AES-256 Encryption Explained (Without the Jargon)

AES-256 is a symmetric encryption algorithm: it scrambles data with a 256-bit key, and only the same key can unscramble it. It's the U.S. government standard (AES), and with a 256-bit key there are so many possible keys that trying them all is not physically feasible. In practice, AES-256 is almost never the weak point. The weak points are how the key is created, where it's stored, and who can get to it.

This guide explains what that means, using photos on a phone as the running example.

The short version

• AES (Advanced Encryption Standard) was selected by the U.S. National Institute of Standards and Technology in 2001 after an open, multi-year competition. It's used in HTTPS, Wi-Fi, disk encryption, messaging apps, and your iPhone.
• 256 is the key length in bits. A 256-bit key has 2²⁵⁶ possible values, a number with 78 digits.
• Symmetric means the same key encrypts and decrypts. (Compare with public-key encryption, which uses a pair.)
• Mode, like GCM, describes how AES is applied to a file longer than one 16-byte block, and whether tampering is detected.
• Key derivation, like Argon2id or PBKDF2, turns a human secret (a password, PIN, or drawn pattern) into a 256-bit key.

How big is 2²⁵⁶?

Suppose every computer on Earth were replaced by a machine that could test a billion billion keys per second, and they all worked together on your one file. Running until the sun burns out, they would still have covered a vanishingly small fraction of the key space.

That's why cryptographers don't worry about brute-forcing an AES-256 key. Even AES-128 is considered out of reach. The extra length in AES-256 is margin, including against future quantum computers: the best known quantum search algorithm would effectively halve the key length, leaving AES-256 around the strength of AES-128 today, which is still very strong.

What "AES-256-GCM" adds

Encrypting a photo isn't just "apply AES." A file has to be processed in chunks, and the way you do that matters.

GCM (Galois/Counter Mode) does two jobs:

1. Encryption. It turns AES into a stream that can encrypt data of any length efficiently.
2. Authentication. It produces a tag, a short checksum that only someone with the key can compute. When decrypting, the tag is checked first. If anyone has altered even one bit of the encrypted file, decryption fails.

Without authentication, an attacker could flip bits in an encrypted file and you'd get a subtly corrupted result without knowing. GCM closes that door. It's the mode used in modern TLS, and it's a sensible default for encrypting files.

GCM has one strict rule: never reuse the same nonce (a unique number per encryption) with the same key. Well-built software generates a fresh random nonce for every file.

The part that actually matters: where the key comes from

A 256-bit key is only as secret as whatever produces it. Humans can't remember 256 random bits, so apps derive the key from something you can remember.

Key derivation functions such as Argon2id, scrypt, or PBKDF2 take your secret and a random value called a salt, and run them through many rounds of hashing to produce the key. The many rounds make each guess slow. If one guess takes a noticeable fraction of a second, guessing billions becomes impractical.

But a slow function can only stretch what you give it:

So when an app says "AES-256," the useful follow-up questions are: how is the key derived, from what, and who else has it? Pattern lock vs PIN vs password goes deeper into how different secrets compare, and the password strength checker and pattern strength meter let you test yours.

Where AES-256 is on your iPhone

Your iPhone already uses AES-256, in hardware. Every file on the device is encrypted, and the keys are protected by the Secure Enclave and your passcode. Apple's design also limits how fast passcode guesses can be made on the device itself, which is why even a six-digit passcode holds up well against someone who steals a locked phone.

The important detail: all of that is unlocked by one secret, your device passcode. Once the phone is unlocked, everything is readable, including the Hidden album. That's not a weakness of AES; it's a question of which key protects what. Is the iPhone Hidden album secure? explains how this plays out for photos.

To strengthen it, use a longer passcode: Settings > Face ID & Passcode > Change Passcode > Passcode Options > Custom Alphanumeric Code.

Where real-world attacks happen

Because the cipher itself is out of reach, attackers go around it:

• Guessing the human secret. Weak passwords, short PINs, obvious patterns.
• Watching you enter it. Shoulder-surfing a passcode is the most common way people's phones get opened by someone else.
• Getting the key from someone else. If a service can reset your password by email, it has a path to your key, and so does anyone who compromises that service.
• Reading data while it's decrypted. Malware on an unlocked device, or apps with broad permissions.
• Copies that were never encrypted. The original photo left in the Camera Roll, a thumbnail in a cache, a backup.
• Bad implementation. Reused nonces, keys stored next to the data, "encryption" that's really just a PIN screen. See are calculator vault apps safe?

How sigil. uses 256-bit encryption

sigil. is an encrypted photo vault for iPhone, and we built it around the points above:

• Authenticated 256-bit encryption for the files in every vault, so content is both encrypted and tamper-checked.
• A random 256-bit vault key, never derived from anything you type: your sign, hardened with Argon2id and bound to the phone's secure chip, is what unlocks it. Because the key is bound to the chip, nobody can copy the files and guess your sign on another machine. See pattern encryption.
• A separate secret from your phone passcode, so unlocking the phone doesn't unlock the vault.
• No account, no server. We never receive your sign or your key, so there's no reset path for anyone to abuse.
• A 12-word recovery phrase you write down, as the only fallback if you forget your sign. There is no reset and no assistance that can reopen a vault.

None of this makes a vault impossible to get into. A guessable sign, someone watching you draw it, or a compromised phone can still defeat good encryption. What strong encryption does is move the problem to places you can control: the strength of your secret and who sees you enter it.

Glossary

• Plaintext / ciphertext: readable data / encrypted data.
• Key: the secret value the algorithm uses. For AES-256, 32 bytes.
• Nonce / IV: a unique value per encryption so the same file encrypted twice looks different.
• Salt: random data mixed into key derivation so identical secrets don't produce identical keys.
• Authentication tag: GCM's tamper check.
• End-to-end encryption: data encrypted on your device and decrypted only on the recipient's, never readable by the service in between. See what is end-to-end encryption for photos?