What Is AES?
AES stands for Advanced Encryption Standard. It is a widely used symmetric encryption algorithm designed to protect information by transforming readable data into an encrypted form.
With symmetric encryption, the same underlying secret key is used to encrypt and decrypt the data. Without the appropriate key, the encrypted information should not be readable.
AES supports key sizes of 128, 192, and 256 bits. AES-256 refers to the version that uses a 256-bit encryption key.
What Does the "256" Mean?
The "256" in AES-256 refers to the size of the encryption key: 256 bits.
A larger key provides a larger possible key space, making exhaustive brute-force attempts against the encryption key computationally impractical with currently known methods when the cryptographic implementation and key management are handled properly.
The important point is that AES-256 is referring to the encryption key size, not the size of the data being encrypted.
What Does GCM Mean?
GCM stands for Galois/Counter Mode. It is a mode of operation that can be used with AES to provide authenticated encryption.
This is important because encryption is not only about keeping data secret. A system also needs a way to detect whether encrypted data has been modified or corrupted.
AES-GCM provides both:
- Confidentiality — helps keep the encrypted data private.
- Integrity and authenticity — provides an authentication tag that can be checked to detect unauthorized changes to the encrypted data.
What Is an Authentication Tag?
AES-GCM produces an authentication tag along with the encrypted data. This tag allows the application to verify that the encrypted information has not been altered since it was created.
If the encrypted data or associated authenticated information is modified, authentication can fail when the data is decrypted. The application can then reject the data instead of treating potentially modified information as valid.
This provides an important layer of protection for applications that store sensitive information.
Why Is This Important for Password Managers?
Password managers store information that can be extremely sensitive, including passwords, usernames, secure notes, and other private information.
Simply storing that information in a file is not enough. If someone gains access to the underlying storage, the stored information should not be available in readable form.
Encryption allows a password manager to store the vault in an encrypted format rather than as plain text.
Authenticated encryption also helps the application detect unexpected modifications to the encrypted vault data.
Encryption Does Not Replace a Strong Master Password
Strong encryption is an important part of protecting a password manager, but it does not eliminate the importance of protecting the key used to access the encrypted data.
A strong, unique master password is therefore an important part of an overall password manager security strategy.
Users should also protect their computers, keep their operating system and security software up to date, and use sensible backup practices.
AES-256-GCM and Local Encryption
Encryption can be used whether a password manager stores its vault locally or uses cloud infrastructure. The important distinction is where the encrypted data is stored and how keys are handled.
With a local password manager, the encrypted vault can remain on the user's own computer rather than being uploaded to a remote service. This can be useful for people who want their password vault to remain entirely under their local control.
What AES-256-GCM Does Not Mean
AES-256-GCM is a cryptographic building block. Using it does not automatically make an application secure.
The overall security of an application also depends on how encryption keys are derived and protected, how encrypted data is handled, how authentication is implemented, how backups are protected, and how the rest of the application is designed.
In other words, the algorithm is only one part of the larger security picture.
AES-256-GCM in KeenPassword Vault
KeenPassword Vault uses AES-256-GCM to encrypt the local vault on the user's Windows computer. The vault is protected locally rather than being uploaded to a cloud service.
KeenPassword Vault is designed as an offline password manager, so your stored vault data remains on your computer. The application does not require an online account, cloud synchronization, or a subscription.
The encryption layer is part of a broader security design that includes local storage, a master password, encrypted backups, and features intended to help users protect their vault.
The Bottom Line
AES-256-GCM combines AES encryption with an authenticated encryption mode. AES-256 provides a 256-bit encryption key, while GCM provides authenticated encryption that can help detect unauthorized modifications to encrypted data.
For a password manager, these capabilities are useful because the application needs to protect sensitive information while also being able to detect when encrypted data is no longer valid.
However, encryption is only one part of password manager security. Strong passwords, secure key handling, protected backups, and good application design all contribute to the overall security of a password vault.