Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsClient-side encryption protects data before it reaches a cloud storage service; server-side encryption is performed within the provider’s service. That difference determines which systems can handle plaintext and who must keep the keys available. Customer-managed server-side keys add customer controls over key use and lifecycle, but they do not move encryption to the client or, by themselves, prove the provider cannot process plaintext.
What is the difference between client-side and server-side encryption?
The distinction is where encryption happens in the data path—not simply whether a customer has some control over keys.
As an Amazon Associate I earn from qualifying purchases.
- Client-side: An application or client encrypts data before sending it to the cloud. The storage service receives ciphertext and does not know the client-side key. Google Cloud describes this model for Cloud Storage and its Tink workflow (Google Cloud: Client-side encryption with Tink and Cloud KMS; Google Cloud: Client-side encryption keys).
- Server-side with provider-managed keys: The storage service encrypts data as part of its storage process and manages the keys. In Google’s Datastore example, data is encrypted before it is written to disk and transparently decrypted for authorized reads (Google Cloud: Server-Side Encryption).
- Server-side with customer-managed keys (CMEK): The service still performs the storage encryption integration, but the customer controls selected key settings and lifecycle actions where the service supports them. Google characterizes CMEK as server-side symmetric envelope encryption (Google Cloud: Customer-managed encryption keys (CMEK)).
These are architectural patterns, not universal descriptions of every provider’s implementation. Check the documentation for the exact storage service, supported key type, and operations you plan to use.
How does the data path work?
Client-side encryption
The client encrypts the content before upload. When the object is retrieved, the service can remove its own at-rest encryption layer, but the customer’s client-side layer remains; an authorized customer-side process must decrypt it. Google Cloud says the customer creates and manages these keys and that Cloud Storage does not know them (Google Cloud: Client-side encryption keys).
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
This creates separation between the storage provider and the client-side content key. It is not an absolute guarantee that no provider-side component or administrator can ever encounter plaintext: the application, endpoint, identity, and any authorized decrypting process are also part of the trust boundary.
Server-side encryption
The storage service handles encryption and decryption within its service boundary. In the cited Datastore example, authorized reads work normally because the service decrypts the data transparently. This can preserve service operations that need readable data, whereas client-side ciphertext may restrict provider-side querying, indexing, search, or processing. The impact depends on the product and workload; verify the specific feature rather than assuming it works with client-encrypted content.
At-rest encryption is distinct from encryption in transit. Google’s Datastore documentation separately describes TLS for read and write operations, so consider both protections rather than treating one as a substitute for the other (Google Cloud: Server-Side Encryption).
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
Who holds and manages the keys?
| Choice | Where encryption happens | Key responsibility | What this means for plaintext access |
|---|---|---|---|
| Client-side encryption | In the application or client, before upload | The customer creates, protects, backs up, and uses the client-side keys. | Storage receives client-encrypted bytes. The provider does not know the client-side key, but plaintext may exist in authorized clients or other parts of the system. |
| Provider-managed server-side encryption | Within the storage service | The provider manages the storage encryption keys. | The service can transparently decrypt for authorized operations, as in Google’s Datastore example. |
| Customer-managed server-side keys | Within the provider’s compatible service integration | The customer controls selected key creation, access, and lifecycle settings; exact controls vary by integration. | Customer key controls do not by themselves establish client-side encryption or prove the service cannot handle plaintext during authorized operations. |
These descriptions reflect the cited Google Cloud documentation; capabilities and boundaries differ by service. Google’s default-encryption documentation describes its own key hierarchy, not a universal provider design (Google Cloud: Default encryption at rest).
How envelope encryption uses DEKs and KEKs
Envelope encryption separates bulk data encryption from protection of the key that encrypts it. A data encryption key (DEK) encrypts the content; a key encryption key (KEK) wraps the DEK. The stored material can include the encrypted content and wrapped DEK, while access to the KEK is controlled through a key-management system.
In Google’s Tink example, Tink generates the DEK locally, encrypts the message, and asks Cloud KMS to wrap the DEK. On decryption, the wrapped DEK is unwrapped and then used to decrypt the message (Google Cloud: Client-side encryption with Tink and Cloud KMS). Envelope encryption can therefore be used in a client-side design; the term itself does not mean encryption occurred on the server.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- Generate DEKs locally and use a new DEK when writing data, as Google recommends for its envelope-encryption guidance.
- Keep a wrapped DEK near the data it protects, while protecting the KEK through a central key-management service.
- Plan for the KEK service, its permissions, and its availability: without successful access to unwrap the DEK, the content may not be decryptable.
- Set rotation and incident procedures for the workload. Google recommends regular KEK rotation and rotation after a suspected incident, but the right schedule and migration behavior depend on the service and wrapping design (Google Cloud: Envelope encryption).
How to choose an encryption model
Start with the required trust boundary, then test whether the operational burden and service behavior fit the workload. Google’s CMEK recommendation is framed around wanting a cryptographic boundary around cloud data; it is guidance for compatible Google Cloud services, not a universal requirement (Google Cloud: Recommended practices for using CMEKs).
Free tools Windows power users keep installed
One-click scans. No signup required.
| Decision question | Client-side | Provider-managed server-side | Customer-managed server-side |
|---|---|---|---|
| Must encryption happen before upload? | Designed for this boundary. | No; the service performs encryption. | No; the service integration remains server-side. |
| Who operates key recovery? | Customer, including backup and recovery of client-side keys. | Provider manages storage keys. | Customer manages selected key policies and lifecycle controls; provider integration still matters. |
| Must the storage service process readable data for its features? | Potentially limiting if a feature needs plaintext; verify queries, indexing, search, and processing requirements. | Authorized service operations can use transparent decryption in the cited example. | Generally follows the service integration model, subject to product compatibility and key availability. |
| What operational work is most important? | Application integration, key availability, recovery testing, and secure decryption paths. | Confirm service coverage and access controls. | Key permissions, lifecycle, availability, audit, and service compatibility. |
Also weigh data sensitivity, threat model, contractual or regulatory requirements, availability objectives, audit needs, and the team’s ability to operate and recover keys. A key-control feature is useful only if the organization can manage its permissions and recovery without making legitimate access unreliable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Failure modes and practical safeguards
Lost or unavailable client-side keys
Google warns that losing client-side keys means Cloud Storage objects encrypted with them can no longer be read (Google Cloud: Client-side encryption keys). Before production, test backups and recovery with the same roles and procedures that will be available during an outage. Do not rely on an untested key copy as a recovery plan.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Compromised clients or overly broad decrypt access
Client-side encryption does not protect data from a compromised application or endpoint that is authorized to decrypt it. Restrict which identities can decrypt, protect the runtime that uses the keys, and review authorization paths as part of the design.
KEK dependency and rotation surprises
Envelope encryption makes decryption dependent on access to the KEK and its key-management service. Test availability and recovery procedures. Do not assume that rotating a KEK always requires rewriting all encrypted data—or that it never does: migration behavior depends on the service and wrapping design. Follow the product-specific instructions (Google Cloud: Envelope encryption; Google Cloud: Customer-managed encryption keys (CMEK)).
Misreading “customer-managed”
Customer-managed describes selected controls over keys in a provider integration. It does not, on its own, mean the customer encrypts before upload or that provider software cannot handle plaintext during authorized operations. Confirm where the service encrypts and decrypts, and which permissions govern key use.
Questions to settle before deployment
- Which components can see plaintext during upload, storage operations, retrieval, and application processing?
- Who can authorize decryption, and how are those identities protected and audited?
- How will keys be backed up, recovered, rotated, disabled, and—if required—destroyed?
- What happens to reads and writes if the key-management service or required permissions are unavailable?
- Do required queries, indexes, searches, or processing features work with the chosen encryption boundary?
- Does the exact service and region support the key configuration and lifecycle controls your policy requires?
Google’s key-management deep dive describes its own key hierarchy and control options; treat those details as provider- and service-specific (Google Cloud: Cloud KMS encryption and key management deep dive).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
