first leg and hides your traffic from the local network, not the entire path.