Understanding Argon2id & AES-256-GCM Encryption

Open any password manager's security page and you'll hit a wall of acronyms: AES-256, Argon2id, PBKDF2, GCM. They sound interchangeable, but two of them are doing very different jobs, and getting both right is the difference between a vault that shrugs off a leaked backup and one that doesn't. Here's the short version, no cryptography degree required.

The two jobs your vault has to do

Protecting your data really comes down to two steps. First, turn the password you can remember into a proper encryption key. Second, use that key to scramble your data so nobody can read it or quietly change it. Argon2id handles the first step. AES-256-GCM handles the second. Let's take them one at a time.

Step one: Argon2id turns your password into a key

Your master password isn't the encryption key itself. It's too short and too human for that. The app has to stretch it into a full 256-bit key first, and how it does that stretching matters enormously.

Old methods like a single pass of SHA-256, or a lightweight PBKDF2 setup, are fast to compute. That sounds good until you realize an attacker who steals an encrypted backup can be fast too. With a rack of graphics cards, they can test billions of password guesses every second, because each guess is cheap.

Argon2id, which won the international Password Hashing Competition, is deliberately expensive in a way that hurts attackers far more than it hurts you. It's what cryptographers call memory-hard: every single guess has to allocate a chunk of RAM to complete. In OneVault, each attempt claims 19 megabytes. Your phone does that once when you unlock, and never notices. A GPU cracking rig, though, lives or dies on running thousands of guesses in parallel, and it simply doesn't have the memory bandwidth to feed 19 MB to thousands of cores at once. The memory requirement quietly strangles the whole attack.

Step two: AES-256-GCM locks the data

Once Argon2id has produced your key, your passwords, cards and notes get encrypted with AES-256-GCM. There are two parts to that name and both earn their place.

• AES-256 is the encryption standard governments and banks have trusted for two decades. With a proper key, there's no known practical way to brute-force it.
• GCM is the part people overlook. It adds an authentication tag to every encrypted chunk, so the app can tell if anything was tampered with. Older CBC-mode encryption would happily decrypt altered data into garbage and hand it back. GCM refuses, which means a corrupted or maliciously edited backup fails loudly instead of silently poisoning your vault.

What "zero-knowledge" really means here

Put the two steps together and you get the property that actually matters: at no point does a readable version of your key leave your device. Argon2id runs on your phone's own processor, in a background isolate so it never freezes the screen. The derived key exists only in memory while you're using the app. Nothing readable is written to disk, and nothing is sent to a server. That's why even we can't open your vault, and why a leaked backup is just noise to whoever finds it. It's also why there's no password reset: there's no copy of your key anywhere for us to recover.

This is the same architecture that makes browser-stored passwords look fragile by comparison, a topic we cover in why browser-saved passwords are a risk. And if you're weighing which apps get the cryptography right, the 2026 password manager comparison is a good next read.