What is an AES-256 key?
AES-256 is a symmetric encryption algorithm — the same 256-bit key both encrypts and decrypts data. The key must come from a cryptographically secure random source; deriving it from a password or predictable string defeats the purpose of a 256-bit key space.
Using it in Node.js
import { createCipheriv, randomBytes } from 'crypto';
const key = Buffer.from(process.env.ENCRYPTION_KEY!, 'hex'); // 32 bytes
const iv = randomBytes(12); // fresh IV per encryption, GCM recommends 12 bytes
const cipher = createCipheriv('aes-256-gcm', key, iv);
const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
const authTag = cipher.getAuthTag();Key management basics
- Store the key in a secrets manager or environment variable — never alongside the encrypted data.
- Generate a new, unpredictable IV for every encryption operation; never reuse an IV with the same key.
- Rotate the key periodically and after any suspected exposure, re-encrypting existing data under the new key.