AES is a symmetric block cipher established by NIST in 2001 that encrypts data in 128-bit blocks using 128, 192, or 256-bit cryptographic keys worldwide.
The Advanced Encryption Standard (AES), originally known as Rijndael, is a specification for the electronic encryption of data established by the U.S. National Institute of Standards and Technology (NIST) in 2001 (FIPS PUB 197). It is a symmetric-key block cipher, meaning the identical secret cryptographic key is used for both encrypting plaintext into ciphertext and decrypting ciphertext back into plaintext.
AES has superseded the legacy Data Encryption Standard (DES) and Triple DES (3DES), becoming the worldwide gold standard for securing sensitive data at rest and in transit across enterprise databases, file systems, VPNs, and HTTPS protocols (TLS 1.3).
| Specification | AES-128 | AES-192 | AES-256 |
|---|---|---|---|
| Key Size (bits / bytes) | 128 bits (16 bytes) | 192 bits (24 bytes) | 256 bits (32 bytes) |
| Block Size | 128 bits (16 bytes) | 128 bits (16 bytes) | 128 bits (16 bytes) |
| Transformation Rounds | 10 rounds | 12 rounds | 14 rounds |
| Round Key Size | 128 bits | 128 bits | 128 bits |
| Expanded Key Material | 176 bytes | 208 bytes | 240 bytes |
| Quantum Resistance | ~64 bits (Grover's) | ~96 bits | 128 bits (Recommended) |
| Standard Specification | NIST FIPS 197 | NIST FIPS 197 | NIST FIPS 197 / NSA Suite B |
AES operates on fixed-size blocks of 128 bits (16 bytes) arranged in a 4×4 column-major order matrix of bytes called the State.
State Matrix (4x4 bytes = 16 bytes = 128 bits):
[ S0,0 S0,1 S0,2 S0,3 ]
[ S1,0 S1,1 S1,2 S1,3 ]
[ S2,0 S2,1 S2,2 S2,3 ]
[ S3,0 S3,1 S3,2 S3,3 ]
Before processing begins, the original cipher key undergoes Key Expansion via the Rijndael key schedule to generate individual subkeys for each round. The encryption routine then executes an initial round, followed by multiple main transformation rounds (10, 12, or 14 rounds depending on key length), and completes with a modified final round:
Because AES natively encrypts only 128 bits (16 bytes) at a time, processing arbitrary lengths of data requires an operational mode. Selecting the correct mode is critical for application security:
| Mode | Authenticated? | Parallelizable? | Initialization Vector (IV)? | Security Verdict |
|---|---|---|---|---|
| ECB (Electronic Codebook) | No | Yes | None | Insecure: Identical plaintext blocks produce identical ciphertext, exposing data patterns. |
| CBC (Cipher Block Chaining) | No | Decryption only | Required (Random 16 bytes) | Legacy: Prone to padding oracle attacks unless combined with an HMAC. |
| CTR (Counter Mode) | No | Yes (Fast) | Required (Unique Nonce) | Secure: Turns block cipher into a stream cipher; requires strict nonce uniqueness. |
| GCM (Galois/Counter Mode) | Yes (AEAD) | Yes (Hardware Accelerated) | Required (96-bit Nonce) | Industry Standard: Provides both confidentiality and tamper-proof data authenticity. |
[!WARNING] Never use ECB mode in production. Even though data is technically encrypted, repeating patterns remain visible in the ciphertext (often demonstrated using the famous pixelated "ECB Penguin"). Always prefer an AEAD (Authenticated Encryption with Associated Data) mode such as AES-GCM.
Modern web browsers and Node.js environments support hardware-accelerated AES-GCM directly through the native standard crypto.subtle API:
// Encrypt text using native Web Crypto API (AES-GCM 256-bit)
async function encryptAesGcm(plaintext, rawKey) {
const enc = new TextEncoder();
const iv = crypto.getRandomValues(new Uint8Array(12)); // 96-bit standard IV
const cryptoKey = await crypto.subtle.importKey(
"raw",
rawKey,
{ name: "AES-GCM" },
false,
["encrypt"]
);
const ciphertext = await crypto.subtle.encrypt(
{ name: "AES-GCM", iv },
cryptoKey,
enc.encode(plaintext)
);
return {
iv: Array.from(iv),
ciphertext: Array.from(new Uint8Array(ciphertext))
};
}
No. An AES-256 key has $2^{256}$ possible combinations ($\approx 1.15 \times 10^{77}$). Even if every supercomputer on Earth could test trillions of keys per second, exhausting the search space would require billions of years—longer than the age of the known universe.
AES-128 uses a 128-bit key over 10 transformation rounds, whereas AES-256 uses a 256-bit key over 14 rounds. While AES-128 is computationally secure against all known conventional attacks and runs slightly faster, AES-256 is universally mandated for top-secret government classifications and provides robust post-quantum security against Grover's algorithm.
Yes. Although the AES block size is strictly fixed at 16 bytes, operational modes like GCM or CTR turn the block cipher into a stream cipher, enabling encryption of any file size or continuous network stream without requiring block padding.
AES is a two-way encryption algorithm intended to protect confidentiality so authorized users with the secret key can decrypt the data. In contrast, SHA-256 is a one-way cryptographic hash function designed to generate a fixed digest that can never be reversed or decrypted. You can test one-way hashing with our Hash Generator tool.
Free, browser-based utilities to test, generate, and inspect Advanced Encryption Standard (AES) payloads directly.