# Encryption (/academy/encryption)



**Encryption** turns readable data into noise that only the right key can undo.

On the road, that is HTTPS. The padlock in the bar. Your [secret](/academy/secret), the password, the Polar token — they travel as junk until they reach the host. Coffee-shop wifi can watch the packets. It should not be able to read them. If your [deploy](/academy/deploy) URL is still `http://`, you are showing the room the card.

At rest, you encrypt what you would hate to leak from a stolen disk. Passwords are different: you hash them. One-way. You compare, you do not reverse. If you invent a scheme at 4 a.m., you will lose. Use the library. Use TLS.

**The lock is not the key**

Encryption protects the data, not the person you handed the key to. A phishing page, a committed `.env`, an [agent](/academy/agent) that prints `STRIPE_SECRET_KEY` into the transcript — the math still works. The door is just open.

Keep keys in the [env file](/academy/env). Put `.env` in `.gitignore`. After [auth](/academy/auth), hash. On the wire, require HTTPS in production. The [CLI](/academy/cli) can scaffold the files. It cannot unsay a push.

The [builder](/builder) will pick Better Auth or Clerk so you do not roll this yourself. Let that be boring. Judges will type a password on a laptop they do not own. Hash it. Ship it over TLS. Do not store the leftover in a JSON fixture.

**What this unlocks**

A stolen packet is junk. A leaked key is not.

Scramble the data. Guard the key. Do not write the scramble.