Definition
ChaCha20 is a 256-bit symmetric stream cipher designed by Daniel J. Bernstein in 2008 as an improvement on his earlier Salsa20 cipher. Unlike a block cipher, which encrypts fixed-size chunks, a stream cipher generates a continuous keystream that is XORed against the plaintext. ChaCha20 is paired with the Poly1305 message authentication code in an authenticated encryption construction known as ChaCha20-Poly1305.
Why It Exists Alongside AES
AES became dominant because it is fast — but mostly when the CPU has dedicated AES-NI hardware instructions. On older hardware or on resource-constrained devices like mobile phones and IoT sensors, software AES is significantly slower. ChaCha20 was designed to be fast in pure software, with no special hardware required. On a modern smartphone running WireGuard, ChaCha20 frequently outperforms AES, which is one reason WireGuard chose it as its only cipher. ChaCha20-Poly1305 is also a TLS 1.3 cipher suite, widely deployed by Google, Cloudflare, and others as a fallback for clients without AES-NI.
Security Properties
ChaCha20 has been extensively studied and no practical attacks are known against it. The 256-bit key and 96-bit nonce provide a comfortable security margin, and the Poly1305 authenticator detects any tampering with the ciphertext. From a practical security standpoint, ChaCha20-Poly1305 is considered equivalent in strength to AES-256-GCM.