Encryption Key Length Calculator
Why Adding One Bit Doubles the Work
An encryption key's strength against brute force isn't linear — it's exponential. A 128-bit key doesn't offer twice the protection of a 64-bit key; it offers 2^64 times more. This calculator turns a key length in bits and an assumed guessing rate into a concrete estimate of how long an exhaustive search of the entire keyspace would take.
The Formula
Time to Brute Force = Keyspace / Guesses per Second
Where This Matters
- Choosing an algorithm/key size — deciding between AES-128 and AES-256, or evaluating whether a legacy cipher's key length is still adequate.
- Compliance requirements — many standards mandate a minimum key length; this shows why that minimum matters in practice.
- Communicating risk — translating an abstract bit count into a duration that's easy to grasp.
Keyspace and Brute-Force Time by Key Length
| Key length | Keyspace (2^bits) | Time to exhaust @ 1e9 guesses/sec |
|---|---|---|
| 40 bits | ~1.100 × 10^12 | ~18.33 minutes |
| 56 bits (DES) | ~7.206 × 10^16 | ~2.28 years |
| 128 bits (AES-128) | ~3.403 × 10^38 | ~1.078 × 10^22 years |
| 192 bits (AES-192) | ~6.277 × 10^57 | ~1.989 × 10^41 years |
| 256 bits (AES-256) | ~1.158 × 10^77 | ~3.669 × 10^60 years |
Computed directly from Keyspace = 2^bits and Time = Keyspace / 1,000,000,000 guesses per second. These are theoretical exhaustive-search figures assuming brute force is the only attack method; real-world cryptanalysis can be faster or slower depending on the algorithm.
How to Use This Calculator
- Enter the Key Length (bits) — for example 128 or 256 for AES.
- Enter the assumed Guesses per Second the attacker is capable of.
- Select Calculate to get the total keyspace and the estimated worst-case time to exhaust it.
Related Calculations
To see the same exponential math applied to human-chosen passwords rather than random keys, use the Brute Force Attack Time Calculator, or check the Password Entropy Calculator.