Which one should I use?

AES-256-GCM with scrypt, which is what the lab picks before you touch anything. It is authenticated, it is hardware-accelerated on every processor made this decade, and the memory-hard derivation makes guessing your passphrase expensive. Change it because you want to see what changes, not because the default is lacking.

No. There is no practical attack on AES at any of its key sizes. The honest reason to prefer 256 is margin against a future nobody can see, not a weakness anybody has found — and it costs almost nothing, which is why it is the default.

What does "authenticated" mean here?

That the cipher can tell you the file was modified, rather than handing you plausible garbage. GCM and ChaCha20-Poly1305 do this themselves. With CTR, flipping one bit of the encrypted file flips exactly that bit of the result and nothing warns you — the lab has a switch that lets you watch it happen.

Every algorithm in the lab

Each of these has its own page with what it is, what it costs, where it runs and what it does not protect. The list is generated from the engine itself, so it cannot describe something the lab does not have.

Ciphers

AES at 128, 192 and 256 bits in GCM, CBC and CTR, plus ChaCha20-Poly1305. GCM and ChaCha20 are authenticated — they detect a modified file. CBC and CTR are not, and the lab adds an HMAC for you unless you switch it off to see what that actually costs.

Key-derivation functions

scrypt, PBKDF2 and Argon2id, with every cost knob exposed and range-checked. A passphrase is not a key; a KDF is the slow, expensive machine that turns one into the other, and its settings are how much a guess costs an attacker.

Public-key envelopes

RSA-OAEP and ECDH over P-256. Both are hybrid, and that is not a shortcut: RSA can only encrypt a couple of hundred bytes and ECDH cannot encrypt at all, so in every real system the public key protects a random symmetric key and the symmetric key protects the data.

Classical ciphers

Caesar, ROT13, Atbash and Vigenère. These are not encryption and every result in the lab says so. They are here because they are the only ciphers you can run by hand, and doing that once is what makes "key" and "keyspace" mean anything — the lab will break the Caesar one in front of you, with no key.

Questions

Which one should I use?: AES-256-GCM with scrypt, which is what the lab picks before you touch anything. It is authenticated, it is hardware-accelerated on every processor made this decade, and the memory-hard derivation makes guessing your passphrase expensive. Change it because you want to see what changes, not because the default is lacking.
Is AES-128 broken?: No. There is no practical attack on AES at any of its key sizes. The honest reason to prefer 256 is margin against a future nobody can see, not a weakness anybody has found — and it costs almost nothing, which is why it is the default.
What does "authenticated" mean here?: That the cipher can tell you the file was modified, rather than handing you plausible garbage. GCM and ChaCha20-Poly1305 do this themselves. With CTR, flipping one bit of the encrypted file flips exactly that bit of the result and nothing warns you — the lab has a switch that lets you watch it happen.