AES and Argon2 explained simply
A plain guide to AES encryption and Argon2 password stretching: what each does, why they work together, and what they cannot fix.
If you read about how security apps work, two names come up again and again: AES and Argon2. They do different jobs. A simple picture helps.
The safe and the slow door
Imagine your photos are in a safe. AES is the safe itself. It turns each file into scrambled data that cannot be read without the right key. AES is a public standard used by governments, banks and every modern phone. Nobody has found a practical way to open it without the key.
But a safe is only as good as its key, and keys made from things people remember, like a PIN or a pattern, are short. A computer could try every short code very quickly.
That is where Argon2 comes in. It sits in front of the safe like a slow, heavy door. Your code goes through Argon2 to become the key, and Argon2 is designed to take a noticeable amount of time and memory each time it runs. For you, unlocking once, that is a fraction of a second. For someone trying millions of guesses, it adds up to a very long time. Because it needs a lot of memory, not just processing power, it also resists the specialized hardware people use to speed up guessing.
Why they need each other
AES without stretching leaves a short code easy to guess. Argon2 without strong encryption has nothing worth protecting. Together, a reasonably strong code becomes a key that is slow to guess and data that is useless without it.
You may also see AES-GCM. GCM is a mode of AES that also detects tampering: if anyone changes the stored data, decryption fails instead of producing quietly corrupted files.
Why "64 MiB" and "two passes" mean anything
Argon2 has settings. The memory setting is how much working memory each attempt must use; the pass count is how many times it works through that memory. Higher settings make each guess cost more, for you and for an attacker alike. App makers pick values that keep your own unlock quick on a phone while making mass guessing expensive. Argon2id is the variant recommended for passwords, because it balances resistance to two different kinds of attack.
You do not need to remember the numbers. What matters is that an app names them at all: it means someone made a deliberate choice rather than leaving it to defaults.
Where the hardware comes in
Modern phones have a small, separate secure chip: the Secure Enclave on iPhone, and on many Android phones a StrongBox security module. Keys can be created inside it and never leave it. When an app ties its key to that chip, the encrypted data copied off the phone is not enough on its own; an attacker would also need the chip, which is designed to resist exactly that.
That is a third layer on top of the safe and the slow door: the door only exists inside this one phone.
What they cannot fix
- A very weak code, such as 1234, is still guessable eventually, just more slowly.
- Someone who watches you unlock, or who you tell, skips the math entirely.
- Copies outside the safe, in your camera roll or a chat, are not protected by it.
In VaultWell, each vault's path is stretched with Argon2id using 64 MiB of memory and two passes, the key is bound to the phone's secure hardware, and content is encrypted in chunks with AES-GCM. The security architecture page has the detail.