AES-256 is the Advanced Encryption Standard used with a 256-bit key. It is the algorithm behind HTTPS on this page, full-disk encryption on your laptop, and the field-level encryption most business software uses to protect bank account numbers and identity documents.
What the 256 means
AES scrambles data in blocks using a secret key. The key can be 128, 192 or 256 bits long. A 256-bit key has 2256 possible values, a number with 78 digits. Trying every key, even on all the computers on Earth for the lifetime of the universe, would not get through a meaningful fraction of them. That is why AES-256 is described as unbreakable by brute force, and why it is approved for government top-secret material in the United States and accepted by every major standards body.
AES-128 vs AES-256
AES-128 is also unbroken and is faster. AES-256 is chosen where the data must stay protected for decades, where a regulator or customer contract names it, or where the small speed cost does not matter. For a business application encrypting a few fields per record, the cost is invisible, so AES-256 is the default.
Modes: CBC and GCM
AES on its own encrypts one block. A mode chains blocks together. CBC (cipher block chaining) is the older mode and needs a separate integrity check to detect tampering. GCM (Galois/Counter Mode) encrypts and authenticates in one step and is what modern TLS uses. Software frameworks such as Laravel encrypt stored fields with AES-256-CBC or AES-256-GCM and add the integrity check automatically.
What AES-256 does not protect
- The key. Encryption is only as safe as where the key lives. A key stored beside the data, or in a backup that walks out the door, undoes everything.
- Data in use. A field is decrypted when the application reads it. Access control, roles and audit trails decide who can trigger that.
- Everything else. "AES-256 encrypted" on a vendor's page usually means the connection is HTTPS. It says nothing about whether the database, the backups or individual fields are encrypted at rest. Ask which.
What to ask a software vendor
- Which fields are encrypted at rest, and with what? (Expect a list, not "everything".)
- Where are the keys kept, and who can read them?
- Are backups encrypted, and for how long are they kept?
- Is data encrypted in transit with TLS 1.2 or later?
- Which certifications do you hold, and which do you not?
A vendor who answers all five plainly, including the last one, is the one to trust. BeyondBoxAI's own answers are on the security page: bank account numbers, government IDs and visitor ID numbers encrypted with AES-256 at the field level, HTTPS with HSTS everywhere, nightly backups kept 14 days, hosting in Mumbai, and no ISO 27001 or SOC 2 certification today.
