What is the secure way to encrypt a file with a key? Since it will be a small file, is using AES good enough for this assuming I keep the key in memory? So what I can do is just use AES for encryption/decryption - or am I am missing something?

  • It will depend on your goal, but AES is recommended by many organizations as "secure enough" – schroeder Sep 17 '15 at 2:41
  • Your question's title is about the secure WAY whereas your question's body is about the secure ALGORITHM, so what are you asking about? – user45139 Sep 17 '15 at 4:54
  • Secure against what kind of attack scenario? – Philipp Sep 17 '15 at 11:25

What improves security is to not persist the key but rather keep it in memory only long enough to use it; then discard it. Use a key management service (KMS), backed by a hardware security module (HSM), to retrieve a key only when you need it. Once you're done with using the key for the immediate operation, you need to discard it from memory. Retrieve it later when necessary by accessing it again through the KMS.

Also, you might want to use a unique key per encrypt operation, sometimes called a data key. This key would itself be encrypted by a higher-level key and the ciphertext of it stored, until decryption is necessary. Using a unique key per encryption operation reduces your exposure in the event that the key is compromised.

  • Thanks. This is for a personal project so plain AES should od. – John-Paul B Sep 17 '15 at 0:59
  • Ok. Well in addition to the above, you'll probably want to use an IV, a mode of operation, and a padding scheme. – vrtjason Sep 17 '15 at 1:35

You can try this on windows

To encrypt a folder or file

  1. Right-click the folder or file you want to encrypt, and then click Properties.
  2. Click the General tab, and then click Advanced.
  3. Select the Encrypt contents to secure data check box, click OK, and then click OK again.

To decrypt a folder or file

1.Right-click the folder or file you want to decrypt, and then click Properties.

2.Click the General tab, and then click Advanced.

3.Clear the Encrypt contents to secure data check box, click OK, and then click OK again



Other answers have already recommended AES encrytption, but I though it was worth sharing this link from NIST on recommended key lengths (and algorithms in fact). In summary, it uses an assessment of the rate of increase in computing power to work our a key length based on how long you want the file to be safe for.

So for example, AES-128 is considered OK if you need to keep your file safe up to 2030.


It might not be relevent for your use case if your file is pretty much ephemeral, but other searchers landing on this page might find it useful...


7zip has options to encrypt most any file, the user has the choice of encryption to apply, up to 2048 bit AES encryption if needed.

  • you mean AES-256? – Dillinur Sep 17 '15 at 7:36
  • Yes, that's what I meant, sorry for not using the proper term. – cat1092 Sep 20 '15 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.