How do you create a new encrypted file with Ansible Vault, and which cipher does it use?

Question

Accepted Answer

ansible-vault create filename asks for a new vault password, then opens the file in an editor (default vi, change it with export EDITOR=nano); when you save, the file is written encrypted. Current Ansible versions use AES256; files from older versions may still use 128-bit AES.
$ ansible-vault create secret.yml
New Vault password: ****
Confirm New Vault password: ****

Instead of typing the password you can point to a vault password file that contains it:
$ ansible-vault create --vault-password-file=vault-pass secret.yml

That file holds the password in plain text, so protect it with strict permissions (chmod 600) and never commit it to the same repository as the encrypted files. Otherwise the encryption protects nothing.
An encrypted file starts with a header like $ANSIBLE_VAULT;1.1;AES256, followed by hex-encoded ciphertext. That header is how Ansible recognises the file as vault-encrypted when it loads it.
Go deeper:

Encrypting content with Ansible Vault (official docs) — creating and encrypting files, and the file format.
 ansible-vault command reference (official docs) — every subcommand and option.
 Advanced Encryption Standard (Wikipedia) — the AES cipher Vault uses.