ECC Key Strength Calculator

Work out ecc key strength instantly with clear inputs, formula shown and shareable results.

About ECC Key Strength Calculator

Elliptic-curve security is about half the field size because Pollard's rho solves the discrete logarithm in roughly sqrt(n) group operations. P-256 therefore delivers 128-bit security in a 256-bit key, matching RSA 3072 while being far cheaper to compute and carrying far smaller certificates and signatures.

Formula

ECC strength

security bits ~ field size / 2; RSA equivalent from NIST SP 800-57 (ECC 256 ~ RSA 3072, ECC 384 ~ RSA 7680)

Worked example

With the default values below, ECC Key Strength Calculator returns Security level of 128. Change any input above and every figure here is recalculated in your browser.

Inputs used

Curveone of P-256 / secp256r1, P-384 / secp384r1, P-521 / secp521r1, Curve25519 / Ed25519, secp256k1: P-256 / secp256r1
Operations needed per secondminimum 0.1: 5,000

Results

Security level: 128 bits
Equivalent RSA modulus: 3,072 bits
Curve field size: 256 bits
CPU cores for the operation rate: 0.417

Step by step

1Values used
2ECC strength
3Security level= 128 bits
4Equivalent RSA modulus= 3,072 bits
5Curve field size= 256 bits
6CPU cores for the operation rate= 0.417

Assumptions and limits

The result is derived only from the 2 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Is Ed25519 better than P-256?

It offers comparable security with a simpler, misuse-resistant design, deterministic signatures and no dependence on a random nonce per signature. Support is now broad but not universal in older hardware and TLS stacks.

Why does secp256k1 appear in cryptocurrencies rather than TLS?

It was chosen by Bitcoin for its efficient structure and verifiably non-random parameters. It offers the same 128-bit level as P-256 but is not in the standard TLS or PKI profiles.