A simple mental model

Imagine a locked shipping case with a numbered tamper seal. Encryption hides the contents; authentication detects whether the case or its label changed. The analogy is imperfect, but it explains why an encrypted vault should not merely scramble bytes—it should also refuse modified records.

Four pieces matter

  1. Key: Secret material that authorizes encryption and decryption.
  2. Nonce: A value that must be unique for each encryption under a given key.
  3. Ciphertext: The protected form stored on disk or in a backup.
  4. Authentication tag: Evidence checked before accepting the decrypted result.

Reusing a GCM nonce with the same key can seriously damage security. Good cryptography therefore depends on format design, randomness, key lifecycle, error handling, and context binding—not only the algorithm name.

Example: A vault encrypts two identical photos with distinct nonces. Their ciphertext should differ. If an attacker swaps a chunk from one file into another, authenticated context and the tag should cause the record to be rejected instead of displaying corrupted plaintext.

Why filenames and thumbnails matter

Encrypting only original image bytes can still reveal names, dates, previews, notes, or album membership. NullVault is designed to encrypt file contents, filenames, metadata, and app-managed previews before storing them in private app storage.

What AES-256-GCM does not solve

It does not turn a predictable human pattern into a random cryptographic key; that is why key derivation matters. It does not protect content while legitimately open on screen, remove exports, defeat a compromised operating system, or guarantee recovery after device loss.

NullVault’s broader design is documented in the security architecture. Continue with why Argon2id is used for patterns to understand the human-secret side of the system.

Standards reference

GCM is standardized by NIST in SP 800-38D. An algorithm label is not an audit; implementation details and the surrounding system determine actual protection.

Guide reviewed: 28 August 2026.