How Password Encryption Works (AES) and When to Use It

Encryption scrambles data so that only someone with the right password can read it. If you send a message or store a file somewhere you don't fully trust, encrypting it first means a stranger who finds it sees only noise.

What AES is

AES is the standard way to encrypt data. It's used by banks, messaging apps, Wi-Fi and governments. The version here, AES-256, uses a 256-bit key. There is no practical way to guess a key that size, so the weak point is never AES itself. It's the password you choose.

From a password to a key

A password is too short and too predictable to be used as a key directly. So it's run through a function called PBKDF2, which mixes it with a random value called a salt and repeats the work hundreds of thousands of times. That makes each guess slow for an attacker, and the salt means the same password never gives the same key twice. The AES Encryption tool uses 600,000 rounds.

What the tool adds for safety

• A fresh random salt and a fresh random IV every time, so encrypting the same text twice gives different results.
• GCM mode, which also adds a check value. If even one character of the result is changed, decrypting fails instead of giving you altered text.
• A wrong password gives a clear error and no partial output.

Choosing the password

Use at least 12 characters, and preferably a few random words or a generated password. A short or common password can be guessed even with slow key making. The Password Generator can make a long random one or a passphrase that's easier to remember.

What you can't do

• Recover the data if you forget the password. Nobody can, including us, because we never see it.
• Hide that something is encrypted. Anyone can see that the data is scrambled.
• Protect a message after you've shared the password in the same chat or email as the data. Send the password a different way.

Check that a file arrived unchanged

Encryption protects secrecy. To check that a copy of a file is identical to the original, compare checksums with the Hash Generator. Used together, the two tell you the file is private and also unchanged.