AES Key Strength Calculator

Compare AES-128, AES-192 and AES-256 by round count, effective security bits and brute-force time, with a Grover option.

Inputs

AES key size

Attacker key trials per secondkeys/s

Assume a Grover-capable quantum attacker

Grover's algorithm halves the effective strength of a symmetric key.

Effective Security Strength

256bits

AES Rounds

Key Space

≈10^77 candidate keys

Brute-force Time (log₁₀ years)

57.3

A value of 6 means about a million years.

Assessment

Safe — 128-bit or better effective strength

Step by step

Values used
AES key size = AES-256 — 14 rounds; Attacker key trials per second = 1,000,000,000,000 keys/s; Assume a Grover-capable quantum attacker = No
AES Key Strength
effective strength = key size (halved to key/2 under Grover); average brute-force time = 2^(strength − 1) ÷ trials per second.
Round schedule (FIPS 197)
AES rounds = 10 for a 128-bit key, 12 for 192-bit, 14 for 256-bit.
Effective Security Strength
= 256 bits
AES Rounds
= 14
Key Space
= ≈10^77 candidate keys
Brute-force Time (log₁₀ years)
= 57.3
Assessment
= Safe — 128-bit or better effective strength

How it works

AES has no practical shortcut attack, so its strength equals its key length and an exhaustive search needs half the key space on average. Grover's algorithm gives a quantum attacker a quadratic speed-up, which is equivalent to halving the key length — AES-256 drops to a 128-bit effective strength, AES-128 to 64 bits. Choosing AES-256 over AES-128 costs about 40% more rounds but is the only symmetric choice that still holds a 128-bit margin against a future quantum attacker, which is why CNSA 2.0 mandates it.

Formulas

AES Key Strength

effective strength = key size (halved to key/2 under Grover); average brute-force time = 2^(strength − 1) ÷ trials per second.

key size: AES key length in bits (128, 192 or 256)
trials: Keys the attacker can test each second
rounds: AES round count fixed by FIPS 197 at 10/12/14

Round schedule (FIPS 197)

AES rounds = 10 for a 128-bit key, 12 for 192-bit, 14 for 256-bit.

Frequently Asked Questions

How is AES Key Strength calculated?

effective strength = key size (halved to key/2 under Grover); average brute-force time = 2^(strength − 1) ÷ trials per second. AES has no practical shortcut attack, so its strength equals its key length and an exhaustive search needs half the key space on average. Grover's algorithm gives a quantum attacker a quadratic speed-up, which is equivalent to halving the key length — AES-256 drops to a 128-bit effective strength, AES-128 to 64 bits.

Why does AES Key Strength matter?

Choosing AES-256 over AES-128 costs about 40% more rounds but is the only symmetric choice that still holds a 128-bit margin against a future quantum attacker, which is why CNSA 2.0 mandates it.

What values do I need to enter?

This calculator takes 3 inputs: AES key size, Attacker key trials per second, Assume a Grover-capable quantum attacker. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is AES-128 still safe today?

Yes against classical attackers — 2^127 average trials is far beyond any conceivable budget. It is not future-proof, because Grover's algorithm reduces it to a 64-bit effective strength, so new systems that must stay confidential past 2035 should use AES-256.

You might also need

RSA Key Size Calculator Quantum Security Readiness Calculator Cipher Block Size Calculator