SSH Key Length Calculator

Compare SSH key algorithm and bit-length strength across RSA, ECDSA and Ed25519.

Inputs

SSH Key Algorithm

Compare Against

Algorithm

Ed25519

Security Strength

128bits

Key Size

256-bit

Notes

Fast, small, modern default

Comparison Algorithm

RSA-4096

Comparison Security Strength

128bits

Comparison

Ed25519 and RSA-4096 offer equivalent security strength.

Step by step

Values used
SSH Key Algorithm = Ed25519; Compare Against = RSA-4096
RSA security strength estimate
security_bits ≈ (key_bits / 30)^(1/3) × 4.5 (NIST approximation: RSA-2048 ≈ 112 bits, RSA-3072 ≈ 128 bits)
Algorithm
= Ed25519
Security Strength
= 128 bits
Key Size
= 256-bit
Notes
= Fast, small, modern default
Comparison Algorithm
= RSA-4096
Comparison Security Strength
= 128 bits

How it works

Different SSH key algorithms achieve comparable real-world security at very different key sizes, because RSA's security relies on integer factorization while elliptic-curve algorithms (Ed25519, ECDSA) rely on the discrete logarithm problem, which resists brute force far more efficiently per bit. NIST's estimated symmetric-equivalent security strength lets keys of very different byte lengths be compared on equal footing: RSA-2048 gives roughly 112 bits, RSA-3072/4096 and Ed25519/ECDSA-256 all give roughly 128 bits, despite Ed25519 keys being a fraction of the size.

Formula

RSA security strength estimate

security_bits ≈ (key_bits / 30)^(1/3) × 4.5 (NIST approximation: RSA-2048 ≈ 112 bits, RSA-3072 ≈ 128 bits)

key_bits: RSA modulus size in bits
security_bits: equivalent symmetric strength in bits

Frequently Asked Questions

Why is Ed25519 recommended over RSA for new SSH keys?

Ed25519 provides RSA-4096-equivalent security (128 bits) with a much smaller 256-bit key, which makes key generation, signing and verification significantly faster while keeping the public key short enough to paste inline in authorized_keys files.

Is RSA-2048 still safe to use for SSH?

RSA-2048 (112-bit security) is still considered acceptable by NIST guidance for now, but it offers a smaller security margin than RSA-3072+ or Ed25519, and many organizations are moving away from it as compute power increases and quantum-resistance planning begins.

What does 'bits of security' actually mean?

It is the estimated number of operations (as a power of two) an attacker would need to break the key via the best known attack, used as a common yardstick to compare fundamentally different algorithms like RSA and elliptic curves.

You might also need

File Permission Calculator ulimit Calculator