What is AES-256?

AES-256 is the Advanced Encryption Standard used with a 256-bit key, the largest of its three key sizes. NIST standardized AES in FIPS 197 in 2001, and it is widely used to protect web traffic, stored files and messages. NIST places AES-256 in its highest post-quantum security category.

Also called: AES 256-bit encryption, 256-bit AES, Advanced Encryption Standard, Rijndael

Updated October 2026. Sources are numbered and listed at the end.

On this page

How AES-256 works

AES is a symmetric cipher: the same secret key both encrypts and decrypts. It works on data in 128-bit blocks, and the number in its name is the key length.1 NIST chose AES in 2000 after a public competition, picking the Rijndael cipher by cryptographers Joan Daemen and Vincent Rijmen.1

Each block goes through a series of rounds. A round mixes the data with four steps: it swaps every byte for another using a fixed table, shifts the rows, mixes the columns, and combines the result with a round key taken from your key. The last round skips the column mixing.1 A longer key means more rounds.

The three AES key sizes in FIPS 197, with NIST’s post-quantum security category for each.
VersionKey lengthRoundsNIST category
AES-128128 bits1012
AES-192192 bits1232
AES-256256 bits1452

AES-256-GCM

AES on its own handles one 16-byte block. A mode of operation turns it into something that can encrypt a whole message. GCM, short for Galois/Counter Mode, is the common choice: it encrypts the data and adds an authentication tag, so any change to the ciphertext is detected when it is decrypted.3 Its one strict rule is that the nonce, or initialization vector, must never repeat under the same key. NIST warns that breaking that rule can undo almost all of its protection.3 Well-built systems avoid the problem by using a fresh key or a fresh random nonce for every message.

Why AES-256 matters

A 256-bit key has 2256 possible values, far too many to try one by one with any computer that exists. Quantum computers don’t change that much for ciphers like AES. NIST says its symmetric standards are significantly less exposed to known quantum attacks than public-key cryptography, and uses AES-256 key search as the yardstick for category 5, the top of its post-quantum scale.2

The weak point is usually not AES itself but how the key gets to the other side. If two parties exchange their AES key with RSA or elliptic-curve cryptography, a future quantum computer could recover that key from a recording and decrypt everything. That is why modern systems pair AES-256 with a post-quantum key exchange such as ML-KEM.

Where you’ll see AES-256

  • HTTPS. TLS 1.3, the protocol behind secure websites, lists AES-256-GCM in its standard cipher suites.4
  • Web apps. Browsers offer AES-GCM to web pages through the Web Crypto API, so encryption can happen on your device.5
  • Encrypted email and storage. End-to-end encrypted services use a key exchange to share a key, then AES to encrypt the actual message or file.

AES-256 in Secria

Secria Mail seals message bodies and attachments with AES-256-GCM, with a fresh key for each message. That key is protected by ML-KEM-1024 and X25519 together, joined with HKDF-SHA256, so every message in your mailbox has post-quantum protection on every plan, free included.

ML-KEMThe NIST standard for agreeing on a secret key in a way quantum computers can’t break. Hybrid encryptionCombining two kinds of cryptography so each one covers the other’s weakness. Encryption at rest vs in transitProtecting data while it moves versus while it’s stored, and why you need both. End-to-end encryptionOnly the sender and recipient can read a message, not the service carrying it. Harvest now, decrypt laterRecording encrypted data today to unlock it once quantum computers can.

Sources

  1. NIST, FIPS 197: Advanced Encryption Standard (AES) (November 2001, updated May 2023).
  2. NIST, IR 8547 (initial public draft): Transition to Post-Quantum Cryptography Standards, section 4.1.3 (November 2024).
  3. NIST, SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC (November 2007).
  4. IETF, RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3, section 9.1 (August 2018).
  5. MDN Web Docs, SubtleCrypto: encrypt() method.

Checked October 2026. Secria facts are from our Mail and VPN pages and the whitepaper.

Questions about AES-256

Is AES-256 secure?

Yes. No practical attack on full AES-256 is known, and trying every key is far beyond any computer. In practice, security depends on how the key is made, stored and shared.

Can quantum computers break AES-256?

Not in any practical way that is known. NIST places AES-256 in category 5, the top of its post-quantum security scale. The part quantum computers threaten is RSA or elliptic-curve key exchange, which is why it is being replaced with ML-KEM.

What is the difference between AES-128 and AES-256?

Key length and rounds. AES-128 uses a 128-bit key and 10 rounds, AES-256 a 256-bit key and 14 rounds. Both are secure today. AES-256 keeps a larger margin for data that must stay private for decades.

What does GCM mean in AES-256-GCM?

Galois/Counter Mode. It encrypts the data and adds an authentication tag, so the receiver can tell if anyone changed the message on the way.

Email that’s ready for what comes next.

Post-quantum encryption on every plan, free included.

Start free

Explore Secria Mail