Vault Encryption Size Calculator
Estimate encrypted file size overhead when using Ansible Vault for secrets.
About Vault Encryption Size Calculator
Ansible Vault encrypts content with AES-256 in CBC mode with an HMAC, then hex-encodes the ciphertext for safe storage in YAML/text files — hex encoding alone doubles size, but combined with the more compact internal encoding Ansible actually uses (base64-like framing) plus the vault header, the net overhead is commonly around 35% for typical secret sizes. Formula: encrypted_size = plaintext × expansion_factor + header_bytes.
Formula
encrypted_size_bytes = plaintext_bytes × expansion_factor + vault_header_bytes
- plaintext_bytes
- Size of content before encryption
- expansion_factor
- Overhead multiplier from AES-256 + hex/base64 armor (~1.35×)
- vault_header_bytes
- Fixed vault header size (~90 bytes)
Worked example
With the default values below, Vault Encryption Size Calculator returns Encrypted File Size of 5.49. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Plaintext Sizeaccepts 0.01–100,000 KB
- 4 KB
- Expansion Factoraccepts 1–3 ×
- 1.35 ×
- Vault Header Sizeaccepts 0–1,000 bytes
- 90 bytes
Results
- Encrypted File Size
- 5.49 KB
- Size Overhead vs Plaintext
- 37.2%
- Overhead in Bytes
- 1,524 bytes
Step by step
- 1Plaintext size in bytes= 4096 bytes
- 2Encrypted body: plaintext × expansion factor= 5530 bytes
- 3Encrypted total incl. vault header= 5620 bytes (5.49KB)
Assumptions and limits
- The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Why is the encrypted file so much bigger than the plaintext?
Ansible Vault's ciphertext is hex-encoded for safe embedding in text-based playbooks/vars files, and the file also carries a header line and HMAC for integrity verification, all of which add overhead beyond the raw AES-256 ciphertext.
Does encrypting a whole file cost more than encrypting single variables?
Per-byte overhead is the same either way, but `ansible-vault encrypt_string` for single variables adds slightly more relative overhead for very small values since the fixed header cost is spread over less content.
Does vault password strength affect encrypted size?
No — the password (or vault ID) only affects key derivation, not the size of the resulting ciphertext, which scales with plaintext size regardless of password complexity.
Should I encrypt entire files or individual variables?
Encrypting individual variables with `encrypt_string` keeps diffs readable and lets you see which variable changed in git history; encrypting whole files is simpler but makes every vars-file change look like a full rewrite in diffs.