AES-256-GCM is authenticated encryption that combines AES with a 256-bit key and Galois/Counter Mode to protect confidentiality and detect unauthorized changes.
What the name tells you
AES identifies the block cipher; 256 is the key length in bits; GCM is the mode that adds authentication. The result is more useful than secrecy alone: a vault should reject altered ciphertext instead of displaying corrupted data as if it were authentic. NIST SP 800-38D specifies GCM as authenticated encryption with associated data.
What the name does not prove
An algorithm label does not measure an app's complete security. A predictable unlock pattern, exposed recovery phrase, compromised device, or mishandled key can undermine a system using a respected cipher. Authentication also has a scope: it protects the information covered by the authenticated operation, not every surrounding file, cloud account, or screenshot.
When assessing an encrypted vault, ask what remains readable while it is locked. Filenames, thumbnails and database records can reveal sensitive information even when the original photograph is ciphertext.
In NullVault
NullVault documents AES-256-GCM for app-managed content and metadata. Pattern processing and platform protections are separate parts of the security architecture. The 256-bit key length should not be presented as the strength of a human-chosen pattern.
For a practical check, import a harmless file, lock the vault, and confirm that ordinary app navigation requires unlocking again. This tests visible behavior; it is not a cryptographic audit. Continue with how encrypted photo vaults work and why filenames and metadata need encryption.