AES-256 Encryption Explained:
Why Your Photo Vault Needs It

You've seen "AES-256 encrypted" on privacy apps, password managers, and even messaging apps. But what does it actually mean? And does it matter for a photo vault on your phone?

The short answer: yes, it matters enormously. Here's why.

What Is AES?

AES stands for Advanced Encryption Standard. It's a symmetric encryption algorithm — meaning the same key is used to both encrypt and decrypt data. It was adopted by the US National Institute of Standards and Technology (NIST) in 2001 and has been the global standard ever since.

AES is used by:

• The US government and military (classified information)
• Banks and financial institutions worldwide
• WhatsApp, iMessage, Signal end-to-end encryption
• Apple's own FileVault disk encryption
• VPNs, password managers, secure messaging apps

It's not marketing language. It's the actual cryptographic backbone of modern digital security.

What Does "256" Mean?

The "256" refers to the key length — 256 bits. This is what makes AES-256 so strong.

To brute-force an AES-256 encrypted file (try every possible key), an attacker would need to try 2²⁵⁶ possible combinations. That's a number with 78 digits. Even if every atom in the observable universe was a computer, and each computer was trying a trillion keys per second, it would take longer than the age of the universe many times over.

AES-128 (128-bit key) is also considered secure for most purposes. AES-256 provides double the key length — an extra margin of safety against future computing advances, including quantum computing.

What Is GCM Mode?

Calculator Vault uses AES-256-GCM specifically. The "-GCM" part stands for Galois/Counter Mode. This is important because:

• GCM is an authenticated encryption mode — it not only encrypts data but also verifies that it hasn't been tampered with
• It detects if an attacker has modified the encrypted file, even by a single bit
• It provides both confidentiality (nobody can read the data) and integrity (nobody can silently modify it)

This means even if someone gets hold of your encrypted vault files, they can't just flip bits and get access — the integrity check will fail.

Where Is the Encryption Key Stored?

Encryption is only as strong as its key management. There's no point using AES-256 if the key is stored in a plain text file next to the encrypted data.

Calculator Vault stores encryption keys in the iOS Keychain. The Keychain is protected by the device's Secure Enclave — a dedicated security processor built into every iPhone since iPhone 5S. The Secure Enclave:

• Runs independently from the main processor
• Never exposes raw key material to the operating system
• Keys cannot be extracted, even by Apple or a forensic tool
• Is wiped on device reset

This means your encryption key is protected at the hardware level — not just by software.

What Happens Without Encryption?

Some photo vault apps protect files with a PIN but don't encrypt the underlying data. If you plug the device into a computer and use a file browser tool, the photos are visible as normal image files. The "vault" is just a locked door with the window open.

With AES-256 encryption, the photos don't exist as photos on disk — they exist as random, meaningless encrypted data. A file browser would show gibberish. A forensic tool would find nothing usable.

How Calculator Vault Implements AES-256

Calculator Vault uses Apple's own CryptoKit framework — the official Apple cryptography library introduced in iOS 13. This means:

• The encryption code is written and maintained by Apple engineers
• It's reviewed with every iOS security update
• No third-party cryptography library with unknown vulnerabilities
• Optimised for Apple hardware (uses hardware acceleration where available)

Every file imported into Calculator Vault is encrypted before being written to disk. Thumbnails are encrypted separately. File names are replaced with random UUIDs with a .vault extension. Even the metadata (file size, creation date) is obscured.