AES Key Strength Calculator

Compare AES-128, AES-192 and AES-256 by round count, effective security bits and brute-force time, with a Grover option.

About AES Key Strength Calculator

AES has no practical shortcut attack, so its strength equals its key length and an exhaustive search needs half the key space on average. Grover's algorithm gives a quantum attacker a quadratic speed-up, which is equivalent to halving the key length — AES-256 drops to a 128-bit effective strength, AES-128 to 64 bits. Choosing AES-256 over AES-128 costs about 40% more rounds but is the only symmetric choice that still holds a 128-bit margin against a future quantum attacker, which is why CNSA 2.0 mandates it.

Formulas

AES Key Strength

effective strength = key size (halved to key/2 under Grover); average brute-force time = 2^(strength − 1) ÷ trials per second.

key size: AES key length in bits (128, 192 or 256)
trials: Keys the attacker can test each second
rounds: AES round count fixed by FIPS 197 at 10/12/14

Round schedule (FIPS 197)

AES rounds = 10 for a 128-bit key, 12 for 192-bit, 14 for 256-bit.

Worked example

With the default values below, AES Key Strength Calculator returns Effective Security Strength of 256. Change any input above and every figure here is recalculated in your browser.

Inputs used

AES key sizeone of AES-128 — 10 rounds, AES-192 — 12 rounds, AES-256 — 14 rounds: AES-256 — 14 rounds
Attacker key trials per secondminimum 1,000,000 keys/s: 1,000,000,000,000 keys/s
Assume a Grover-capable quantum attacker: No

Results

Effective Security Strength: 256 bits
AES Rounds: 14
Key Space: ≈10^77 candidate keys
Brute-force Time (log₁₀ years)A value of 6 means about a million years.: 57.3
Assessment: Safe — 128-bit or better effective strength

Step by step

1Values used
2AES Key Strength
3Round schedule (FIPS 197)
4Effective Security Strength= 256 bits
5AES Rounds= 14
6Key Space= ≈10^77 candidate keys
7Brute-force Time (log₁₀ years)= 57.3
8Assessment= Safe — 128-bit or better effective strength

Assumptions and limits

The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is AES Key Strength calculated?

effective strength = key size (halved to key/2 under Grover); average brute-force time = 2^(strength − 1) ÷ trials per second. AES has no practical shortcut attack, so its strength equals its key length and an exhaustive search needs half the key space on average. Grover's algorithm gives a quantum attacker a quadratic speed-up, which is equivalent to halving the key length — AES-256 drops to a 128-bit effective strength, AES-128 to 64 bits.

Why does AES Key Strength matter?

Choosing AES-256 over AES-128 costs about 40% more rounds but is the only symmetric choice that still holds a 128-bit margin against a future quantum attacker, which is why CNSA 2.0 mandates it.

What values do I need to enter?

This calculator takes 3 inputs: AES key size, Attacker key trials per second, Assume a Grover-capable quantum attacker. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is AES-128 still safe today?

Yes against classical attackers — 2^127 average trials is far beyond any conceivable budget. It is not future-proof, because Grover's algorithm reduces it to a 64-bit effective strength, so new systems that must stay confidential past 2035 should use AES-256.