Security · 5 min read
AES Encryption Explained: Keys, Modes, and IVs
AES is the symmetric cipher behind HTTPS, disk encryption, password managers, and most encrypted files you will ever touch. The algorithm itself is not where people go wrong — the choices around it are: the mode, the IV, and how the key is made.
This guide covers those choices in plain terms so you can tell a sound setup from a broken one.
Try it yourself with the related tool.
Encrypt text with AES →Advertisement
Symmetric means one shared key
AES uses the same key to encrypt and decrypt. That makes it fast — fast enough to encrypt gigabytes per second on modern CPUs — but it means both sides must already share the key. In practice, public-key cryptography is used to agree on an AES key, and AES then does the heavy lifting.
AES comes in 128-, 192-, and 256-bit key sizes. AES-128 is already far beyond brute force; AES-256 is common because it costs little extra and leaves a margin against future attacks.
Modes: why GCM is the default
AES on its own encrypts exactly 16 bytes. A mode of operation describes how to encrypt longer messages. The old ECB mode encrypts each block independently, so identical blocks produce identical output and patterns leak through — never use it. CBC chains blocks together but does not detect tampering on its own.
GCM is the modern default. It is an authenticated mode: alongside the ciphertext it produces a tag, and decryption fails loudly if a single bit was changed. Encryption without authentication lets an attacker flip bits in your data undetected.
The IV (nonce) must never repeat
Every encryption needs a fresh initialization vector, also called a nonce — 12 random bytes for GCM. It is not secret and is usually stored right next to the ciphertext. What matters is that the same key and IV are never used twice. With GCM, a repeated nonce can expose the authentication key and let an attacker forge messages.
Turning a password into a key
A password is not a key. Before using one with AES, run it through a deliberately slow key-derivation function such as PBKDF2, scrypt, or Argon2, with a random salt. The salt and iteration count are stored alongside the ciphertext so the same key can be derived again at decryption time. A weak password stays weak, though — the derivation only slows guessing down.