Encryption Key Brute Force Time Calculator

What brute force actually means for a symmetric key

Brute force is the attack that always works given enough time: try every possible key until one decrypts the ciphertext into something meaningful. Its cost is therefore a property of the key length alone, and it sets the ceiling on how strong a cipher can be. A cipher is considered broken when someone finds an attack materially cheaper than this ceiling.

A k-bit key drawn uniformly at random has 2^k possible values. Searching in a random order, you expect to find it halfway through, after 2^k−1 trials. That single factor of two is worth noticing because it is the only place brute-force arithmetic gets easier: everything else about the problem grows by a factor of two for every bit you add.

The exponential growth is the whole story. A 64-bit key has 4.3 billion times the keyspace of a 32-bit key. A 128-bit key has 1.8×10¹⁹ times the keyspace of a 64-bit one. Attackers respond by parallelising, but parallelism is linear and the defence is exponential: doubling the attacker's hardware removes exactly one bit from the effective key length. Going from one machine to a million removes about twenty bits. Against a 128-bit key, that leaves 108 bits, which is not progress in any practical sense.

Two caveats bound what this calculator can tell you. First, it assumes the key is uniformly random. A key derived from a human-chosen password has far less entropy than its bit length suggests — quantify that with the password entropy calculator instead. Second, it assumes the cipher has no shortcut. Brute force is the ceiling; cryptanalysis, side channels, implementation bugs and key-management failures are the floor, and every real-world break in living memory has come from one of those rather than from exhausting a keyspace.

The arithmetic, and where each term comes from

Keyspace. N = 2^k. Nothing subtle here, but the numbers become hard to hold: 2⁵⁶ is 7.2×10¹⁶, roughly the number of grains in a cubic kilometre of fine sand; 2¹²⁸ is 3.4×10³⁸, which is more than the estimated number of atoms in the Earth's oceans by a wide margin. The calculator reports these in scientific notation for that reason.

Expected trials. 2^k−1. If the key is drawn uniformly and you search in an order uncorrelated with it, the position of the correct key is uniform on 1…N, so its expected value is (N+1)/2, which for large N is N/2.

Time. Divide by the total rate. Total rate is the rate one device achieves multiplied by the number of devices, because brute force is embarrassingly parallel — each machine takes a disjoint slice of the keyspace and there is no communication between them. That property is why key-search estimates scale so cleanly and why an attacker's budget translates directly into bits.

Energy. Multiply trials by the energy one trial consumes. This is often the more persuasive number, because energy has a hard physical floor while time does not obviously have one. The Landauer limit says that erasing one bit of information at temperature T must dissipate at least k_B·T·ln 2 joules. At 300 K that is 1.380649×10⁻²³ × 0.693147 × 300 = 2.871×10⁻²¹ J. Even at that impossible efficiency, and even pretending a trial decryption costs a single bit erasure, searching half of a 128-bit keyspace needs 1.7014×10³⁸ × 2.871×10⁻²¹ = 4.884×10¹⁷ J, which is 1.357×10¹¹ kWh, or about 136 TWh. A real AES trial costs thousands of bit operations, so multiply that figure by three or four orders of magnitude to get anywhere near a physical machine.

The quantum adjustment. Grover's algorithm finds a marked item in an unstructured space of N candidates in about √N queries rather than N. Applied to key search, √(2^k) = 2^k/2, so the effective strength halves: AES-128 offers about 64 bits against an ideal quantum adversary, and AES-256 offers about 128. This is the reasoning behind the standard advice to double symmetric key lengths, and it is why AES-256 is treated as the quantum-resistant choice while AES-128 is not. The model is deliberately generous to the attacker — it ignores the enormous constant factors, the serial depth of the Grover iteration, and the error-correction overhead a real machine would carry.

How to read the result

Read the exponent, not the mantissa. Whether the answer is 5×10¹⁸ years or 2×10¹⁹ years makes no difference to any decision; whether it is 10⁶ or 10¹⁸ makes every difference. That is also why sensitivity analysis is pointless above about 100 bits: multiply the attacker's budget by a million and you have removed twenty bits, which moves 10¹⁸ years to 10¹² years. The conclusion is unchanged.

Compare against a security-strength target rather than against a wall-clock intuition. NIST SP 800-57 Part 1 Rev. 5 organises algorithms by security strength in bits — 112, 128, 192 and 256 — and treats 112-bit strength as acceptable only through 2030, with 128 bits and above as the durable choice. Anything below 112 bits is disallowed for applying new cryptographic protection. Those are the numbers to design against; they already fold in decades of margin for hardware improvement.

Distinguish key length from security strength. They are equal for a well-designed symmetric cipher and they are not equal for asymmetric ones: a 3072-bit RSA modulus provides about 128 bits of security strength, because factoring is far cheaper than exhaustive search over the modulus. This calculator models symmetric key search only. If you enter an RSA or Diffie–Hellman modulus size here, the answer will be enormously optimistic.

Finally, notice what the result implies about where to spend effort. If your keyspace figure is 10³⁸ and your key is generated by a library seeded from the operating system's cryptographic random source, brute force is not your problem. Your problems are key storage, key rotation, an implementation that leaks timing, a backup that contains plaintext, and an administrator who can be phished. Rank those with the CVSS base score calculator and price them with the annualised loss expectancy calculator.

Expected exhaustive-search time by key length

For scale, the universe is about 1.38×10¹⁰ years old, so even the 112-bit row exceeds it by a factor of roughly six thousand at this rate. The 40-bit row is there because it was the export-grade limit imposed by United States regulation until the late 1990s, and it explains why those ciphers were retired.

Assumptions and limits of this model

• The key is uniformly random. Any bias, any pattern, any reused nonce or predictable seed reduces the real search space, sometimes by an enormous factor.
• The cipher has no shortcut. Published cryptanalysis of AES shaves a couple of bits off exhaustive search in impractical settings; a badly designed cipher can be worse by dozens of bits. The number here is the ceiling, not a guarantee.
• Trials are independent and verifiable. The attacker must be able to recognise the right key, which needs known plaintext or a recognisable structure. Without it, brute force has no stopping rule.
• The attack rate is constant. Hardware improves over the decades a long search would take. For any key at or above 112 bits this makes no practical difference, because the improvement is polynomial and the problem is exponential.
• No side channels. Timing, power analysis, cache behaviour and fault injection recover keys without searching for them, and they are how real systems are broken.
• Multi-target attacks are not modelled. An attacker who will accept breaking any one of 2^t keys effectively faces a search of 2^k−t. That matters at scale and is a reason to use per-user salts and nonces.
• The Grover model is first order only. It ignores constant factors, the serial depth of the iteration, and quantum error correction — all of which make a real quantum attack far more expensive than the halved-bits figure suggests.

Key terms

Keyspace

The set of all values a key can take. For a k-bit key it has 2^k members, and its size is the upper bound on the work an exhaustive search requires.

Security strength

The number of bits of work an attacker must do to break a mechanism, expressed as a power of two. It equals the key length for a good symmetric cipher and is much lower than the modulus size for RSA or Diffie–Hellman.

Grover's algorithm

A quantum search algorithm that finds a marked item among N candidates in about √N queries. Against symmetric cryptography it halves the effective key length, which is why doubling the key restores the margin.

Landauer limit

The minimum energy any irreversible computation must dissipate to erase one bit: k_B · T · ln 2, which is about 2.87×10⁻²¹ J at 300 K. It sets a physical floor under the energy cost of a brute-force search.

Multi-target attack

An attack that succeeds by recovering any one key from a large set rather than one specific key. It reduces the effective search by the number of targets, which is why per-user salts and nonces matter.

Where key-search estimates fit in a real threat model

Exhaustive key search is the least likely way your data will be exposed, and calculating it is still worth doing — because it tells you when to stop worrying about key length and start worrying about everything else. Once the number is above about 10²⁰ years, further increases buy nothing, and effort belongs elsewhere.

The historical record makes the point. DES fell in 1998 not because 56 bits was mathematically weak but because it was a fixed target while hardware improved for twenty years; the EFF's purpose-built machine simply ran the search this calculator describes. Everything since has been different in kind — protocol flaws, padding oracles, weak random number generators, keys left in source control, and social engineering. None of those appear in a keyspace calculation.

For an adjacent problem with the same flavour of exponential arithmetic, see the hash collision probability calculator: the birthday bound means a collision appears after roughly 2^b/2 values rather than 2^b, which is why a 128-bit digest offers only 64 bits of collision resistance. The halving there is structural, not quantum, and it catches people out for the same reason Grover does — the exponent, not the arithmetic, is where the intuition fails.