AES vs RSA
A detailed comparison of features, privacy, and developer experience.
Last reviewed: 2026-05-17
Executive Summary
Different jobs. AES is for encrypting actual data. RSA is for exchanging the AES key (or signing). Almost every real system uses both.
AES
Advanced Encryption Standard, a symmetric block cipher. The same key encrypts and decrypts. Fast, well-vetted, the backbone of most data-at-rest and TLS-in-flight encryption.
RSA
Rivest–Shamir–Adleman, a public-key (asymmetric) algorithm. A public key encrypts, a private key decrypts. Slow, but solves the key-distribution problem AES alone can't.
Editor's Verdict
This isn't a versus, they're complementary. AES encrypts bytes fast: 128-bit AES-GCM runs at gigabytes per second per core. RSA can't do that, a 2048-bit RSA operation takes milliseconds and the ciphertext can't exceed the key size. The standard pattern (used by TLS, SSH, PGP, age, every file-encryption tool) is: generate a random AES key, encrypt the data with AES, encrypt the small AES key with the recipient's RSA public key, ship both. Recipient uses RSA private key to recover the AES key, then AES to decrypt the data. RSA is also widely used for digital signatures (sign with private key, verify with public). For new systems today, prefer elliptic-curve alternatives (Ed25519 for signatures, X25519 for key exchange), they're faster and have smaller keys at equivalent security.
What we ran
We encrypted `hello` with AES-256-GCM (password-derived) and inspected an RSA 2048 public PEM. AES output was a short Base64 blob; RSA is for wrapping keys and signatures, not bulk strings. Hybrid: RSA wraps an AES key, AES encrypts the body.
🔒When to use AES
- Encrypting any data larger than a few hundred bytes
- Disk encryption, database column encryption, file encryption
- TLS record-layer encryption (handled by the protocol)
🔐When to use RSA
- Encrypting an AES key for transport to another party
- Digital signatures (signing a JWT, verifying a release artifact)
- Legacy systems that already use RSA, for new work, prefer Ed25519/X25519
| Feature | AES | RSA |
|---|---|---|
| Type | Symmetric | Asymmetric (public/private) |
| Speed | Gigabytes/sec | Milliseconds per op |
| Max payload | Unlimited | Key size minus padding |
| Key exchange problem | Doesn't solve it | Solves it |
| Signature support | Use HMAC instead | Yes |
| Quantum resistance | Effectively yes (256-bit) | No (Shor's algorithm) |
| Modern alternative | ChaCha20-Poly1305 | Ed25519 / X25519 |
Key Takeaways
- Different jobs: AES = symmetric (one key, fast, bulk data). RSA = asymmetric (key pair, slow, small payloads).
- Real systems use both: RSA (or ECDH) to exchange an AES key, then AES to encrypt actual data, TLS does exactly this.
- AES-256-GCM is the modern default, authenticated encryption (encrypt + MAC in one step).
- RSA-2048 minimum in 2026; prefer ED25519 or X25519 for new signing/key-exchange needs.
- Never use raw RSA on payloads larger than your key size, use a hybrid scheme (RSA + AES).
Common Mistakes
- Using RSA to encrypt large files, orders of magnitude slower; use hybrid AES + RSA.
- Using AES-ECB mode, patterns in plaintext appear in ciphertext; the 'penguin meme' lives here.
- Reusing an AES-GCM nonce with the same key, catastrophic; key effectively compromised.
- Hand-rolling crypto code, use libsodium / Web Crypto / language-native AEAD primitives instead.
Frequently Asked Questions
Why is RSA slow?+
RSA operations are modular exponentiation with huge numbers (2048+ bits). That's intrinsically expensive compared to AES, which uses simple byte-level permutations and substitutions designed to be hardware-friendly.
Should I use RSA for new projects?+
Probably not. Ed25519 (signatures) and X25519 (key exchange) are faster, have smaller keys (32 bytes vs 256+), and are easier to use safely. Only use RSA when you have to interoperate with existing RSA systems.
Is AES-256 better than AES-128?+
Marginally. AES-128 has no known practical attacks and would take longer than the age of the universe to brute-force. AES-256 is preferred when post-quantum margin matters (Grover's algorithm halves effective bits). For most uses, both are fine.
How we tested this
We evaluated both AES and RSA in real developer workflows to build this comparison. Our assessment covers feature parity, privacy posture, developer experience, and ecosystem maturity.
Why these tools are worth your time
Privacy-respecting picks
We prefer tools that run locally or are explicit about what they send to the cloud.
Daily-driver tested
Recommendations come from real developer workflows, not marketing pages.
No vendor lock-in advice
We surface the trade-offs so you can switch later without rewriting your stack.