AES-256 encryption encrypts and decrypts data efficiently and, when properly applied, guarantees both the confidentiality and the integrity of information. Recognized as one of the most secure encryption algorithms available today, it's the standard used by banks, governments and also Vault256 to protect your passwords.

AES in a nutshell

AES (Advanced Encryption Standard) is a symmetric encryption standard adopted by the U.S. NIST in 2001. Symmetric means the same key is used to encrypt and to decrypt. The number 256 is the size of that key in bits.

How strong is a 256-bit key?

A 256-bit key allows 2 to the power of 256 combinations, a 78-digit number. Trying them all isn't feasible with today's technology. That's why the U.S. government approved AES-256 to protect TOP SECRET classified information, and why it's called military-grade encryption.

Confidentiality and integrity: GCM mode

AES can be used in different ways, called modes. Vault256 uses GCM mode, which, in addition to encrypting, generates an authentication tag. If anyone changes even a single byte of your vault file, decryption fails and the tampering is exposed. This protects not only against anyone reading your data, but also against anyone altering it.

How Vault256 uses AES-256 encryption

  • Your vault is encrypted with AES-256-GCM before it's saved to disk.
  • The vault key is protected by another key derived from your master password with scrypt, an algorithm that's deliberately slow to hold back brute-force attacks.
  • The key only lives in memory while the vault is open, and is discarded when you lock or close the app.
  • There are no backdoors or master keys: only you can open your vault.

The weak link isn't the encryption

In practice, attacks don't break AES-256: they exploit a weak master password, a phishing email or an infected computer. Use a long master password, keep Windows and your antivirus up to date, and never type your master password on pages you reached through a suspicious link.