What Is AES-256 Encryption? A Plain Explanation
AES-256 is a published encryption standard that scrambles data with a 256-bit key. Without that key, the data cannot be read in any practical amount of time. So the question for any app that says "AES-256" is not the cipher. It is who holds the key and what protects it.
Try Cryptile free: join the beta on TestFlight
What do I need to know?
- The cipher is not the weak point. Attacks go after the key, the password behind it, or the unlocked device.
- "256" is the key length. It means 2^256 possible keys, far beyond any search.
- The label says little on its own. Ask what is encrypted, where the key is made, and who else has it.
What does AES-256 actually mean?
AES is the Advanced Encryption Standard, published by the US National Institute of Standards and Technology. NIST's FIPS 197 defines three versions: AES-128, AES-192 and AES-256. All work on 128-bit blocks. The number is the length of the key in bits.
A 256-bit key has 2^256 possible values. That is a number with 78 digits. Trying them one by one is not a realistic attack, now or with any computer we know how to build.
What is AES-256-GCM?
AES on its own only describes how one block is scrambled. A "mode" says how a whole file is handled. GCM is one such mode, specified in NIST SP 800-38D.
GCM is authenticated encryption. Besides hiding the content, it detects if anyone changed the encrypted file. A tampered file fails to open instead of opening as something else.
If AES-256 can't be broken, how does data get stolen?
Through everything around the cipher. The usual routes are:
- A weak password or code. If a 4-digit PIN makes the key, an attacker tries 10,000 PINs, not 2^256 keys.
- The key stored next to the data. Encryption with the key in the same place is a locked box with the key taped on.
- A company that holds the key. If a server can reset your password and give your files back, someone other than you can read them.
- An open, unlocked device. Whatever is decrypted and on screen can be seen or copied.
- Things left unencrypted. Thumbnails, file names or a database of albums can leak what the files are.
How can I check an app's "AES-256" claim?
Ask these five questions. A good app answers them in its own documentation.
- Is every file encrypted, including thumbnails and the index of what is in the vault?
- Where is the key made: on your device, or on the company's server?
- What turns your password or pattern into the key? It should be a slow, standard method.
- Can the company reset your password? If yes, it can reach your files.
- Is the code or a security write-up published for others to check?
If an app only says "AES-256" and nothing more, treat it as unknown, not as secure.
How does Cryptile use AES-256?
Every file, thumbnail and index in a Cryptile vault is encrypted with AES-256-GCM. The key is made on your phone from the pattern you draw. There is no account and no server, and the developer never holds your keys.
The encryption core is published for audit with a threat model and test vectors. Our security page links to it. File sizes are padded, so the size of an encrypted file says less about what it is.
What this doesn't protect against
AES-256 is only as strong as the secret behind the key. A short pattern is weaker than a passphrase, so use 8 or more cells. If someone watches you draw it, or your phone runs malware while a vault is open, encryption does not help. If you lose your pattern and your recovery phrase, nobody can open the vault, including us.
Do it with Cryptile
Cryptile encrypts photos, videos, files and notes with AES-256-GCM under a key made on your device. A different pattern opens a different vault, and there is no vault list.
Cryptile is free for up to 2 vaults, 100 photos and 10 videos. Plus removes the limits and adds the panic pattern and search inside the vault for $19.99 a year (7-day free trial) or $39.99 once.