Estimate encrypted file size overhead when using Ansible Vault for secrets.
Ansible Vault encrypts content with AES-256 in CBC mode with an HMAC, then hex-encodes the ciphertext for safe storage in YAML/text files — hex encoding alone doubles size, but combined with the more compact internal encoding Ansible actually uses (base64-like framing) plus the vault header, the net overhead is commonly around 35% for typical secret sizes. Formula: encrypted_size = plaintext × expansion_factor + header_bytes.
encrypted_size_bytes = plaintext_bytes × expansion_factor + vault_header_bytes
Ansible Vault's ciphertext is hex-encoded for safe embedding in text-based playbooks/vars files, and the file also carries a header line and HMAC for integrity verification, all of which add overhead beyond the raw AES-256 ciphertext.
Per-byte overhead is the same either way, but `ansible-vault encrypt_string` for single variables adds slightly more relative overhead for very small values since the fixed header cost is spread over less content.
No — the password (or vault ID) only affects key derivation, not the size of the resulting ciphertext, which scales with plaintext size regardless of password complexity.
Encrypting individual variables with `encrypt_string` keeps diffs readable and lets you see which variable changed in git history; encrypting whole files is simpler but makes every vars-file change look like a full rewrite in diffs.