Encryption Strength Calculator

Complete encryption strength analysis. Key strength, hash functions, cipher modes, post-quantum cryptography, and random number generation.

About this calculator

This calculator covers five separate areas of applied cryptography behind one Analysis Type selector, and only the mode you have selected reads its own inputs -- switching modes swaps the entire input and output set rather than blending them. Key Strength & Entropy (the default mode) converts a raw key length into an Effective Strength in bits using real NIST-anchored equivalences -- for RSA specifically, the conversion is a step function (RSA-2048 rates about 112-bit, RSA-3072 about 128-bit), not a straight fraction of the key length, because factoring difficulty scales far more slowly than a symmetric brute-force search does. Effective Strength depends only on Key Length and Algorithm Type; Implementation Quality is then applied as a separate multiplier before the Classical Crack Time estimate is computed, modeling the fact that a theoretically strong algorithm can still be weakened by a flawed implementation (a side-channel leak, a bad random-number source) without changing its on-paper key size. Hash Function Analysis reports each function's collision and preimage resistance and flags MD5 as broken rather than merely weak.

Block Cipher Modes compares how ECB, CBC, CTR, GCM, and XTS handle parallelism, authentication, and IV reuse risk. Post-Quantum Cryptography reports the real published NIST-standardized key and signature sizes for Kyber (FIPS 203), Dilithium (FIPS 204), and SPHINCS+ (FIPS 205). Random Number Generation compares CSPRNG, PRNG, TRNG, and DRBG sources by whether they are safe for cryptographic use at all. None of the five modes model an active adversary's real-world resources or motivation -- they report theoretical strength, not a threat assessment for your specific situation.

Progress0%

Step 1 of 2

Analysis Type

Key Length (bits)

Algorithm Type

Figures current as of 2020. Source: NIST Special Publication 800-57 Part 1 Revision 5, "Recommendation for Key Management: Part 1 – General," Table 2 (p. 54): RSA modulus k=1024 -> <=80-bit, k=2048 -> 112-bit, k=3072 -> 128-bit, k=7680 -> 192-bit, k=15360 -> 256-bit estimated maximum security strength.

How to Use This Calculator

Pick an Analysis Type: Key Strength & Entropy, Hash Function Analysis, Block Cipher Modes, Post-Quantum Cryptography, or Random Number Generation -- each mode swaps in its own inputs and outputs.
In Key Strength & Entropy (the default), enter Key Length, choose Algorithm Type (AES, RSA, ECC, or ChaCha20), and set Implementation Quality to see Effective Strength and Classical Crack Time.
In Hash Function Analysis, pick a Hash Function and Salt Length to compare collision/preimage resistance and see whether it's still considered secure.
In Block Cipher Modes, pick a Cipher Mode, Block Size, and Data Size to compare parallelism, authentication, and IV-reuse risk across ECB/CBC/CTR/GCM/XTS.
In Post-Quantum Cryptography, pick a PQ Algorithm and NIST Security Level to see real published Kyber/Dilithium/SPHINCS+/Classic McEliece key and signature sizes.
In Random Number Generation, pick an RNG Type, Seed Entropy, and Output Size to check whether that source is safe for cryptographic use (CSPRNG/TRNG/DRBG) or not (PRNG).

What each input means

Analysis Type: Calculation mode to use.
Key Length (bits): AES: 128/192/256, RSA: 2048+
Implementation Quality (%): Account for side-channels, etc.
Hash Function: Hash algorithm to use.
Iterations/Cost Factor: For bcrypt: cost factor (10-14)
NIST Security Level (1-5): 1=AES-128, 3=AES-192, 5=AES-256

How this is calculated

Formula

Security = 2^(key_bits) operations | Birthday attack = 2^(n/2)

Worked example, using the default values

Identify Input Parameters
4 parameters
Analysis Type = 0, Key Length (bits) = 256, Algorithm Type = 0, Implementation Quality (%) = 100 = 4 input(s) provided
Calculate Algorithm
Algorithm
AES = AES
Calculate Effective Strength
Effective Strength
256 = 256
Calculate Security Level
Security Level
Very Strong = Very Strong
Calculate Quantum Resistant
Quantum Resistant
Partial (Grover halves) = Partial (Grover halves)

Figures and sources

Comparable security strengths of RSA, ECC, and symmetric-key algorithms (2020) — NIST Special Publication 800-57 Part 1 Revision 5, "Recommendation for Key Management: Part 1 – General," Table 2 (p. 54): RSA modulus k=1024 -> <=80-bit, k=2048 -> 112-bit, k=3072 -> 128-bit, k=7680 -> 192-bit, k=15360 -> 256-bit estimated maximum security strength.

Engine last updated September 3, 2026. Checked against 8 independently-derived tests — how we verify calculators. Built by Paul Gunder, a software engineer, not a licensed financial, medical, or legal professional.

Frequently Asked Questions

Why doesn't Implementation Quality change the Effective Strength number?

Effective Strength is the algorithm's theoretical, on-paper strength based purely on Key Length and Algorithm Type -- it answers "how strong is this algorithm supposed to be." Implementation Quality is applied afterward, before the Classical Crack Time estimate, to answer a different question: "how strong is THIS PARTICULAR implementation," accounting for real-world flaws like side-channel leaks that can undermine a theoretically sound algorithm even though its on-paper key size never changes.

Why is RSA-2048's effective strength only 112 bits, not 2048?

Because RSA's security comes from the difficulty of factoring its modulus, and the best factoring algorithms run in sub-exponential time -- much faster relative to key size than the brute-force search a symmetric key requires. NIST SP 800-57 Part 1 Rev. 5, Table 2 rates a 2048-bit RSA modulus at 112-bit security, a 3072-bit modulus at 128-bit, and so on in a step pattern, not a smooth fraction of the raw bit length.

Is MD5 really unsafe for every use, even non-security ones?

For anything security-relevant, yes -- MD5's collision resistance has been practically broken for years, meaning an attacker can deliberately construct two different inputs that hash to the same value, which defeats its use in digital signatures or integrity checks against a malicious actor. It remains usable only as a fast, non-adversarial checksum, such as detecting accidental file corruption where nobody is trying to fool the check.

Why does ECB mode show up as insecure when it's the fastest option?

ECB encrypts each block independently with no chaining, so identical plaintext blocks always produce identical ciphertext blocks -- patterns in the original data (like large blank regions in an image) remain visible in the encrypted output. Its speed and parallelism come from skipping the very step (chaining blocks together, or using a nonce) that hides those patterns, which is why it is flagged as insecure for real encryption despite its performance.

Are the Kyber and Dilithium key sizes shown here made up, or real numbers?

They are the real published sizes from NIST's finalized post-quantum standards -- Kyber (now standardized as FIPS 203 ML-KEM) and Dilithium (FIPS 204 ML-DSA) each specify fixed public-key, private-key, and ciphertext or signature sizes per security parameter set, and this calculator reproduces those published figures rather than estimating them.

The questions that sit next to this one — chosen by subject, including calculators filed under a different category.

Technology & Computing