Choose the encryption layer according to who must be unable to read the plaintext. Encrypt in the application or client before data reaches a database or storage service when those operators should not see selected values. Use database column encryption when its product-specific query limits fit and keys can be kept from database administrators. Use storage-side encryption for protection of stored objects or media, not as a guarantee that the service or an authorized workload cannot access plaintext. These layers can be combined when each protects a different exposure path.
Start with the plaintext boundary
Encryption protects data at a particular point in its lifecycle. “Encryption at rest” generally means stored media or objects are encrypted; it does not mean an authorized database or storage service cannot decrypt data to return it to an application. Encryption in transit protects a different path. Field or column encryption can restrict access to selected values, while client-side or end-to-end encryption can keep usable keys and plaintext outside a service.
Before choosing a layer, name the people and systems that should not see plaintext: for example, a database administrator, a cloud storage service, an application operator, or an attacker with access to a stolen disk. Then identify which components must still process the protected values. Those two answers determine the viable design more than the word “encryption” in a product setting.
Application vs. database vs. storage encryption
| Layer | Where plaintext is kept from | What to expect for queries and access | Best fit |
|---|---|---|---|
| Application/client-side | Database or storage engine, if encryption occurs before data is sent there | The trusted client must decrypt and perform operations that are not supported on ciphertext; server-side search and analytics can be constrained | Selected values that database or storage operators should not read |
| Database column | Depends on the database feature, encryption mode, driver, and key custody | Capabilities vary by product. Some modes restrict operations; others may enable selected processing under specific configurations | Database fields requiring a defined confidentiality boundary and compatible database workflows |
| Storage/server-side | Stored media or objects; the storage service remains in the access path | Usually transparent to an authorized application, which can receive decrypted data | Broad protection for stored files, objects, or disks against exposure of the underlying media |
The table describes common trust boundaries, not a universal guarantee for every vendor feature. Verify the exact product, mode, deployment, and key configuration before treating a layer as protection from a particular administrator or service.
#1 Best Overall
- Encrypt your data with the cloudAshur to ensure the ultimate protection of your data stored in the cloud, on your PC/MAC, transferred as an email attached or file sharing software
- Share your encrypted data security with authorised users in the cloud, via email and file transfer services using the cloudAshur KeyWriter (not included)
- Manage and monitor your cloudAshur devices centrally using the cloudAshur Remote Management Console (not included)
- cloudAshur eliminates data security vulnerabilities associated with cloud platforms, such as lack of control and unauthorised access to your confidential data.
- Take back control of your data - with the cloudAshur, you hold the KEY to your data!
When application or client-side encryption is the right boundary
With application-side field encryption, a trusted client encrypts a value before it is sent to the database or storage service. If the service receives only ciphertext and does not have usable keys, its operators and engine cannot simply read that value through normal access. This is the strongest fit among the three layers when the service itself is outside the plaintext trust boundary.
Plan around restricted data operations
Once values are ciphertext, the database cannot perform ordinary operations on their plaintext unless the design deliberately enables an appropriate mechanism. Exact-match lookup, sorting, range filters, joins, aggregation, pattern matching, and analytics each need to be considered individually. Do not assume that encrypting a column preserves its prior query behavior. Decide which operations are essential, test them with the selected encryption approach, and keep any queryable or unencrypted fields to the minimum needed.
Account for trusted clients and key availability
This design moves responsibility to the application and its key-management path. A client that can decrypt data must be trusted with access to the relevant key or a service that can use it. Define how applications obtain keys, which identities are allowed to decrypt, and what happens during outages, rotation, revocation, and recovery. If a client is compromised while it has plaintext or key access, encryption at the database boundary does not make that client safe.
Rank #2
- Sovereign Self-Custody HSM: Personal hardware security module that encrypts secrets offline without relying on servers or third-party infrastructure
- Offline PSBT Signing: Sign Bitcoin PSBT transactions with deliberate human verification and dual air-gap security, minimizing attack surfaces
- No Telemetry, No Metadata Leakage: Designed with zero telemetry, zero balance auditing, and zero backend dependency for maximum privacy
- AES-256-GCM Cryptography: Seed phrases are encrypted offline with advanced AES-256-GCM; secrets never touch internet-connected systems
- Supports Any Wallet: Works seamlessly with existing wallets that expose recovery seeds (Ledger, Trezor, Coldcard, Jade, etc.)
AWS distinguishes server-side S3 encryption from its S3 Encryption Client: the latter encrypts before upload, so the object is not exposed to AWS in plaintext through that client-side design. The customer specifies how wrapping keys protect data keys. This is a different trust boundary from asking S3 to encrypt an object after it arrives.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhen database column encryption fits
“Database encryption” is not one behavior. Products differ in where encryption occurs, whether the database engine can use keys, and which operations remain available. Confirm the supported database edition or service, driver, client library, mode, and deployment rather than generalizing from the feature name.
SQL Server Always Encrypted illustrates the trade-off
Microsoft’s Always Encrypted encrypts sensitive values in the client driver before they reach SQL Server. The database engine does not hold the plaintext keys. In standard Always Encrypted, deterministic encryption permits equality comparisons; pattern matching and richer server-side operations are not supported in the database. Microsoft’s documentation describes secure enclaves as an option for selected computations over plaintext in a protected memory region, subject to supported platforms and enclave configuration. These are product-specific properties, not a description of all column-encryption systems.
Rank #3
- 🔧TPM 2.0 (20pin-1) Compatible For B450、B450M；B450 AORUS ELITE、B450 AORUS Elite V2、B450 AORUS M B450 AORUS PRO、B450 AORUS PRO WIFI、B450 Gaming X、B450M DS3H、B450M DS3H V2
- 🔧Chipset:SLB9665 Compatible For B450、B450M；B450 AORUS ELITE、B450 AORUS Elite V2、B450 AORUS M B450 AORUS PRO、B450 AORUS PRO WIFI、B450 Gaming X、B450M DS3H、B450M DS3H V2
- 🔺Important Notes: This product is only compatible with older motherboards such as INTEL and AMD. It is not compatible with newer motherboard models featuring firmware TPM, all-in-one computers, or laptops.
- 🔺Important Notes: The minimum hardware requirements for upgrading to Windows 11 via TPM 2.0 are as follows: a 1 GHz or faster 64-bit processor (dual-core/multi-core), 4 GB of RAM, 64 GB of storage space, firmware supporting UEFI Secure Boot and TPM 2.0, a DirectX 12-compatible graphics card, and a display with a resolution of 720p or higher.
- 🔧Purpose a: Resolve TPM 2.0 verification issues when upgrading to Windows 11, enabling it to function as an independent encryption chip, providing secure storage for sensitive data, and enhancing overall security;
Map required queries before selecting a mode
List every operation the application performs on the protected field: filtering, sorting, joining, indexing, range comparisons, aggregation, or pattern matching. Validate each against the exact encryption mode and supported driver. If the required operation is unavailable, options include changing the application workflow, minimizing what is encrypted, or selecting a supported feature with an explicitly understood security boundary. More capable processing is a platform and security design choice, not an automatic benefit of encrypting a column.
When storage-side encryption is enough—and when it is not
Server-side storage encryption is appropriate when the goal is to protect stored objects or media while allowing the service to decrypt them for authorized access. It is typically transparent to the application. It does not, by itself, hide plaintext from workloads or service operators that have normal access to the data.
Free tools Windows power users keep installed
One-click scans. No signup required.
For Amazon S3 SSE-KMS, AWS documents an envelope-encryption flow: KMS generates a data key and an encrypted copy; S3 encrypts the object with the plaintext data key and stores the encrypted data key with the object. On retrieval, KMS decrypts the data key and S3 uses it to decrypt the object. Customer-managed KMS keys provide more control over access, disabling, rotation, and auditing than the default AWS-managed key, while requiring additional permissions and operational ownership. AWS says KMS keys used for S3 must be in the bucket’s Region; KMS charges may apply. AWS also documents that SSE-KMS objects encrypted with AWS-managed keys cannot be shared cross-account, whereas customer-managed keys can be configured for cross-account access.
Rank #4
- Applicable Systems: TPM2.0 encrypted security module is available for for 11 motherboards. Some motherboards require the TPM module to be inserted or updated to the latest BIOS to enable the TPM option.
- Encryption Processor: The TPM is a standalone encryption processor that is connected to a Sub board attached to the motherboard. The TPM securely stores an encryption key that can be created using encryption software such as for BitLocker. Without this key, the content on the user's PC will remain encrypted and protected from unauthorised access.
- SPEC: Replacement TPM 2.0 module chip 2.0mm pitch, 14 pin security module for motherboards. Built in support for memory modules higher than DDR3!
- Support: Supports for 7 64 bit, for 8.1 32 64 bit, for 10 64 bit. Advertised performance is based on the maximum theoretical interface value for each chipset vendor or organization that defines the interface specification. Actual performance may vary depending on your system configuration.
- Standard PC Architecture: A certain amount of memory is set aside for system use, so the actual memory size will be less than the specified amount. Functionality is the same as the original version. Supported states may vary depending on motherboard specifications.
AWS states that using an S3 Bucket Key for SSE-KMS can reduce AWS KMS request costs by up to 99 percent. That is an AWS product-specific maximum claim, not a general encryption-cost estimate or guaranteed saving. Check current pricing and the workload’s request pattern before using it in a cost decision.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep keys separate from ciphertext
Key custody determines whether encryption creates a meaningful access boundary. OWASP’s Cryptographic Storage Cheat Sheet advises storing keys separately from encrypted data where possible. It recommends secure storage such as an HSM, virtual HSM, key vault, or external secrets-management service where available, and cautions against hard-coding keys, checking them into source control, or exposing them through configuration.
Envelope encryption is a common way to separate roles: a data encryption key (DEK) encrypts the data, and a separate key-encryption key (KEK) protects the DEK. The KEK should be held separately from the DEK. Separation reduces the chance that access to only the database or only the key store exposes both the ciphertext and what is needed to decrypt it.
Recommended Free Tools
Best Value
- TPM 2.0 Module 18pin-1 LPC SLB9665, TPM 2.0 Encryption Security Module for ASROCK Motherboard Compatible with Win11 Replacement For ASRock Z390 Extreme4、Z390 Taichi Ultimate、Z390 Phantom Gaming 4、Z390 Phantom Gaming 6、Z390 Phantom Gaming 9、Z390 Phantom Gaming SLI、Z390M Pro4、Z390M-ITXac
- ● Important note: This product is only compatible with older motherboards such as INTEL and AMD. It is not compatible with newer motherboard models featuring firmware TPM, all-in-one computers, or laptops.
- ● Important Notes: The minimum hardware requirements for upgrading to Windows 11 via TPM 2.0 are as follows: a 1 GHz or faster 64-bit processor (dual-core/multi-core), 4 GB of RAM, 64 GB of storage space, firmware supporting UEFI Secure Boot and TPM 2.0, a DirectX 12-compatible graphics card, and a display with a resolution of 720p or higher.
- ● Purpose a: Resolve the TPM 2.0 verification issue when upgrading to Windows 11, enabling it to function as an independent encryption chip, providing secure storage for sensitive data, and enhancing security; ● Purpose b: Hardware encryption acceleration, such as improving game lag issues and other functions.
- ● Hardware encryption acceleration: Reduces CPU load by accelerating encryption operations via dedicated hardware, indirectly improving system response speed and enhancing the smooth operation of certain encryption-dependent applications (such as games and security software)
In Microsoft’s Always Encrypted design, column encryption keys encrypt data and column master keys protect those column encryption keys. The database holds encrypted column encryption key values and metadata identifying the trusted key store; the plaintext master key remains in a store such as Windows Certificate Store, Azure Key Vault, or an HSM. Microsoft recommends role separation when the goal is to keep DBAs from accessing sensitive data: security administrators manage keys, while DBAs administer database metadata without access to the actual key store.
- Define who may provision, use, rotate, disable, and recover each key.
- Set access policies and audit key use; do not rely on the database role alone to define key access.
- Plan backups and recovery before deployment. Losing or disabling a required key can make ciphertext unavailable.
- Test rotation and revocation procedures, including application behavior and any re-encryption work they require.
Choose a design in six steps
- Identify who must not see plaintext. If database or cloud-storage operators are outside the trust boundary, ordinary server-side storage encryption is not enough by itself. Assess client-side encryption or a database feature whose key custody keeps keys from the engine.
- Specify required operations. Record exactly how each sensitive field is read, filtered, joined, sorted, or analyzed. Validate those operations against the selected product, driver, version, and mode.
- Assign key responsibilities. Separate key administrators from database administrators where needed, and establish permissions, rotation, availability, recovery, revocation, and audit arrangements.
- Trace copies and derivatives. Check logs, exports, backups, replicas, search indexes, caches, and analytics pipelines. Encrypting the primary row or object does not automatically protect every copy or metadata created elsewhere.
- Estimate operational impact. Evaluate latency and throughput, any cloud KMS request charges, migration and re-encryption effort, support burden, and the impact of key loss or service unavailability.
- Layer only for distinct threats. Storage encryption can protect media while field encryption limits a service’s ability to read selected values. Layering helps only when the key custody and access paths are genuinely independent.
What to verify before rollout
- The protected values and every system that needs plaintext, including background jobs and administrative tools.
- The exact database or storage feature, supported client drivers, versions, regions, and deployment settings.
- Query behavior under encryption, tested against real application workflows rather than inferred from feature names.
- Key ownership, separation, lifecycle, recovery, and auditing, including the consequence of a key service outage.
- Coverage of data in memory and in secondary locations such as logs, backups, exports, replicas, and caches.
- Performance, cost, migration, and operational responsibilities for each additional layer.
Vendor defaults, feature support, and prices change. Check the current official documentation for the selected platform before implementation, especially when relying on a particular query mode, cross-account policy, or cost behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
