How long is the encryption/decryption key for an assymetric algorithm, such as AES? If I use AES 128-bit, how many characters should I type in for my key? What about AES 256-bit?

Edit: Here is why I am asking: I am trying to use OpenSSL to encrypt some data using Node.js, PHP and command-line. I need to give in the key. When I tried 32 letter-key for AES128, it returned key length error. When I tried 32 for AES256 it returned general key error. I have no idea how I am supposed to enter the encryption key...

closed as off-topic by Adi, NULLZ, AviD Nov 12 '13 at 8:05

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    This question appears to be off-topic because it is not constructive. – Adi Nov 11 '13 at 23:14
  • 1
    There are several mis-conceptions here (and in your answer). Before you start asking for in-depth details (and especially before you try providing an answer to your own strawman question), I strongly suggest you start by reading up on the basics, even Wikipedia will do. – AviD Nov 12 '13 at 8:07

An AES 128-bit key can be expressed as a hexadecimal string with 32 characters. It will require 24 characters in base64.

An AES 256-bit key can be expressed as a hexadecimal string with 64 characters. It will require 44 characters in base64.

  • 3
    Thanks for this succinct answer to the question. (which even though is closed because "off topic" has been viewed 30k times so is clearly something people are searching for!) to generate AES256 encryption key in Erlang/Elixir we used: :crypto.strong_rand_bytes(32) |> :base64.encode – nelsonic Apr 10 '18 at 13:55

Encryption keys for AES are not expressed in characters or letters. Encryption keys are a series of 128 (or 256) bits.

If you are using some kind of interface to enter a text-based password, internally it is turning your typed password into bits. It may be using a complex routine like PBKDF2, or a single iteration of SHA-1.

In that case, you need to understand the unpredictability of someone guessing your password, instead of thinking of a minimum number of characters. Much has been written on the topic. I suggest you google for "correct horse battery staple" for an excellent primer on the topic.


For a 128-bit key:

8-bits per character raw (base-256, i.e. where a character can take any byte value)
6-bits per character base-64 encoded

Not the answer you're looking for? Browse other questions tagged or ask your own question.