ECB mode encrypts every block of data independently with the same key, so identical plaintext blocks produce identical ciphertext blocks. Structure in your data shows through the encryption. Do not use it for real data. Use an authenticated mode such as GCM or ChaCha20-Poly1305 instead.
What leaks
A block cipher like AES works on 16-byte blocks. In ECB mode, block one and block ninety encrypt to the same output if they hold the same 16 bytes. An attacker who sees only ciphertext can still tell which blocks match, and can often learn the shape of the data.
A classic demonstration is an image encrypted this way: the outline of the picture is still visible. The same idea applies to database columns with repeated values, fixed headers in files, and padded fields.
Ciphertext blocks can also be cut and rearranged. Nothing in ECB detects that, so an attacker may reorder or duplicate blocks and the decryption still works.
How it ends up in code anyway
ECB is rarely chosen on purpose. It shows up because:
- A library defaults to it when you name only "AES". Some APIs historically did exactly this.
- A tutorial used it for brevity.
- A developer wanted deterministic output so equal inputs give equal ciphertext for lookups.
- A string like
AES/ECB/PKCS5Paddingwas copied without thought.
OWASP's guidance says ECB should not be used outside of very specific circumstances. For almost all applications there are no such circumstances.
What to use instead
- For storing or sending data: an AEAD such as AES-GCM or ChaCha20-Poly1305, with a unique nonce per message under a key. See our guide to choosing between them.
- If you must use CBC or CTR for compatibility: pair it with a separate authentication step, ideally encrypt-then-MAC, as OWASP advises.
- If you wanted deterministic lookups: store a keyed hash (HMAC) of the value in a separate column, instead of weakening the encryption.
How to find it
Search your repositories for the strings ECB, AES/ECB, MODE_ECB and for calls that name an algorithm without a mode. Check configuration files and older services, not only new code. Review any place where equal inputs give visibly equal stored output.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how each result names the exact place to fix.
Quick check
Is ECB ever acceptable?
Only for a single block of already-random data, such as wrapping one random key with a key-wrapping design. Even then, prefer a purpose-built key wrap mode from your library.
Does a longer key fix ECB?
No. The weakness comes from the mode, not the key size.
Sources
Last reviewed: 19 October 2026.
