Security / AES-256-GCM
AES-256-GCM encryption explained simply
Short answerAES-256-GCM is a widely trusted way to scramble data so it can only be read with the right key. It also notices if the scrambled data has been changed. The standards behind it are published by the US National Institute of Standards and Technology (NIST).
What the name means
- AES is the Advanced Encryption Standard, the method that does the scrambling. Anyone can read how it works. Its strength comes from the secret key, not from keeping the method hidden.
- 256 is the size of the key, in bits. AES also comes in 128-bit and 192-bit sizes, and 256 is the largest. Trying every possible 256-bit key isn't a realistic attack.
- GCM is the way AES is used here. It adds a check, so if even the tiniest piece of the scrambled data changes, it refuses to open instead of showing you something damaged or tampered with.
An everyday way to picture it
Think of a sealed envelope that can't be steamed open. Without the key, nobody can read what's inside. If someone tampers with it, the seal shows it, and you find out when you try to open it.
How FirstHour's Vault uses it
- Everything in the Vault is sealed, including files, notes and the small previews. Videos and large files are sealed in pieces, because they're too large to handle all at once.
- It happens on your iPhone, using Apple's own encryption toolkit, CryptoKit. FirstHour's own code doesn't reinvent the encryption.
- One random key seals your Vault. It's stored only in locked form, and your pattern or PIN is what unlocks it.
What it can't do
- It's only as strong as the way in. Nobody needs to break AES if they can guess or watch your pattern.
- It protects the Vault, not your whole phone. Pictures still in Photos aren't encrypted by FirstHour.
- A picture on screen is a picture on screen. While the Vault is open, anyone looking at your iPhone can see what you see.
Here's the full list of what FirstHour can't protect against.
Questions
Could a very powerful computer break it?
Nobody can promise anything forever, but trying every 256-bit key isn't considered realistic. In practice, people's pictures get exposed through guessed passcodes, watched screens and unlocked phones, not through broken AES.
Does encryption mean nobody can ever see my pictures?
No. It means they can't be read without the key. Anyone who gets your pattern, PIN or recovery phrase can open the Vault.