AES-256-GCM and PBKDF2 are not competing encryption algorithms. AES encrypts the data with a secret key. PBKDF2 derives a key from a password so that the password can be used to protect that data.
AES is a symmetric cipher, which means the same secret key encrypts and decrypts the data. The 256 in AES-256 describes the key length in bits. GCM is an operating mode that also authenticates the encrypted data, so a changed or damaged payload can be detected during decryption.
A person usually remembers a password rather than a random 256-bit key. PBKDF2 applies a password-based derivation function with a salt and a work factor to produce a key. The salt helps ensure that the same password does not always produce the same derived key.
Pyxelze uses PBKDF2 to derive the encryption key and AES-256-GCM to protect the archive contents. It then uses PNG steganography to place the encrypted archive in an image. The encryption protects the contents; the image encoding serves a separate purpose.
A strong, unique password still matters. Key derivation raises the cost of guessing passwords, but it cannot make a weak or reused password safe. Keep the password private and retain a tested copy of the image so that you can recover your files.
