Encryption Algorithms in 2026: Which Ones to Use, and Which Are Retired

The short answer: there is no single best encryption algorithm, because encryption algorithms do different jobs. For bulk data use AES-256-GCM or ChaCha20-Poly1305. For key exchange use X25519. For signatures use Ed25519, or RSA-3072 where compatibility forces it. For file integrity use SHA-256 or BLAKE2. For passwords use Argon2id, never a plain hash. DES, 3DES, RC4, MD5 and SHA-1 are retired and should not appear in anything you deploy in 2026.

Most lists of encryption algorithms mix these categories together and rank them as if they competed. They do not. A signature algorithm and a password hash are not alternatives to each other, and calling both “encryption” is where most confusion starts. This page sorts them by the job they do.

The working list, by job

A note on how to read that table: “retired” here means a standards body has formally deprecated the algorithm or practical attacks exist, not that it is merely old. Age alone is not a flaw. AES was published in 2001 and remains the default recommendation.

Symmetric encryption: one key, used for the bulk of the data

Symmetric algorithms use the same key to encrypt and decrypt. They are fast, and they do almost all of the actual work. When your browser loads a page over HTTPS, the slow public-key mathematics happens once during the handshake, and a symmetric cipher encrypts everything after that.

AES (Advanced Encryption Standard). Selected by NIST in 2001 from the Rijndael submission, published as FIPS 197. It is a block cipher with a 128-bit block and keys of 128, 192 or 256 bits. Most modern processors implement it in hardware through the AES-NI instruction set, which is why AES is usually the fastest option on a laptop or server.

The mode matters as much as the cipher. AES-GCM provides authenticated encryption, meaning it detects tampering as well as hiding content. AES-XTS is the mode used for disk encryption, where each sector is encrypted independently. AES-ECB should never be used for anything, because identical plaintext blocks produce identical ciphertext blocks and the structure of the data leaks through.

ChaCha20-Poly1305. A stream cipher paired with a message authentication code, specified in RFC 8439. It is the usual choice where AES hardware acceleration is missing, which in practice means many phones and embedded devices. It is used by TLS 1.3 and by WireGuard. On hardware without AES-NI it is typically faster than AES; on hardware with AES-NI, AES usually wins.

Asymmetric encryption: two keys, used to establish trust

Asymmetric algorithms use a public key that anyone may hold and a private key that only the owner has. They solve the problem symmetric ciphers cannot: agreeing on a key with someone you have never met.

RSA. Published in 1977 and named after Rivest, Shamir and Adleman. Its security rests on the difficulty of factoring the product of two large primes. RSA-1024 is broken in practice and should not be accepted anywhere. RSA-2048 is still widely deployed; RSA-3072 or RSA-4096 is the safer choice for anything issued today. RSA keys and signatures are large and RSA operations are slow compared with elliptic curve alternatives, which is why new systems rarely choose it unless compatibility demands it.

Elliptic curve algorithms. These achieve comparable security with much smaller keys. X25519, built on Curve25519, is the standard key exchange in TLS 1.3, Signal and WireGuard. Ed25519 is the matching signature algorithm. ECDSA on P-256 is the older NIST curve option, still very common in certificates. Ed25519 is generally preferred for new work because its design avoids a class of implementation mistakes that have broken ECDSA deployments in the past, most famously when a random value is reused.

Hashing is not encryption, and the difference matters

A hash function is one way. There is no key and nothing to decrypt. Hashes prove that data has not changed; they do not hide it. Calling a hash “encryption” is the single most common error in this subject.

SHA-2, published in 2001, is the current workhorse. SHA-256 and SHA-512 are its most used members. SHA-3, standardised in 2015 from the Keccak design, is not a replacement but an insurance policy: it is built on completely different internals, so an attack on SHA-2 would be unlikely to affect it. BLAKE2 and BLAKE3 are fast modern alternatives widely used outside formal standards work.

MD5 and SHA-1 are broken. MD5 collisions have been practical since the mid-2000s. SHA-1 collisions were demonstrated publicly in 2017 by the SHAttered research. Neither should be used to verify anything that an attacker might want to forge. You will still encounter both as non-security checksums, and that use is not dangerous, but do not confuse the two roles.

Password hashing is a separate category with separate rules

Passwords must never be stored with a general purpose hash, however modern. SHA-256 is designed to be fast, and speed is exactly the wrong property here: it lets an attacker who steals your database try billions of guesses per second.

Password hashing functions are deliberately slow and memory-hungry. Argon2id won the Password Hashing Competition in 2015 and is the current recommendation. scrypt and bcrypt remain acceptable and are widely deployed. All three take tuning parameters, and the parameters matter as much as the choice of function. None of this protects a password that was reused elsewhere, which is why two-factor authentication matters even when the hashing is done correctly.

What post-quantum standardisation changes, and what it does not

In August 2024 NIST published its first post-quantum standards: ML-KEM (FIPS 203, from the Kyber design) for key encapsulation, ML-DSA (FIPS 204, from Dilithium) for signatures, and SLH-DSA (FIPS 205, from SPHINCS+) as a hash-based signature alternative.

The threat these address is specific and worth stating precisely. A sufficiently large quantum computer running Shor’s algorithm would break RSA and elliptic curve cryptography, because both rest on problems that algorithm solves efficiently. No such machine is known to exist. The reason to act now is the harvest-now-decrypt-later problem: traffic captured today can be stored and decrypted later, so anything that must stay secret for a decade is already exposed.

Symmetric cryptography is far less affected. Grover’s algorithm gives a quadratic speedup against a brute force key search, which is why AES-256 is generally considered to retain an adequate margin while AES-128 is viewed as weaker under that assumption.

In practice, deployment today is hybrid: browsers and servers have begun combining X25519 with ML-KEM so that the connection stays safe if either component fails. You do not need to change your own choices yet, beyond preferring AES-256 over AES-128 where the option exists.

Honest limits of this page

Three things this list cannot tell you.

The algorithm is rarely what fails. Implementation bugs, key management and configuration cause vastly more real breaches than cipher weaknesses. Heartbleed was a memory handling bug in OpenSSL, not a flaw in any algorithm.

Recommendations move. Everything above reflects the position in September 2026. Post-quantum guidance in particular is changing quickly, and any page that claims a permanent answer is wrong by construction.

Defaults are usually right. If you are using a maintained tool with modern defaults, such as LUKS for disks or TLS 1.3 for transport, you are almost certainly already on the algorithms in the recommended column. The main value of knowing the list is recognising when something has been left behind.

For the underlying concepts rather than the catalogue, start with what encryption is, and for applying it to a whole disk see full disk encryption.