Encryption
What Is AES-256 Encryption? A Plain-English Guide for iPhone Users
What AES-256 encryption is, why a 256-bit key is out of reach, and what it does and does not protect on your iPhone. Honest and technical, no marketing fluff.
Quick answer: AES-256 is a symmetric cipher with a 256-bit key, standardized by NIST in 2001 and used for everything from classified government data to the storage encryption inside your iPhone. It scrambles data so that nobody without the key can read it. The cipher is public and trusted; the key, and who holds it, is what you actually have to think about.
To see AES-256 at work, try the free encrypt text tool: it encrypts a message with AES-256-GCM and a password, entirely in your browser.
What is AES-256?
AES-256 is the Advanced Encryption Standard used with a 256-bit key. It is a symmetric block cipher: the same key encrypts and decrypts, and it works on 128-bit blocks of data. NIST selected it in 2001 from a public competition and published it as FIPS 197. The number after AES is the key length, not the block size.
The winning design was Rijndael, by Belgian cryptographers Joan Daemen and Vincent Rijmen. The spec is published and has been studied by cryptographers for over two decades, and that open scrutiny is a big part of why it is trusted. AES-256 is not magic. It is a very large lock, and the interesting question is why a 256-bit key is out of reach.
Why is a 256-bit key considered uncrackable?
A 256-bit key has 2^256 possible values, about 1.16 × 10^77. Even a billion machines each trying a trillion keys per second would need on the order of 10^48 years to search the keyspace; the universe is about 1.4 × 10^10 years old. Brute force is simply not a realistic attack.
AES-128 is already in the same category. Its 2^128 keyspace is still far beyond any nation-state budget. AES-256 mostly buys a margin against future cryptanalysis and the partial speedup quantum search (Grover's algorithm) would offer.
| Attribute | AES-128 | AES-256 |
|---|---|---|
| Key size | 128 bits | 256 bits |
| Possible keys | 2^128 (~3.4 × 10^38) | 2^256 (~1.2 × 10^77) |
| Rounds per block | 10 | 14 |
| Brute-force time (classical) | Infeasible | Infeasible, larger margin |
| Effective strength vs Grover | 64 bits, borderline | 128 bits, safe |
| Speed | Slightly faster | About 40% more rounds per block |
| Typical use | TLS, much cloud storage | Device storage, long-lived secrets, backups |
No AES key has ever been brute-forced in the open literature. Real attacks go after the surrounding system: weak key derivation, reused nonces, side-channel leaks, or simply an unlocked phone.
How does AES-256 protect notes in practice?
AES-256 protects notes only where it is actually applied, and only as well as its key is protected. On an iPhone it is applied at the storage layer by iOS itself. Inside an app it may or may not be applied again. The key is usually derived from a passcode or password, so a weak passcode weakens everything.
Apps never encrypt with your password directly. A password goes through a key derivation function such as PBKDF2 or Argon2id, which deliberately burns time and memory so that offline password guessing becomes slow. The derived key then encrypts data in an authenticated mode such as GCM, which gives both confidentiality and tamper detection.
What AES-256 does not protect you against:
- An unlocked phone in the wrong hands. Once you have unlocked, data is decrypted for use. An app lock, Face ID and a short auto-lock timer help here; the cipher does not.
- Shoulder surfing and screenshots. Decrypted content on screen is human-readable by definition.
- A weak password.AES-256 with a key derived from “1234” falls to a dictionary attack if the attacker gets the encrypted data and can guess offline.
- Copies in the clear. If a plain-text export or a cloud copy sits somewhere with weaker protection, the strong cipher elsewhere does not help.
Where does AES-256 show up on your iPhone?
Your iPhone already uses AES-256 for its storage. A dedicated hardware engine encrypts the flash, and iOS Data Protection ties file keys to your device passcode, so most app data is unreadable while the phone is locked. iCloud adds its own encryption, which Apple makes end-to-end only with Advanced Data Protection.
This is why a strong device passcode matters more than any app's marketing. Apple documents the details in the Apple Platform Security guide, and our guide to whether iCloud is safe for sensitive notes walks through what changes once notes leave the phone.
How does Secure Notes use AES-256?
It depends on the platform, and we want to be precise. On Android, Secure Notes stores the whole vault in an AES-256 encrypted SQLCipher database, with the key protected by your PIN through Argon2id. On iPhone and iPad, notes rely on iOS Data Protection plus the app's passcode and Face ID lock. The app does not add its own cipher to notes.
What the iPhone app does encrypt itself is the Pro Encrypted Backup file (version 3.8.1 and later): AES-256-GCM, with the key derived on your device from a backup password you choose. Only someone with that password can open it. iCloud sync (Pro) goes to your own private iCloud database, not to a PixelPort server. The full picture is on our security page.
When you compare apps, look past the word “AES-256” to four questions: what exactly is encrypted, who holds the key, how the key is derived, and whether the claim can be checked. Our comparison of encrypted notes apps applies those questions to the popular options, and the glossary defines the terms.
Frequently asked: AES-256 encryption
Is AES-256 actually unbreakable?
In practical terms, yes. AES-256 has 2^256 possible keys, roughly 10^77. Brute-forcing one key at a trillion guesses per second would take far longer than the age of the universe. No public attack has materially weakened it since 2001. What breaks in the real world is the code around it: weak passwords, bad key derivation, reused nonces, side channels.
What is the difference between AES-128 and AES-256?
Both are the same algorithm with different key sizes. AES-128 uses a 128-bit key and 10 rounds; AES-256 uses a 256-bit key and 14 rounds. AES-128 is already considered out of reach for classical computers. AES-256 adds a larger safety margin, which is why it is a common default for long-lived secrets.
Does Apple use AES-256?
Yes. Every iPhone has a hardware AES-256 engine that encrypts the flash storage, with keys tied to the Secure Enclave and, for Data Protection, to your device passcode. Apple says iCloud data is encrypted with at least 128-bit AES. The Apple Platform Security guide is the canonical reference.
Can quantum computers break AES-256?
Not for the foreseeable future. Grover's algorithm would in theory reduce AES-256 to the equivalent of a 128-bit search, which is still infeasible. Symmetric ciphers like AES are far more quantum-resistant than the RSA and elliptic-curve systems used for key exchange, so AES-256 is considered a post-quantum-safe choice today.
Is AES-256 the same as end-to-end encryption?
No. AES-256 is a cipher, a math function. End-to-end encryption is an architecture decision about who holds the keys. A service can use AES-256 and still read your data if it holds the keys. End-to-end encryption means only your devices hold the keys, so the service in the middle cannot decrypt.
Does Secure Notes encrypt notes with AES-256?
On Android, yes: the whole vault is an AES-256 SQLCipher database whose key is protected by your PIN via Argon2id. On iPhone, notes are protected by iOS Data Protection (Apple's hardware AES) plus the app's passcode and Face ID lock; the app does not add its own cipher to notes. From version 3.8.1, the iPhone app's Pro backup file is AES-256-GCM encrypted with your password.
How do I know if an app actually uses AES-256?
Look for specific, checkable statements: the cipher and mode (AES-256-GCM), what exactly is encrypted (notes, attachments, backups), where the key comes from, and the key derivation function (PBKDF2, Argon2id). Vague phrases like 'military-grade' or 'bank-level' encryption with no detail are a warning sign. Open source code or a published audit is better still.
Keep reading
Related guides
Encryption
Zero-knowledge architecture, explained
What 'zero-knowledge' actually means, and how to spot a fake claim.
iCloud
Is iCloud safe for sensitive notes?
What iCloud encrypts, who holds the keys, and when that matters.
Comparison
Best encrypted notes apps for iPhone
How the main private notes apps actually protect your data.
