# How does AES 256 encryption work? The algorithm and AES-256-GCM explained URL: https://webvpn.org/encryption/how-aes-works/ Updated: 2026-09-09 How the Advanced Encryption Standard works: the AES-256 algorithm's rounds, key expansion and mixing steps explained, and how AES-256-GCM adds authentication. AES-256 encryption works by taking 16 bytes of data at a time, arranged as a four-by-four grid, and passing it through 14 rounds in which every byte is substituted through a fixed lookup table, the rows are rotated, each column is mathematically mixed, and the result is combined with a round key derived from the 256-bit main key. After the last round the grid is the ciphertext. Decryption applies the inverse of each step in reverse order. AES-256-GCM wraps this block operation in a mode that handles data of any length and adds an authentication tag to detect tampering. The Advanced Encryption Standard is deliberately built from operations simple enough to describe on one page, and yet it has resisted two decades of attack. This guide walks through how AES works: the state, key expansion, the four round operations and why they are ordered as they are, what changes with a 256-bit key, and how GCM turns the raw cipher into something safe to use on real data. ## The state: 16 bytes in a grid AES operates on a fixed block of 128 bits, which is 16 bytes. The algorithm arranges them in a four-by-four grid called the state, column by column. Every operation in AES either transforms individual bytes, rows or columns of this grid. At the end, the grid is read out column by column as the 16-byte ciphertext block. The key is separate from the block. AES-128, AES-192 and AES-256 all use the same 128-bit block; only the key length, and with it the number of rounds, changes. ## Key expansion: one key becomes many Before any data is processed, the key schedule expands the main key into a series of round keys, one for the initial step and one for each round. AES-256 produces 15 round keys of 128 bits each from its 256-bit key; AES-128 produces 11. The expansion mixes the key with itself through substitutions, rotations and fixed constants so that each round key looks unrelated to the others, and so that recovering one round key does not trivially reveal the main key. The round keys are what make the transformation depend on the secret. The other operations are fixed and public; the round keys are the only place the key enters. ## The four round operations Each round applies four operations to the state in order. Together they provide what cryptographers call confusion, hiding the relationship between key and ciphertext, and diffusion, spreading each input bit's influence across the whole output. - SubBytes. Every byte in the state is replaced with another byte according to a fixed 256-entry table called the S-box. The S-box is built from a mathematical inversion followed by a small transformation, chosen so that the substitution is highly non-linear. This is the only non-linear step in AES and the main source of confusion. - ShiftRows. The four rows of the grid are rotated left by zero, one, two and three positions respectively. Bytes move between columns, so that the next step mixes bytes that started in different columns. - MixColumns. Each column of four bytes is multiplied by a fixed matrix in a finite field, so that every output byte in the column depends on all four input bytes. Combined with ShiftRows, this spreads each byte's influence across the entire state within two rounds. The final round omits MixColumns, because it would add no security there and would complicate decryption. - AddRoundKey. The state is combined byte by byte with the round key using XOR. This is where the secret enters each round. Before the first round, a single AddRoundKey with the first round key is applied to the plaintext, so that no operation is performed on unkeyed data. ## Why 14 rounds One round of AES is weak on its own; the mixing is incomplete. After two rounds, every bit of the state depends on every bit of the input, and by around six rounds the best known analytic attacks stop working. The standard specifies 10 rounds for AES-128, 12 for AES-192 and 14 for AES-256. The extra rounds beyond the minimum are a safety margin against future improvements in cryptanalysis. Attacks published on reduced-round AES give researchers a way to measure how large that margin is, and it has remained comfortable. ## How AES-256 differs from AES-128 The algorithm is the same. What changes is that a 256-bit key is expanded into 15 round keys, the key schedule runs slightly differently to accommodate the longer key, and 14 rounds are executed. The result is about 40 percent more work per block and a much larger keyspace, as the AES-256 guide on this site discusses. Everything above about the state and the operations applies identically. ## Decryption Every AES operation is invertible. Decryption applies InvSubBytes with the inverse S-box, InvShiftRows rotating right, InvMixColumns with the inverse matrix, and AddRoundKey, which is its own inverse since XOR twice returns the original. The round keys are used in reverse order. Hardware implementations of AES commonly implement both directions, which is why disk encryption and VPNs can decrypt as fast as they encrypt. ## From one block to real data: modes of operation AES on its own encrypts exactly 16 bytes. Real data is longer, and encrypting each block independently, called ECB mode, leaks patterns because identical blocks produce identical ciphertext. Modes of operation define how the block cipher is applied to longer data, and the choice is critical. The AES modes guide on this site compares CBC and GCM; here is what GCM does. ## AES-256-GCM: encryption plus authentication Galois/Counter Mode uses AES in an unusual way. Instead of encrypting the data directly, it encrypts a sequence of counter values, each derived from a unique nonce plus a block number, and XORs the resulting keystream with the plaintext. This turns AES into a stream cipher: any length of data, no padding, and blocks can be processed in parallel, which is why GCM is fast. At the same time, GCM computes an authentication tag over the ciphertext and any associated data using multiplication in a Galois field. The recipient recomputes the tag and rejects the message if it does not match. This detects any modification of the ciphertext, which unauthenticated modes cannot do, and closes a whole class of attacks in which an adversary alters encrypted data to learn or change its contents. GCM has one strict requirement: the nonce must never repeat for the same key. Reusing a nonce leaks the XOR of two plaintexts and can expose the authentication key. Implementations handle this with counters or large random nonces, and getting it wrong has broken real products. Used correctly, AES-256-GCM is the standard choice in TLS, VPN protocols, messaging and storage, as the VPN and HTTPS guides on this site note. ## What the designers and standards bodies say The description above follows the published specification and its analysis. The AES specification defines the state, key expansion, the four round operations and the round counts exactly as described, and its designers documented that the structure was chosen for provable diffusion properties, resistance to known attack classes and efficiency in hardware and software. Standards bodies recommend authenticated encryption modes such as GCM for new systems, specify nonce requirements for GCM, and note that ECB mode is unsuitable for general data protection. Cryptanalysts who study AES report that the best attacks on the full cipher remain impractical, that attacks on reduced-round variants stop well short of the specified rounds, and that implementation issues including side channels and nonce reuse account for real-world failures. ## What to take from the algorithm You do not need to implement AES to benefit from understanding it, and you should never implement it yourself for real use. What the walkthrough gives you is a way to read a product's claims: AES is the block transformation, the key size sets the rounds, the mode decides how blocks become data, and GCM adds the integrity check that makes ciphertext trustworthy. When a product says AES-256-GCM, you now know exactly what it is promising. ## FAQ Q: How does the AES encryption algorithm work? A: AES treats 16 bytes of plaintext as a four-by-four grid called the state and applies a sequence of rounds. Each round substitutes every byte through a fixed table, rotates the rows, mixes each column mathematically, and combines the state with a round key derived from the main key. After the final round the state is the ciphertext. Decryption runs the inverse operations in reverse. Q: How does AES 256 bit encryption work differently from AES-128? A: The algorithm is identical. AES-256 uses a 256-bit key, which the key expansion stretches into 15 round keys instead of 11, and runs 14 rounds instead of 10. Block size stays 128 bits in both. The extra rounds and key material give a larger security margin. Q: What is AES-256-GCM encryption? A: AES-256 used in Galois/Counter Mode, an authenticated encryption mode. GCM turns AES into a stream cipher by encrypting a counter and XORing the result with data, and simultaneously computes an authentication tag that detects any tampering. It is the standard way to use AES in TLS, VPNs and modern software. Q: Why does AES use so many rounds? A: Each round spreads the influence of every input bit and key bit a little further. After two rounds every output bit depends on every input bit; the remaining rounds provide a margin against cryptanalysis. The best known attacks work on versions with fewer rounds than the full cipher, which is why the round count is set well above the minimum. Q: Is AES a block cipher or a stream cipher? A: AES itself is a block cipher, processing 128-bit blocks. Modes of operation such as GCM or CTR use it to produce a keystream, making it behave like a stream cipher for arbitrary-length data. The cipher provides the core transformation; the mode determines how it is applied.