Security Strength Calculator

Because Overall Security reports the WEAKEST of the three components, and at the default combination (AES-128, RSA-2048, SHA-256) the RSA key is the binding constraint at about 112-bit security -- both the symmetric key (128-bit) and the hash's collision resistance (128-bit) already sit above that floor. Raising the symmetric key length further only widens a margin that isn't the bottleneck; you would need to raise the RSA key size to move the overall number.

Because breaking RSA means factoring its modulus, and the best known factoring algorithms (the general number field sieve) run in sub-exponential time -- far faster than the brute-force key search a symmetric cipher requires. A 2048-bit RSA modulus is estimated to take about as much computational effort to factor as a 112-bit symmetric key takes to brute-force, per Table 2 of NIST SP 800-57 Part 1 Revision 5 (nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf), which is why the two numbers look so different for keys that are meant to offer comparable protection. That published table only anchors 1024/2048/3072/7680/15360-bit moduli, though -- the ~140-bit rating this calculator shows for a 4096-bit key is a commonly-cited linear interpolation between the 3072 and 7680 anchors, not an official NIST breakpoint, and any other non-anchor gap (e.g. between 7680 and 15360) is conservatively held at the last confirmed anchor instead of interpolating or rounding up early.

Elliptic-curve cryptography gets its security from a harder mathematical problem (the elliptic curve discrete logarithm) than RSA's factoring problem, so it needs a much smaller key to reach the same security level -- roughly double the symmetric security level in bits, versus RSA's roughly-3000-bit modulus for a 128-bit security level. That is why a 256-bit ECC key and a 3072-bit RSA key are both considered equivalent to a 128-bit symmetric key.

It reports the NIST-anchored reference key sizes for the security tier your current Overall Security falls into: the 256/7680/512-bit tier at 192-bit security and above, the 128/3072/256-bit tier from 128 up to 192, and the 80/1024/160-bit legacy tier below that. It is meant as a reference point for which tier you are currently operating in, not a live recommendation to downgrade if you already exceed a tier's minimum.

No -- treat it as an order-of-magnitude illustration, not a forecast. It is built from a simple exponential formula anchored to a rough historical reference point, and real cryptographic risk depends on unpredictable factors like new cryptanalytic techniques, quantum computing progress, and implementation flaws that no closed-form formula captures. Use published NIST or NSA transition timelines for actual compliance planning.