Data Encryption

These are two different threat models with two different controls — TLS defends against an eavesdropper between the user and the server, while at-rest encryption defends against someone who later steals a database backup, a decommissioned hard drive, or a cloud storage snapshot.

TLS protects data while it moves; at-rest encryption protects it while it sits — an app needs both, not one or the other

A stolen encrypted database backup is useless without the separately-stored decryption key — key management is the actual security boundary, not the encryption algorithm choice

Encrypting a field doesn't help if the application logs the plaintext value on its way in, or if backups store an older, unencrypted copy

Field-level encryption (encrypting just the sensitive columns) limits blast radius even if the whole database is later exposed

Hands-on demo

Steal a database backup

Toggle encryption at rest, then simulate an attacker who gets hold of a full backup file — see what they actually walk away with.

Try it yourself

Try it yourself — run a scenario below, then flip this and replay it to see what changes.

Checkout Over TLS

A payment form submitted over HTTPS is unreadable to anyone intercepting the connection.

Want this flow explained in detail as it plays?

https://checkout.flowground.dev

Checkout

Card

4242 4242 4242 4242

Browser

Server

Attacker

Before any form data is sent, the browser and server agree on encryption keys that only the two of them know.

Selected hop

Browser initiates a TLS handshake

Browser

The user's browser — where every request actually originates and every response is rendered.

Server

Handles the request server-side — the only place a check can't be bypassed by the client.

What happens here

Before any form data is sent, the browser and server agree on encryption keys that only the two of them know.