AES-GCM, like all versions of AES, has a block-size of 128 bits, or 16 bytes. Generally speaking, you shouldn't have to worry about the "merging encrypted blocks" as the implementation should handle encryption of data larger than a single block for you, and simply provide you with the full ciphertext that is the end result. Likewise, you don't have to worry about generating the authentication tag. The implementation generates the authentication tag for you. and you simply need to retrieve it once encryption is complete. **More Technically:** AES-GCM is a combination of AES-CTR and a authentication tag computed using Galois field multiplication. The fact that it is based on counter (CTR) mode which is a streaming mode means that the ciphertext is of variable length. The output can be the same length as the plaintext input, and does not need to be padded to make a full 16 byte final block as block modes such as ECB or CBC would require. The authentication function is a keyed hash function computed over both the ciphertext, and an additional authentication (but not encrypted) data which will always include (at minimum) the nonce.