AES-GCM vs AES-CBC
Authenticated encryption versus classic block chaining—compare tamper detection, nonce handling, and padding pitfalls.
Overview
Both modes use the same AES block cipher, but only GCM authenticates the ciphertext. CBC can be used safely with a properly ordered encrypt-then-MAC construction, yet in practice that step is skipped or reversed, which is how padding-oracle vulnerabilities keep reappearing. GCM shifts the burden onto nonce discipline: a unique nonce per message per key is mandatory.
AES-GCM
Open AES Encrypt/DecryptPros
- Detects tampering with a built-in auth tag
- No padding, so no padding-oracle class of bugs
- Widely available in Web Crypto and TLS
Cons
- Reusing a nonce with one key is catastrophic
- Limited safe data volume per key
AES-CBC
Pros
- Long-standing support in legacy systems
- Simple to describe and widely documented
- Available where GCM is unavailable
Cons
- No integrity check unless you add a MAC
- Padding handling invites oracle attacks
Comparison table
| Aspect | AES-GCM | AES-CBC |
|---|---|---|
| Integrity | Built-in authentication tag | Requires a separate MAC |
| Padding | None needed | PKCS#7 padding required |
| Main risk | Nonce reuse | Padding oracle and missing MAC |
| Best fit | You want confidentiality and integrity in one step | You must interoperate with an existing CBC system |
Recommendation
Choose AES-GCM for new work and generate a fresh random nonce for every message. Keep CBC only for interoperability, and always pair it with an explicit MAC over the ciphertext.
Related tools
Related articles
Related comparisons
Frequently asked questions
- Is a random nonce good enough for GCM?
- A 96-bit random nonce per message is standard practice for moderate volumes. Very high-volume systems should use a deterministic counter to eliminate collision risk entirely.
- Are browser-based demos safe for real secrets?
- Treat local encryption tools as learning aids. Production key management, rotation, and audit belong in a dedicated service, not a browser tab.
- What pushes someone toward AES-GCM instead of AES-CBC?
- AES-GCM wins when you want confidentiality and integrity in one step. The practical upside is that detects tampering with a built-in auth tag, and no padding, so no padding-oracle class of bugs. The trade-off to watch is that reusing a nonce with one key is catastrophic.
- When does AES-CBC beat AES-GCM for the same job?
- Reach for AES-CBC when you must interoperate with an existing CBC system. It gives you long-standing support in legacy systems plus simple to describe and widely documented, at the cost that no integrity check unless you add a MAC.
- Can ToolHub help me try AES-GCM and AES-CBC before I commit?
- Yes. The tools linked from each side of AES-GCM vs AES-CBC run in your browser, so you can exercise AES-GCM and AES-CBC with sample data without uploading anything.