HomeBlogAES-256 Explained
Security · 8 min read

AES-256, explained without the crypto headache.

What "AES-256 encrypted at rest" really means for a finance app you carry every day — and why "encrypted" alone is a meaningless promise without the key story to go with it.

VS
By Vinay Saurabh Published 25 Apr 2026Updated 30 May 2026

Every privacy-conscious app these days claims to be "encrypted". The word does an extraordinary amount of marketing work. It is also, on its own, almost meaningless. Encryption that uses a key the vendor can read is not really protecting you from the vendor. Encryption in transit that ends at a database stored in plaintext on a server is not protecting you from the breach. Encryption with a weak algorithm is not protecting you from anyone.

So when we say Trenziq stores your ledger using AES-256 with keys in the Android Keystore, that is a precise claim with three specific parts. Let's unpack each of them in plain language.

Part 1: AES-256 is the algorithm

AES — the Advanced Encryption Standard — is a symmetric block cipher published by NIST in 2001 after a five-year open competition. "Symmetric" means the same key encrypts and decrypts; "block cipher" means it operates on fixed-size chunks of bytes (16, in AES's case); the "256" in AES-256 refers to the size of the key in bits.

For practical purposes, you need to know three things about AES-256:

Part 2: SQLCipher is the storage layer

Trenziq's ledger lives in SQLite, the embedded database that runs on basically every smartphone ever shipped. Vanilla SQLite, however, stores its database file in plaintext on disk — if a forensic tool pulls the file off the device, the rows are right there.

SQLCipher is a well-respected, open-source extension to SQLite that transparently encrypts every page of the database with AES (256-bit, in CBC mode with HMAC) before writing it to disk and decrypts it on read. From the app's point of view, it is just SQLite. From the disk's point of view, it is opaque ciphertext.

This solves a very specific problem: if your phone is off, or the database file is otherwise pulled out of the app's sandbox, the data is unreadable without the key. That is the meat of "encryption at rest".

🔐

Why "encrypted at rest" needs a footnote

"At rest" specifically means "while sitting on storage". It does not mean "while the app is open with the database unlocked in memory". A finance app cannot, by definition, work without decrypting the data at some point — but it can absolutely refuse to send that decrypted data anywhere. The cloud-finance dangers piece goes into where that boundary tends to leak.

Part 3: Android Keystore is where the key lives

The hardest, and most consequential, part of any encryption story is key management. Where does the key come from? Where does it live? Who can read it?

On modern Android devices, the answer is the Keystore — an OS-level service that, on phones with hardware-backed key support (almost all phones from the last seven years), stores cryptographic keys inside a dedicated secure element or trusted execution environment. The key never leaves that hardware boundary. Even the app that requested it cannot extract its bytes; the app can only ask the Keystore to perform operations using the key.

For Trenziq, this means:

What this combination actually defends against

Crypto is most useful when you can map it to specific threats. Here is the matrix as it applies to Trenziq:

ThreatDefended?How
Lost / stolen locked phoneYesDatabase is AES-256 ciphertext on disk; key is device-bound.
Forensic disk imaging of the deviceYesThe imaged blob is unreadable without the in-hardware key.
Malicious app on the same deviceMostlyAndroid sandboxing prevents direct file access; key is not extractable.
Lost / stolen unlocked phoneNoThe app, like any app, will open. Use device lock + biometrics.
Server-side breachN/AThere is no server.
State-level adversary with physical access & vendor cooperationOut of scopeHonest answer — this is not the threat model.

What about backups?

Trenziq's optional Google Drive backup runs entirely client-side. The database is already AES-encrypted on disk; when you opt in, the backup picks up that ciphertext, wraps it with another envelope tied to a user-supplied secret, and pushes the resulting blob to your Drive. Google sees an opaque file, nothing more.

This is the right place to mention the responsibility you take on when you turn that backup on: you need to remember the wrapping secret. There is no "forgot password" link, because we cannot provide one without becoming exactly the kind of intermediary we set out to avoid. The companion piece on Android permissions walks through the related INTERNET-permission story.

How to evaluate "AES-256" claims in other apps

If you are auditing any finance app's encryption claim, ask these five questions:

  1. Where is the key? Hardware-backed Keystore, software keystore, or — alarmingly — embedded in the binary?
  2. Can the vendor decrypt my data? If yes (typical for cloud apps), the encryption is only as strong as the vendor's operational security.
  3. What is "at rest" defined as? Disk only? Memory? Both?
  4. What is the mode? AES-CBC + HMAC, AES-GCM, AES-CTR — they have different properties. "AES" without a mode is a yellow flag.
  5. Is the implementation auditable? SQLCipher, libsodium, Android Keystore — these are open, well-studied. Hand-rolled crypto is a red flag.

Closing the loop with sovereignty

Strong encryption is necessary but not sufficient. It makes your data unreadable to the wrong people; it cannot, on its own, prevent the data from being collected by the wrong people in the first place. That is why Trenziq pairs AES-256 storage with the more important architectural decision: nothing leaves the device unless you explicitly ask it to. The longer essay on data sovereignty ties the two threads together.

If you remember nothing else from this piece, remember this: an encryption claim without a key-management story is a marketing slogan. Now you know what to ask for.


Further reading from the network: If you appreciate engineering that treats users as the customer, our sister teams take the same posture in their own verticals — VoBot Developers for engineering, IBULUXE for premium essentials, Plasma Biotech for pharma research, Jigyasa Foundation for social-impact work and PGH for hospitality.

Our Network

Premium Essentials
IBULUXE
Technology
VoBot Developers
Pharma
Plasma Biotech
NGO / CSR
Jigyasa Foundation
Travel & Hotels
PGH