Vault Encryption Size Calculator
Estimate the encrypted file size overhead when protecting a file or variable with Ansible Vault.
Inputs
Size of the file or variable value before encryption.
Overhead multiplier from AES-256 encryption plus base64/hex armor and the vault header — 1.35× is typical.
Fixed-size header Ansible Vault prepends (version, cipher, salt) — roughly 90 bytes.
Encrypted File Size
5.49KB
Size Overhead vs Plaintext
37.2%
Overhead in Bytes
1,524bytes
Step by step
Plaintext size in bytes
4KB × 1024
= 4096 bytes
Encrypted body: plaintext × expansion factor
4096 × 1.35
= 5530 bytes
Encrypted total incl. vault header
5530 + 90
= 5620 bytes (5.49KB)
How it works
Ansible Vault encrypts content with AES-256 in CBC mode with an HMAC, then hex-encodes the ciphertext for safe storage in YAML/text files — hex encoding alone doubles size, but combined with the more compact internal encoding Ansible actually uses (base64-like framing) plus the vault header, the net overhead is commonly around 35% for typical secret sizes. Formula: encrypted_size = plaintext × expansion_factor + header_bytes.
Formula
encrypted_size_bytes = plaintext_bytes × expansion_factor + vault_header_bytes
- plaintext_bytes
- Size of content before encryption
- expansion_factor
- Overhead multiplier from AES-256 + hex/base64 armor (~1.35×)
- vault_header_bytes
- Fixed vault header size (~90 bytes)
Frequently Asked Questions
Why is the encrypted file so much bigger than the plaintext?
Ansible Vault's ciphertext is hex-encoded for safe embedding in text-based playbooks/vars files, and the file also carries a header line and HMAC for integrity verification, all of which add overhead beyond the raw AES-256 ciphertext.
Does encrypting a whole file cost more than encrypting single variables?
Per-byte overhead is the same either way, but `ansible-vault encrypt_string` for single variables adds slightly more relative overhead for very small values since the fixed header cost is spread over less content.
Does vault password strength affect encrypted size?
No — the password (or vault ID) only affects key derivation, not the size of the resulting ciphertext, which scales with plaintext size regardless of password complexity.
Should I encrypt entire files or individual variables?
Encrypting individual variables with `encrypt_string` keeps diffs readable and lets you see which variable changed in git history; encrypting whole files is simpler but makes every vars-file change look like a full rewrite in diffs.