Online banking
Your bank already encrypts its website. A VPN adds a layer between you and the VPN server, and keeps the names of the sites you visit away from the local network.
VPNs and online bankingEncryption and protocols
AES-256 encryption
Encryption is what turns a VPN from a detour into a private tunnel. DarkMatter uses AES-256, a widely used, openly published cipher, so the networks between you and the VPN server see scrambled data.
- AES-256: an open, widely reviewed encryption standard
- Scrambles traffic between your device and the VPN server
- Established cryptography, nothing home-grown
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
- Up to 5 devices at once
- Windows, macOS, iOS, Android and Fire TV
What it is
What is AES-256 encryption?
In short
AES-256 is a symmetric encryption cipher: the same secret key scrambles and unscrambles data. The 256 is the length of that key in bits. In a VPN, data is encrypted on your device before it leaves and decrypted at the VPN server, so anyone watching in between sees only scrambled data.
How it works
How VPN encryption works
Encryption in a VPN happens in two stages: agreeing secret keys, then using them to scramble your data.
- Encrypted VPN tunnel
- Normal connection
- Data without encryption
Read this diagram as text
Two rows. Row one, unprotected data on shared Wi-Fi: data your device sends without encryption crosses the Wi-Fi network in readable form, where someone watching could read it, before reaching the website. Row two, inside an encrypted VPN tunnel: your device encrypts the data with a cipher such as AES-256, the shared Wi-Fi sees only scrambled data, and the VPN server decrypts it and sends it on. This shows how encryption works in general.
Two rows. Row one, unprotected data on shared Wi-Fi: data your device sends without encryption crosses the Wi-Fi network in readable form, where someone watching could read it, before reaching the website. Row two, inside an encrypted VPN tunnel: your device encrypts the data with a cipher such as AES-256, the shared Wi-Fi sees only scrambled data, and the VPN server decrypts it and sends it on. This shows how encryption works in general.
Keys are agreed
When you connect, your device and the VPN server use a key exchange to agree fresh session keys, without sending the keys themselves across the network.Data is encrypted
Before traffic leaves your device, it’s scrambled with the session key. Without the key, it’s unreadable.The server decrypts it
The VPN server uses its copy of the key to unscramble the data and send it on to where it’s going.
A 256-bit key has an astronomically large number of possible values, far too many to try one by one. That’s why attacks on well-implemented encryption tend to target other things, such as stolen passwords or compromised devices, rather than the cipher itself.
Not every VPN protocol uses the same cipher. WireGuard, for example, is designed around ChaCha20-Poly1305, another modern cipher. The protocols you can choose depend on your device.
Why it matters
Where it makes a difference
Encryption earns its keep whenever your traffic crosses a network someone else runs.
Public Wi-Fi
On a shared network, unprotected traffic can be watched. Inside the tunnel, the network sees scrambled data heading to a VPN server.
Using a VPN on public Wi-FiWorking remotely
Cafés, co-working spaces and hotels put your traffic on networks you don’t control. Encryption means those networks see only scrambled data.
VPNs for remote work
Side by side
How it compares
| HTTPS only | VPN tunnel only | HTTPS inside a VPN tunnel | |
|---|---|---|---|
| Page contents encrypted in transit | Yes | Partly | Yes |
| Site names kept from the local network | No | Yes | Yes |
| Your IP address kept from the site | No | Yes | Yes |
| Other apps’ traffic encrypted | Only apps that encrypt | Traffic in the tunnel | Traffic in the tunnel |
“Partly”: a VPN on its own encrypts traffic as far as the VPN server. From there to the website, the site’s own HTTPS protects the contents.
The honest bit: what it can’t do
- Encryption protects data between your device and the VPN server. From the server to the website, the site’s own encryption (HTTPS) does that job.
- It doesn’t stop websites or accounts you sign in to recognising you, and it doesn’t remove tracking cookies.
- It can’t protect a device that’s already compromised. Malware that can read your screen can read your data before it’s encrypted.
- Which cipher protects a connection depends on the protocol in use, and the protocols available depend on your device.
AES-256 Encryption
Common questions
What does AES-256 mean?
AES is the Advanced Encryption Standard, a cipher standardised in the early 2000s and used widely across the internet. The 256 is the length of its key in bits.
Is AES-256 secure?
It’s widely regarded as secure and is used across banking, messaging and the wider web. As with any encryption, real-world security also depends on how it’s implemented and on the devices at each end.
Does WireGuard use AES-256?
No. WireGuard is designed around ChaCha20-Poly1305, a different modern cipher. See how WireGuard works.
What is a session key?
A temporary key your device and the VPN server agree when you connect. It encrypts that session’s data, and modern VPN protocols replace it over time rather than using one key for everything.
What protects my data after it leaves the VPN server?
From the VPN server to the website, your traffic travels like any other internet traffic. If the site uses HTTPS, as most do, the contents stay encrypted on that stretch too.
If websites already use HTTPS, do I need a VPN?
HTTPS protects the contents of a page. A VPN also keeps the names of the sites you visit from the local network, and replaces your IP address with a VPN server’s. They do different jobs and work well together.
Can my internet provider see what I do while I’m connected?
They can see that you’re connected to a VPN server and roughly how much data you send, but the traffic inside the tunnel is scrambled.
Is encryption included on every plan?
Yes. Every plan includes every feature. See plans.
Included on every plan
Every plan includes every feature, for up to 5 devices at once. Renewal prices are shown before you pay.
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
- Up to 5 devices at once
- Windows, macOS, iOS, Android and Fire TV
Related features
Last reviewed