The cipher
AES (Advanced Encryption Standard) turns readable data into ciphertext using a key. AES-256 uses a 256-bit key: there are more possible keys than atoms in the observable universe, so guessing the key directly is not a realistic attack.
The mode: why GCM
A cipher needs a mode to encrypt files of any size. GCM encrypts the data and computes an authentication tag. If anyone changes even one bit of the ciphertext, decryption fails instead of returning corrupted data. VaultBolt uses AES-256-GCM for file content, thumbnails and its index, sealed in chunks so videos can stream.
Where real attacks happen
| Weak point | Example | Defence |
|---|---|---|
| Weak unlock | A 4-digit PIN | Passphrase; slow key derivation |
| Key derivation | Fast hashing lets attackers guess quickly | Memory-hard Argon2id |
| Off-device guessing | Copying storage to a fast computer | Key bound to the Secure Enclave |
| Key on a server | Vendor can reset or read | No account; keys stay on device |
| Plain copies | Originals left in Photos | Zero-copies clean-up |
Why "military-grade" tells you little
AES-256 is used by governments, so "military-grade" is technically true of almost any app that uses it. It says nothing about the mode, the key or where it lives. Look for a security page that explains those.
Frequently asked questions
Can AES-256 be cracked?
Not by brute-forcing the key with any foreseeable technology. Attacks target weak passwords, stolen keys or software bugs instead.
What is the difference between AES-256 and AES-256-GCM?
AES-256 is the cipher. GCM (Galois/Counter Mode) is how it is applied to data; it encrypts and also produces an authentication tag that detects any change to the ciphertext.
