# How to verify whether the 256 bit AES encryption option applied? and not using the default 128

**URL:** <https://forums.percona.com/t/how-to-verify-whether-the-256-bit-aes-encryption-option-applied-and-not-using-the-default-128/40410>\
**Category:** PG\_TDE – Transparent Data Encryption (TDE)\
**Created:** [March 26, 2026, 5:15pm UTC](https://forums.percona.com/t/how-to-verify-whether-the-256-bit-aes-encryption-option-applied-and-not-using-the-default-128/40410 "2026-03-26T17:15:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![roko](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@roko](https://forums.percona.com/u/roko)\
**Post date:** [March 26, 2026, 5:15pm UTC](https://forums.percona.com/t/how-to-verify-whether-the-256-bit-aes-encryption-option-applied-and-not-using-the-default-128/40410/1 "2026-03-26T17:15:29Z")

</div>

Hi,

Using `Percona server 18 with TDE`

Reading the source code [256bit option](https://github.com/percona/pg_tde/blob/main/documentation/docs/variables.md#pg_tdecipher) the default is `aes_128`

 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/3/2/329179525d7ca40679162c6114f43a4fecf19a0b.png)

I added the 256 option to `postgresql.conf`

`pg_tde.cipher = ‘aes_256’`

I would like to know how to verify the encryption is now 256 and not 128.  
I know I can use `\d+ table1` to see if it is encrypted or not:

But how to tell if it’s 256 bit encrypted or 128 bit encrypted?

---

<div class="post-metadata">

**Author:** ![hieu.nguyen](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/hieu.nguyen/32/21872_2.png) [@hieu.nguyen](https://forums.percona.com/u/hieu.nguyen)\
**Post date:** [March 27, 2026, 4:49am UTC](https://forums.percona.com/t/how-to-verify-whether-the-256-bit-aes-encryption-option-applied-and-not-using-the-default-128/40410/2 "2026-03-27T04:49:48Z")

</div>

Hi @roko,

I did not find any function to check the cipher used for a table. But in the test file [t/tde\_heap\_aes\_256.pl](https://github.com/percona/pg_tde/blob/c431ef83491bd37ea47742a8adce90a41e3fafe0/t/tde_heap_aes_256.pl#L31), the team did test what happens if you switch from `pg_tde.cipher='aes_128'` to `pg_tde.cipher='aes_256'`:

```auto

-- server restart
###########################
SELECT * FROM test_enc0 ORDER BY id;
 id | k         
----+-------------------
  1 | multitude
  2 | multitudinous
  3 | multitudinously
  4 | multitudinousness
(4 rows)

psql:<stdin>:1: WARNING: length "16" of key "test-db-key" does not match the length "32" of the current cipher setting
HINT: Create a new principal key and set it instead of the current one.

```