What is AES-GCM Encryption?
AES-GCM combines encryption with integrity verification. Learn what nonces and tags do, compare other modes, and try a tamper-detection demo in your browser.
Updated September 9, 2026. Checked against NIST, IETF and Apple sources, plus Simple Memo 5.8.26 source. The author develops Simple Memo.
What do ciphertext, nonce and tag do?
AES is a symmetric cipher; GCM is a mode of operation. AES-GCM is an AEAD scheme: it can encrypt a payload and authenticate additional data (AAD) without encrypting that data. For example, an application could bind a visible format-version field to an encrypted body. AAD itself is not secret.
The nonce (IV) distinguishes encryptions and must not be reused with the same key. Unlike the key, it can accompany ciphertext. The authentication tag is checked during decryption; failed verification must produce an error rather than accepted plaintext.
Definitions: NIST SP 800-38D. Inputs and nonce requirements: RFC 5116.
Try changing the ciphertext
This example uses only a fixed sentence with the browser’s Web Crypto API. First encrypt and recover it, then change one bit in a ciphertext copy and verify again. This is an educational browser demo, not an audit of the app’s encryption.
Example: Review the draft at 10:00.
Start with the first button.
Working…
Verified: the original sentence was recovered.
Rejected: the changed ciphertext returned no plaintext.
The operation could not complete. Start again with the first button.
This environment cannot run the demo. It requires an HTTPS browser and JavaScript.
- Nonce (12 bytes)
- Original ciphertext (hex)
- Authentication tag (16 bytes)
Each run creates a new 256-bit key and nonce. The demo does not save or transmit its key or results. Reloading resets it. API reference: AES-GCM in Web Cryptography API.
Compare AES-CBC and ChaCha20-Poly1305
The table separates encryption from authentication. Performance depends on hardware and implementation; this is not a speed ranking. Knowing that a product uses CBC alone does not establish how its full authenticated construction behaves.
| Aspect | AES-GCM | AES-CBC | ChaCha20-Poly1305 |
|---|---|---|---|
| Encryption and authentication | Combined (AEAD) | CBC alone encrypts only | Combined (AEAD) |
| Uses AES | Yes | Yes | No |
| Design checks | Key, nonce, tag and usage limits | Authentication composition, IV and padding | Key, nonce, tag and usage limits |
TLS 1.3 is not limited to AES-GCM. RFC 8446 §9.1 requires AES-128-GCM implementation and also recommends AES-256-GCM and ChaCha20-Poly1305. See RFC 8439 for ChaCha20-Poly1305.
What does this protect in Simple Memo?
The checked release uses Apple CryptoKit AES-GCM with Keychain-managed keys for local storage. Newly generated keys are 256 bits. Outbox holds queued data; its encryption does not establish end-to-end encryption of a later email.
This implementation reads a symmetric key from Keychain. A Keychain-stored key is not the same claim as a private key generated and used inside Secure Enclave. Apple explains storing CryptoKit keys and Secure Enclave private keys separately.
Email passes through the app’s relay and delivery provider, and leaves a recipient-side copy. Check the privacy policy, recipient setup and arrival checks, and device/account access. Removing an Outbox item is not proof that every copy has been securely erased.
Frequently asked questions
What does 256 mean in AES-256-GCM?
It is the AES key length in bits. It is not the nonce length, authentication-tag length, or a score for the safety of an entire device.
Must the nonce remain secret?
Unlike the secret key, the nonce can be stored with ciphertext. The crucial requirement is not to reuse a nonce for encryption under the same key.
Can I display the body when tag verification fails?
Do not use failed verification output as valid plaintext. Handle the authentication error and investigate corruption, an incorrect key, or changed data.
Does AES-GCM mean end-to-end encryption?
The algorithm name is insufficient. A system design must specify who holds keys and where decryption occurs. Local Outbox encryption is separate from email transport and recipient-side storage.
Does Keychain storage mean the key never leaves Secure Enclave?
Not necessarily. The checked app implementation reads symmetric-key data from Keychain. That is different from an API that performs private-key operations inside Secure Enclave.
