tech calculator

Encryption Key Strength (bits) Calculator

Convert a key size into bits of security strength using the NIST comparable strengths table.

Key length equals security strength only for symmetric ciphers. Per NIST SP 800-57, RSA-2048 provides 112 bits, RSA-3072 and a 256-bit elliptic curve key provide 128, and AES-256 provides 256. RSA-2048 spends 18.29 key bits per bit of real security against 2.00 for a 256-bit curve.

Quick actions: Save inputs, view saved runs, print, share, or export results

Saved Runs

Inputs

Algorithm Family

Key Lengthbits

Attacker Capability

Operations per Second (edit for a specific threat model)

Results

Security Strength

112 bits

Key Length2,048 bits

Key Bits per Bit of Security18.29

NIST StatusAcceptable through 2030, then deprecated

Equivalent Symmetric Cipher3TDEA

Equivalent RSA Modulus2,048 bits

Equivalent Elliptic Curve224-255 bits

Average Time to Break by Search8.23e+13 years

Quantum ExposureBroken outright by Shor's algorithm

Tip

Useful when a policy document specifies a key size and you need to know what it buys, and useful when comparing an RSA certificate against an elliptic-curve one without the numbers misleading you.

Formula

Security strength, not key length

Symmetric:  security strength = key length
Hash:       security strength = digest length / 2 (collision resistance)
RSA / DH:   1024 -> 80  |  2048 -> 112  |  3072 -> 128  |  7680 -> 192  |  15360 -> 256
ECC:        160-223 -> 80  |  224-255 -> 112  |  256-383 -> 128  |  384-511 -> 192  |  512+ -> 256

Average time to break = 2^(strength - 1) / guesses per second

The equivalences come from the comparable security strengths table in NIST SP 800-57 Part 1: reading a row across gives algorithms that resist attack equally well. A key length only equals a security strength for symmetric ciphers. RSA and Diffie-Hellman fall to index-calculus methods far faster than brute force, which is why a 2048-bit RSA key delivers 112 bits of security rather than 2048.

Step by step

How the calculation works

1Choose the algorithm family first, because key length means completely different things across them. A 256-bit AES key and a 256-bit elliptic curve key both provide 128 bits of security against classical attack, and a 2048-bit RSA key provides less than either.
2Read the security strength, not the key size. It is the only number that compares across algorithms, and it is what standards bodies actually specify. NIST treats 112 bits as the floor for new protection through 2030 and 128 bits as the level to specify for anything expected to outlive that.
3The key-bits-per-security-bit ratio shows why elliptic curve replaced RSA in most new designs. RSA-2048 spends more than 18 key bits for each bit of real security; a 256-bit curve spends two. That difference is the whole reason a certificate chain, a TLS handshake, and a hardware token are all faster on elliptic curve.
4Increasing an RSA modulus buys progressively less. Doubling from 1024 to 2048 bits adds 32 bits of security; doubling again from 2048 to 4096 does not reach the next NIST row at all, and 15360 bits is required to match AES-256. This is diminishing returns in its purest form.
5Quantum exposure splits the field cleanly. Shor’s algorithm breaks RSA, Diffie-Hellman and elliptic curve outright given a sufficiently large quantum computer, so those need post-quantum replacements rather than longer keys. Grover’s algorithm only halves symmetric strength, which is why AES-256 is widely treated as the conservative choice for data that must stay confidential for decades.
6For the human-facing side of the same question, the [password entropy calculator](/calculators/password-entropy-calculator) measures the strength of a password or passphrase in the same units, and the [password entropy guide](/blog/utility/password-entropy-estimation) covers where those bits actually come from.

Related guides

Learn more about this calculation

Guide

Password Entropy Guide: Length, Character Pools, and the Limits of Complexity Rules

Understand how password entropy is estimated from length and character-pool size, how the current DTC password generator behaves, and why secure password policy depends more on length and uniqueness than on arbitrary complexity rituals.

Guide

How to Use Do The Calculation Calculators: A Practical Step-by-Step Guide

Learn the fastest reliable workflow for using Do The Calculation calculators, reading results, checking formulas, and using save, print, share, and export actions correctly.

Tech Tool

Password Entropy Calculator

The same bits-of-security measure applied to passwords and passphrases.

Tech Tool

Base64 Encoder / Decoder

Encode and decode the key material and tokens these keys protect.

tech calculator

Encryption Key Strength (bits) Calculator

Convert a key size into bits of security strength using the NIST comparable strengths table.

Quick actions: Save inputs, view saved runs, print, share, or export results

Saved Runs

Inputs

Algorithm Family

Key Lengthbits

Attacker Capability

Operations per Second (edit for a specific threat model)

Results

Security Strength

112 bits

Key Length2,048 bits

Key Bits per Bit of Security18.29

NIST StatusAcceptable through 2030, then deprecated

Equivalent Symmetric Cipher3TDEA

Equivalent RSA Modulus2,048 bits

Equivalent Elliptic Curve224-255 bits

Average Time to Break by Search8.23e+13 years

Quantum ExposureBroken outright by Shor's algorithm

Tip

Useful when a policy document specifies a key size and you need to know what it buys, and useful when comparing an RSA certificate against an elliptic-curve one without the numbers misleading you.

Summary

Key output metrics

Security Strength

112 bits

Acceptable through 2030, then deprecated

Key Bits per Security Bit

18.29

2,048-bit key

Post-Quantum Strength

Broken by Shor

needs a post-quantum replacement

D3 visualization

Security Strength Against the NIST Rows

Your key measured against the five comparable-strength rows in NIST SP 800-57 Part 1, in bits of security rather than key length.

Guide

How to understand and use this calculator

Quick Answer — How Strong Is a 2048-Bit RSA Key?

It provides 112 bits of security, not 2048. Key length equals security strength only for symmetric ciphers. RSA and Diffie-Hellman fall to index-calculus methods far faster than brute force, so their keys have to be far longer to reach the same bar.

The comparable security strengths from NIST SP 800-57 Part 1 — every entry in a row resists attack equally well:

80 bits — 2TDEA, RSA 1024, ECC 160–223
112 bits — 3TDEA, RSA 2048, ECC 224–255
128 bits — AES-128, RSA 3072, ECC 256–383
192 bits — AES-192, RSA 7680, ECC 384–511
256 bits — AES-256, RSA 15360, ECC 512 and above

The efficiency gap across that table is the whole story. RSA-2048 spends 18.29 key bits for every bit of real security; a 256-bit elliptic curve key spends 2.00; an AES key spends 1.00. That is why elliptic curve replaced RSA in most new designs, and why doubling an RSA modulus buys progressively less each time.

NIST treats 112 bits as the floor for new protection through 2030 and 128 bits as the level to specify for anything expected to outlive that.

How to Use This Calculator: Comparing RSA-2048 With a 256-Bit Curve

Select RSA and enter 2048. The calculator returns a security strength of 112 bits, a key-bits-per-security-bit ratio of 18.29, and a NIST status of acceptable through 2030 and deprecated after that. The equivalent row gives 3TDEA on the symmetric side and ECC 224–255 on the curve side.

Now select elliptic curve and enter 256. The security strength is 128 bits and the ratio is 2.00. A key one eighth the size delivers 16 more bits of security — which, since each bit doubles the work, means it is about 65,000 times harder to break.

Switch to symmetric and enter 128. The strength is 128 bits, the ratio is exactly 1.00, and this is the only family where the number on the tin is the number you get.

Set the attacker capability to see the classical search time. At 10¹² operations per second — a large GPU cluster — a 128-bit strength survives about 5.4 × 10¹⁸ years. That figure is not the interesting output. The security strength is, because it is a stable property of the algorithm while the attack rate only ever improves.

The Formulas and Mappings This Calculator Uses

Symmetric ciphers: security strength = key length. AES-128 gives 128 bits, AES-256 gives 256.

Hash functions: security strength = digest length ÷ 2, because collision resistance is what governs a signature scheme built on the hash. SHA-256 therefore provides 128 bits.

RSA and finite-field Diffie-Hellman: mapped through the NIST rows — 1024 → 80, 2048 → 112, 3072 → 128, 7680 → 192, 15360 → 256. A modulus between two rows takes the lower row's strength, which is the conservative reading and the one standards bodies use.

Elliptic curve: 160–223 → 80, 224–255 → 112, 256–383 → 128, 384–511 → 192, 512 and above → 256.

Average time to break by search = 2^(strength − 1) ÷ operations per second, using half the keyspace because a search of a uniformly random space is expected to succeed halfway through.

Post-quantum strength = strength ÷ 2 for symmetric and hash algorithms, reflecting the square-root speed-up Grover's algorithm provides. For RSA, Diffie-Hellman and elliptic curve it is zero: Shor's algorithm breaks them outright given a sufficiently large quantum computer, and no key length fixes that.

A Second Example: Why RSA-4096 Is Not Twice RSA-2048

Enter RSA 4096. The security strength comes back as 128 bits — the same as RSA-3072, because 4096 sits between the 3072 and 7680 rows and NIST credits it with the lower one. The ratio has climbed to 32.00 key bits per bit of security.

Trace the whole curve. RSA-1024 gives 80 bits at a ratio of 12.80. RSA-2048 gives 112 at 18.29 — doubling the modulus added 32 bits. RSA-3072 gives 128 at 24.00; another 1024 bits bought 16. RSA-4096 adds nothing at all on the NIST table, and reaching 256 bits requires RSA-15360, at a ratio of 60.00.

Each doubling costs more and delivers less, and the operational cost rises with it: RSA operations scale badly with modulus size, so a 15360-bit key is not merely large but slow enough to be impractical for most protocols.

The elliptic-curve column runs flat by comparison. A 256-bit curve gives 128 bits at a ratio of 2.00; a 384-bit curve gives 192 bits at exactly the same ratio. Doubling the curve size roughly doubles the security strength, which is the property RSA does not have.

For the human-facing version of the same measure — bits of entropy in a password or passphrase — the password entropy calculator applies identical arithmetic to secrets a person has to remember.

What This Number Does and Does Not Protect Against

Security strength describes resistance to the best known attack on the algorithm. It says nothing about implementation, and implementation is where cryptography actually fails: side channels, weak random number generation, key reuse, padding oracles, and keys sitting in a repository or a log file have all broken far more systems than any key length ever has.

The quantum split is the most consequential distinction on this page. Shor's algorithm breaks RSA, Diffie-Hellman and elliptic curve outright, so those need post-quantum replacements rather than longer keys, and NIST has standardised algorithms for exactly that purpose. Grover's algorithm only halves symmetric strength, which is why AES-256 — 128 bits of post-quantum strength — is widely treated as the conservative choice for data that must stay confidential for decades.

That timeline matters now rather than later, because of harvest-now-decrypt-later. Traffic captured today can be stored and decrypted once a capable quantum computer exists, so anything with a long confidentiality requirement should be migrating already even though the machine does not yet exist.

And key strength is only one layer. It protects data in transit and at rest against an attacker who has the ciphertext and nothing else. It does nothing about an attacker who has the key, the endpoint, or the person holding either — which is most real compromises.

Limitations

The NIST mapping is a table with five rows, and this calculator does not interpolate between them. A 4096-bit RSA key almost certainly provides somewhat more than 128 bits of security in practice; it is credited with 128 because that is what the standard says, and inventing an interpolated figure would be worse than being conservative.

Security strength estimates are current best knowledge, not proofs. They assume the best publicly known attacks and they have moved before — the 80-bit row was considered adequate well into the 2000s and is now disallowed for new protection. Treat any figure here as a snapshot with a shelf life.

The crack-time figure is a classical brute-force search and applies cleanly only to symmetric keys. Nobody attacks RSA by trying keys; they factor the modulus. The number is shown to give the security strength a physical scale, not as a threat model.

The post-quantum column is a structural claim, not a schedule. It says which algorithm families Shor's algorithm breaks, and says nothing about when a machine capable of running it against real key sizes will exist.

Related Calculators

This calculator measures algorithmic key strength; the password entropy calculator measures the same quantity for secrets people choose and remember, and the two use identical arithmetic on very different inputs. The password entropy guide covers where those bits come from and why length beats complexity rules. For working with the key material itself, the Base64 encoder and decoder handles the encoding that wraps almost every key and token, and the binary, hex and ASCII converter is what you reach for when a key has to be inspected byte by byte.

Related concepts

Security Strength

Bits of resistance to the best known attack. The only measure that compares fairly across algorithm families, and what standards actually specify.

Comparable Strengths Table

The NIST SP 800-57 Part 1 mapping that puts AES-128, RSA-3072 and a 256-bit curve on the same row at 128 bits of security.

Post-Quantum Exposure

Shor's algorithm breaks RSA, Diffie-Hellman and elliptic curve outright; Grover's only halves symmetric strength. The distinction decides what needs replacing rather than lengthening.

Frequently Asked Questions

How many bits of security does RSA-2048 provide?+

112 bits, according to the comparable security strengths table in NIST SP 800-57 Part 1. That puts it level with 3TDEA and with a 224 to 255-bit elliptic curve key. It spends 18.29 key bits for every bit of real security, which is the inefficiency that pushed most new designs toward elliptic curve.

Is AES-256 twice as strong as AES-128?+

It has twice the security strength in bits, which means 2^128 times the work — an unimaginably larger margin than the word 'twice' suggests. Both are far beyond classical brute force. The practical argument for AES-256 is quantum: Grover's algorithm halves symmetric strength, leaving AES-256 at 128 bits and AES-128 at 64.

Should I use RSA-4096 instead of RSA-2048?+

It is stronger, but the NIST table credits 4096 with the same 128 bits as 3072 because it sits between rows. If you want more than 112 bits, 3072 reaches 128 at lower operational cost. If you want a real step up in efficiency rather than size, move to elliptic curve: a 256-bit curve matches RSA-3072 at one twelfth the key length.

Why is elliptic curve so much more efficient than RSA?+

Because the best known attacks against it scale much worse for the attacker. RSA falls to index-calculus factoring methods, so its modulus has to grow disproportionately; elliptic curve resists anything better than generic square-root attacks. A 256-bit curve spends 2.00 key bits per bit of security against RSA-2048's 18.29.

What key size does NIST require?+

At least 112 bits of security strength for new protection through 2030, and 128 bits for anything expected to remain protected beyond that. In key sizes, that means RSA or Diffie-Hellman at 2048 minimum and 3072 preferred, elliptic curve at 224 minimum and 256 preferred, and AES-128 or above.

Which algorithms does a quantum computer break?+

Shor's algorithm breaks RSA, Diffie-Hellman and elliptic curve outright given a sufficiently large machine, and no key length fixes it — those need post-quantum replacements. Grover's algorithm only halves symmetric strength, so AES-256 retains 128 bits of post-quantum strength and remains a reasonable long-term choice.

How is hash strength calculated?+

As half the digest length, because collision resistance is what governs a signature scheme built on the hash. SHA-256 therefore provides 128 bits of security, matching AES-128 and RSA-3072. Preimage resistance is the full digest length, but collision resistance is the binding constraint in practice.

Does a longer key make my system secure?+

No. Key strength resists an attacker who has ciphertext and nothing else. Side-channel leaks, weak random number generation, key reuse, padding oracles, and keys committed to a repository have all broken far more systems than any key length ever has. Get the key size past the NIST floor and spend the remaining effort on everything else.

Formula

Security strength, not key length

Symmetric:  security strength = key length
Hash:       security strength = digest length / 2 (collision resistance)
RSA / DH:   1024 -> 80  |  2048 -> 112  |  3072 -> 128  |  7680 -> 192  |  15360 -> 256
ECC:        160-223 -> 80  |  224-255 -> 112  |  256-383 -> 128  |  384-511 -> 192  |  512+ -> 256

Average time to break = 2^(strength - 1) / guesses per second

Step by step

How the calculation works

1Choose the algorithm family first, because key length means completely different things across them. A 256-bit AES key and a 256-bit elliptic curve key both provide 128 bits of security against classical attack, and a 2048-bit RSA key provides less than either.
2Read the security strength, not the key size. It is the only number that compares across algorithms, and it is what standards bodies actually specify. NIST treats 112 bits as the floor for new protection through 2030 and 128 bits as the level to specify for anything expected to outlive that.
3The key-bits-per-security-bit ratio shows why elliptic curve replaced RSA in most new designs. RSA-2048 spends more than 18 key bits for each bit of real security; a 256-bit curve spends two. That difference is the whole reason a certificate chain, a TLS handshake, and a hardware token are all faster on elliptic curve.
4Increasing an RSA modulus buys progressively less. Doubling from 1024 to 2048 bits adds 32 bits of security; doubling again from 2048 to 4096 does not reach the next NIST row at all, and 15360 bits is required to match AES-256. This is diminishing returns in its purest form.
5Quantum exposure splits the field cleanly. Shor’s algorithm breaks RSA, Diffie-Hellman and elliptic curve outright given a sufficiently large quantum computer, so those need post-quantum replacements rather than longer keys. Grover’s algorithm only halves symmetric strength, which is why AES-256 is widely treated as the conservative choice for data that must stay confidential for decades.
6For the human-facing side of the same question, the [password entropy calculator](/calculators/password-entropy-calculator) measures the strength of a password or passphrase in the same units, and the [password entropy guide](/blog/utility/password-entropy-estimation) covers where those bits actually come from.

Related guides

Learn more about this calculation

Guide

Encryption Key Strength (bits) Calculator

Inputs

Results

Security strength, not key length

How the calculation works

Learn more about this calculation

Password Entropy Guide: Length, Character Pools, and the Limits of Complexity Rules

How to Use Do The Calculation Calculators: A Practical Step-by-Step Guide

Password Entropy Calculator

Base64 Encoder / Decoder

Key facts

Sources & methodology

Encryption Key Strength (bits) Calculator

Inputs

Results

Key output metrics

Security Strength Against the NIST Rows

How to understand and use this calculator

Quick Answer — How Strong Is a 2048-Bit RSA Key?

How to Use This Calculator: Comparing RSA-2048 With a 256-Bit Curve

The Formulas and Mappings This Calculator Uses

A Second Example: Why RSA-4096 Is Not Twice RSA-2048

What This Number Does and Does Not Protect Against

Limitations

Related Calculators

Related concepts

Frequently Asked Questions

Security strength, not key length

How the calculation works

Learn more about this calculation

Password Entropy Guide: Length, Character Pools, and the Limits of Complexity Rules

How to Use Do The Calculation Calculators: A Practical Step-by-Step Guide

Password Entropy Calculator

Base64 Encoder / Decoder

Key facts

Sources & methodology

Key output metrics

Security Strength Against the NIST Rows

How to understand and use this calculator

Quick Answer — How Strong Is a 2048-Bit RSA Key?

How to Use This Calculator: Comparing RSA-2048 With a 256-Bit Curve

The Formulas and Mappings This Calculator Uses

A Second Example: Why RSA-4096 Is Not Twice RSA-2048

What This Number Does and Does Not Protect Against

Limitations

Related Calculators

Related concepts

Frequently Asked Questions