A Symmetric Block Cipher
AES — the Advanced Encryption Standard — is a symmetric cipher, meaning the same secret key both encrypts and decrypts. This is the fast kind of cryptography, suited to bulk data, and it is one half of the pairing explained in symmetric vs asymmetric encryption. The catch with any symmetric cipher is getting that shared key to the other party safely, which is a separate problem solved by key exchange.
AES is also a block cipher: it encrypts data in fixed-size chunks of 128 bits (16 bytes) at a time, rather than one bit at a time. Data longer than a block is broken into blocks; data shorter is padded. How those blocks are chained together is decided by the cipher's mode — a detail that turns out to matter enormously, as we will see.
It became a standard in 2001 after an open international competition, chosen to replace the ageing DES. That open, public vetting is part of why it is so trusted: it was not handed down in secret but selected after years of worldwide scrutiny, and the scrutiny has continued ever since without anyone finding a practical break.
How AES Scrambles a Block
Inside, AES transforms each 128-bit block through several rounds, and each round applies the same handful of operations that together achieve "confusion and diffusion" — the principle that every output bit should depend on many input bits and key bits in a tangled, irreversible-looking way. The operations in a round:
- SubBytes — each byte is replaced via a fixed substitution table, adding non-linearity.
- ShiftRows — rows of the block are shifted, spreading bytes around.
- MixColumns — columns are mathematically combined, mixing bytes together.
- AddRoundKey — a portion of the expanded key is XORed in, so the key influences every round.
Crucially, every step is reversible if you know the key — decryption runs the inverse operations in reverse order. Without the key, the cumulative scrambling is so thorough that the output is statistically indistinguishable from random noise. The number of rounds depends on the key size, which brings us to the headline numbers.
AES-128, AES-192, AES-256
When people say "AES-256," the number is the key length in bits — not the block size, which is always 128. A longer key means more rounds and a vastly larger space of possible keys:
| Variant | Key size | Rounds |
|---|---|---|
| AES-128 | 128 bits | 10 |
| AES-192 | 192 bits | 12 |
| AES-256 | 256 bits | 14 |
Here is the part that surprises people: AES-128 is already unbreakable by brute force. The number of possible 128-bit keys is so astronomically large that trying them all is beyond the reach of any conceivable computer running for the lifetime of the universe. AES-256 does not make you meaningfully "more secure" in everyday terms — both are far past the point of practical attack. What AES-256 buys is a larger margin against future advances, which is why high-assurance and long-term-secret use cases prefer it. For protecting a web session, AES-128 is entirely sufficient.
The Mode Matters More Than the Key Size
A subtle truth of AES is that how you use it affects security more than which key length you pick. A block cipher on its own only knows how to encrypt one block; a mode of operation defines how to handle many blocks and whether integrity is checked. The wrong mode can leak patterns even with a perfect key.
The mode to know is GCM (Galois/Counter Mode). AES-GCM is authenticated encryption: it encrypts the data and produces a tag that detects any tampering, all in one pass. This is why modern protocols overwhelmingly use AES-GCM — it closes the gap that older modes left open. By contrast, the older CBC mode encrypts only, requiring a separate integrity check bolted on, an arrangement that has been the source of several real-world attacks. When you see AES128-GCM in a cipher suite, the GCM is doing as much for your security as the 128.
Where You Are Already Using AES
AES is the default symmetric cipher across essentially the entire industry, in large part because modern processors include dedicated hardware instructions that make it extraordinarily fast. You rely on it when:
- A secure website encrypts your traffic after the TLS handshake agrees on a key — the bulk of HTTPS data is AES.
- Your Wi-Fi uses WPA2 or WPA3, which encrypt the air link with AES.
- You encrypt a disk, a file, a backup, or a database.
- A VPN protects your traffic inside its tunnel.
The recurring theme across all of these: AES is almost never the weak link. When encrypted systems fail, it is because of a stolen or weak key, a poorly chosen password, or an insecure mode — not because someone broke AES. The algorithm has done its job reliably for over two decades, which is exactly why it has become invisible infrastructure. For how AES differs from one-way hashing, see hashing vs encryption.
Frequently Asked Questions
What is AES encryption?
The Advanced Encryption Standard — a symmetric block cipher that encrypts and decrypts data with one shared key. It processes data in 128-bit blocks through several rounds of substitution and permutation. It is the most widely used encryption algorithm in the world.
What is the difference between AES-128 and AES-256?
The number is the key length. AES-128 uses a 128-bit key and 10 rounds; AES-256 uses a 256-bit key and 14 rounds. Both are secure against any practical attack — AES-128 is already beyond brute force — so AES-256 offers a larger safety margin rather than everyday difference.
Is AES encryption secure?
Yes. AES has been studied intensively since 2001 with no practical break, and brute-forcing even a 128-bit key is infeasible. Failures come from poor key management, weak passwords, or insecure modes — not the algorithm itself.
What is AES-GCM?
AES in Galois/Counter Mode — an authenticated encryption mode that encrypts the data and produces a tamper-detection tag in one operation. It is fast and secure, which is why modern protocols like TLS favour it over older modes such as CBC.
Where is AES used?
Almost everywhere encryption happens: HTTPS traffic after the TLS handshake, Wi-Fi with WPA2/WPA3, file and disk encryption, VPN tunnels, and encrypted backups and databases. Hardware acceleration on modern processors makes it the default symmetric cipher.