Crates / Compare / aes-gcm vs chacha20poly1305
Rust crates side by side · data Oct 24, 2026
aes-gcm vs chacha20poly1305
Short answerBy steady daily use, aes-gcm is bigger: 653,891 real downloads a day against 325,391 for chacha20poly1305 (2.0x). 1,968 crates depend on aes-gcm and 1,434 on chacha20poly1305. aes-gcm last shipped 2 months ago, chacha20poly1305 4 months ago.
aes-gcm
Widely usedWidely used and gaining.
1,968 crates depend on it; downloads don't spike on releases.
Pure Rust implementation of the AES-GCM (Galois/Counter Mode) Authenticated Encryption with Associated Data (AEAD) Cipher with optional architecture-specific hardware acceleration
chacha20poly1305
Widely usedWidely used and gaining.
1,434 crates depend on it; no release in the last 90 days, so its count is all steady use.
Pure Rust implementation of the ChaCha20Poly1305 Authenticated Encryption with Additional Data Cipher (RFC 8439) with optional architecture-specific hardware acceleration. Also contains implementations of the XChaCha20Poly1305 extended nonce variant of ChaCha20Poly1305, and the reduced-round ChaCha8Poly1305 and ChaCha12Poly1305 lightweight variants.
aes-gcmchacha20poly1305 · 100% = that crate's normal quiet day, so a spike to 300% is triple its usual traffic
Every number, side by side
| Same window, same method | aes-gcm | chacha20poly1305 |
|---|---|---|
| Real downloads a day | 653,891 | 325,391 |
| Crates that depend on it | 1,968 | 1,434 |
| Last release | 0.11.1, 2 months ago | 0.11.0, 4 months ago |
| Trend vs the field | +20% | +20% |
| Release-window share | 1.8% | 0.0% |
| Downloads in the window | 60,777,667 | 31,822,137 |
| All-time downloads | 187,606,424 | 100,249,282 |
| Versions published | 37 | 35 |
| License | Apache-2.0 OR MIT | Apache-2.0 OR MIT |
| MSRV | 1.85 | 1.85 |
| First published | Aug 16, 2019 | Oct 6, 2016 |
Which to pick
- Downloads tell you what is common, not what fits. Each crate's own description above says what it is for; when the jobs differ, pick by the job.
- When both fit, prefer the one more crates depend on (aes-gcm, 1,968 dependents): more eyes, more answered questions, and you may already have it in your tree.
- Check the release dates against your own pace: aes-gcm 2 months ago, chacha20poly1305 4 months ago.
Also in this space
Method
Real downloads = the median day with no release that day or the day before, from the crates.io API (Jul 27, 2026 to Oct 23, 2026). Raw crates.io counts include CI and bots and run high (why); the method is from our 90-day study.
Up next
Another comparison: Same method, same window. Foundational and steady vs widely used and steady.reqwest vs ureqRead it next →Also worth your time