What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Client-side encryption protects data before it reaches a storage provider; server-side encryption protects it inside the provider’s service. That distinction determines who can handle plaintext, who controls the keys, what the service can do with the data, and who must keep keys available for recovery. Customer-managed keys add customer control to some server-side integrations, but they do not automatically turn them into client-side encryption.
Where does encryption happen?
The simplest way to compare these approaches is to trace the data from the application to storage and back. The word “server-side” describes where a storage service applies encryption; it does not, by itself, identify who owns the keys or promise that provider software never handles plaintext.
Client-side: encrypt before upload
With client-side encryption, the application or another client-controlled process encrypts data before sending it to cloud storage. Google Cloud describes this as encryption performed before data is sent to the cloud. The storage service receives ciphertext and does not know the client-side key. On retrieval, the service removes its own at-rest encryption layer, if present, but the customer must decrypt the client-side layer.
This creates a separation between the storage service and the client-side content key. It is not an absolute guarantee that no provider component or administrator can ever see plaintext: the application, its runtime, credentials, key service, and authorized decryption processes remain part of the trust boundary.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
Server-side: encrypt within the storage service
With server-side encryption, the storage service encrypts data as part of its storage path. As one product-specific example, Google’s Firestore in Datastore mode automatically encrypts data before writing it to disk and transparently decrypts it for authorized reads. The service can use Google-managed keys or, where supported, customer-managed keys. This example describes that service, not a universal implementation rule for every cloud product.
Provider-managed keys generally keep the customer’s setup and application changes low. Customer-managed server-side keys add controls over selected parts of key creation, use, access, rotation, disabling, or destruction, depending on the service integration. The storage service still performs the server-side encryption operation.
How envelope encryption works
Envelope encryption separates encryption of the data from protection of the key that encrypts it. A data encryption key (DEK) encrypts the content. A key encryption key (KEK) wraps the DEK, protecting it while it is stored or handled. The ciphertext and wrapped DEK can be stored together; the KEK is protected through a key-management system.
Recommended Free Tools
In Google’s Tink and Cloud KMS example, Tink generates the DEK locally, encrypts the message, and asks Cloud KMS to wrap the DEK. The resulting ciphertext includes the encrypted data and wrapped DEK. To decrypt, the wrapped DEK is unwrapped and then used to decrypt the content. This workflow shows how a remote key-management service can protect a key without encrypting the bulk data itself.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
Google recommends generating DEKs locally, encrypting stored DEKs, keeping DEKs near the data they protect, creating a new DEK when writing data, and using a central service for KEKs. It recommends regular KEK rotation and rotation after a suspected incident; the appropriate schedule and migration method depend on the workload, policy, and service.
What changes when the customer manages the server-side key?
Customer-managed encryption keys (CMEK) are a key-control option for compatible provider services, not a synonym for client-side encryption. Google describes CMEK as server-side symmetric envelope encryption. In a supported integration, the service uses the customer-managed key as part of its storage encryption path; the application does not thereby encrypt the data before upload.
Using CMEK can add governance over key policies and lifecycle actions, but it does not, on its own, establish that the provider’s service cannot process plaintext during authorized operations. The key boundary is different from the client-side boundary, where the client encrypts before data reaches storage.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsGoogle frames CMEK as useful when customers want a cryptographic boundary around cloud data in compatible services. That is guidance for those integrations, not a universal requirement or a guarantee that every service supports the same controls. Check the specific service’s current compatibility and key behavior before choosing.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Compare the three approaches
| Decision | Client-side encryption | Server-side, provider-managed keys | Server-side, customer-managed keys |
|---|---|---|---|
| Where encryption happens | In the application or client before upload. | In the provider’s storage service. | In the provider service integration, using customer-managed key controls where supported. |
| Who controls the relevant keys | The customer creates, protects, backs up, and uses the client-side keys. | The provider manages the storage keys. | The customer controls selected key lifecycle and access settings; the exact controls vary by integration. |
| Provider’s access to stored content | Storage receives client-encrypted bytes and does not know the client-side key. This does not secure a compromised decrypting client. | In the cited Datastore example, the service transparently decrypts for authorized reads. | Still a server-side integration; customer key control alone does not show that provider software cannot process plaintext during authorized operations. |
| Operational responsibility | More responsibility for application integration, key availability, backup, and recovery. Losing the key can make data unreadable. | Lower setup burden; the cited Datastore service requires no change to normal access. | Additional work for key policy, permissions, availability, and lifecycle actions. |
| Effect on service features | Operations that need plaintext—such as search, indexing, queries, or processing—may be limited. Confirm behavior for the specific product and design. | The service can perform its normal authorized operations after transparent decryption, as in the cited Datastore example. | Similar service-integration model to other server-side encryption, subject to the product’s key availability and compatibility requirements. |
| Typical reason to choose it | Encrypt at the application boundary or keep content-key custody separate from storage. | Get at-rest protection with minimal application overhead. | Add key governance or a cryptographic boundary within a supported cloud service. |
Choose based on trust, functionality, and recovery
Start with the data and the workload, rather than the label on a key option. Google’s CMEK recommendation is specifically about wanting a cryptographic boundary around data in compatible cloud services; it is not a blanket instruction to use CMEK everywhere.
- Plaintext access: Identify which applications, service components, administrators, and identities can handle readable data during normal operation.
- Service features: Check whether the product must search, index, query, transform, or otherwise process the data. Client-side ciphertext can prevent operations that require plaintext.
- Key custody and governance: Decide whether provider-managed keys meet the requirement or whether control over selected key policies and lifecycle actions is needed.
- Recovery and availability: Establish who can restore keys, authorize decryption, and regain access if a key or key service is unavailable.
- Audit and obligations: Map regulatory or contractual requirements to the controls the actual service offers, rather than assuming a particular encryption label satisfies them.
- Operational capacity: Assign responsibility for key permissions, rotation, backups or recovery mechanisms, incident response, and testing.
Failure modes and safeguards
Lost client-side keys
Cloud Storage says it does not know client-side keys and warns that losing them means the customer can no longer read the affected objects. Before production, test that key backups and recovery procedures work. A ciphertext backup without a usable key is not a recovery plan.
Compromised clients or overly broad access
Client-side encryption does not protect data from an application or identity that is authorized to decrypt it and has been compromised. Restrict decrypt permissions and consider where the application and its credentials run; storing the key separately from the object is not a substitute for sound authorization.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallKey-management service dependency
In an envelope-encryption design, decryptability can depend on access to the KEK and its key-management service, permissions, and availability. Include those dependencies in recovery planning and test the procedure rather than assuming that stored ciphertext is immediately decryptable.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Rotation is not always a data rewrite
Rotating a KEK does not necessarily require re-encrypting all data, but the result depends on the wrapping design and the service. Follow the product’s documented process; do not assume a universal rotation or migration behavior.
At rest is not in transit
Encryption at rest protects stored data. In the cited Datastore documentation, TLS is separately identified as protecting read and write operations in transit. Evaluate both protections; one does not replace the other.
Sources and implementation references
- Google Cloud: Client-side encryption with Tink and Cloud KMS
- Google Cloud Storage: Client-side encryption keys
- Google Cloud: Default encryption at rest
- Google Cloud: Envelope encryption
- Google Cloud SQL: About client-side encryption
- Google Cloud Datastore: Server-Side Encryption
- Google Cloud: Recommended practices for using CMEKs
- Google Cloud: Cloud KMS encryption and key management deep dive
- Google Cloud: Customer-managed encryption keys (CMEK)
These references describe Google Cloud documentation; service features and controls can change. Verify the current behavior of the specific service and integration you plan to use.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
