Nonce Length Calculator

Compare random and counter nonce strategies for AEAD: message limits, collision probability and rekey thresholds.

About Nonce Length Calculator

A 96-bit random nonce is only good for roughly 2^32.5 messages before the birthday bound bites, which is why NIST SP 800-38D prefers a deterministic construction of a fixed field plus an invocation counter. A 192-bit XChaCha20 nonce makes random generation safe for any practical volume. Distributed encryptors that each generate random 96-bit nonces will eventually collide, and a single AES-GCM nonce repeat leaks the GHASH subkey — giving universal forgery, not just one lost message.

Formulas

Nonce Length

random nonces are safe for about 2^((b + 1 − 32) ÷ 2) messages at a 2⁻³² risk target; a counter gives the full 2^b messages.

b: Nonce length in bits
2⁻³²: The conventional acceptable collision risk
counter: A monotonic sequence number, never reset across restarts

Birthday bound

collision probability for random nonces ≈ k² ÷ 2^(b+1).

Worked example

With the default values below, Nonce Length Calculator returns Message Limit (log₁₀) of 9.78. Change any input above and every figure here is recalculated in your browser.

Inputs used

Nonce lengthone of 64-bit (8 bytes), 96-bit (12 bytes) — AES-GCM default, 192-bit (24 bytes) — XChaCha20: 96-bit (12 bytes) — AES-GCM default
Nonce generation strategyone of Random per message, Deterministic counter: Random per message
Messages per keyminimum 1 messages: 4,000,000,000 messages

Results

Message Limit (log₁₀): 9.78
Nonce Length: 12 bytes
Collision Probability (log₁₀): -10.00
Headroom: About 10^0.2× more messages available
Assessment: Safe — random 96-bit nonces hold at this volume

Step by step

1Values used
2Nonce Length
3Birthday bound
4Message Limit (log₁₀)= 9.78
5Nonce Length= 12 bytes
6Collision Probability (log₁₀)= -10.00
7Headroom= About 10^0.2× more messages available
8Assessment= Safe — random 96-bit nonces hold at this volume

Assumptions and limits

The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Nonce Length calculated?

random nonces are safe for about 2^((b + 1 − 32) ÷ 2) messages at a 2⁻³² risk target; a counter gives the full 2^b messages. A 96-bit random nonce is only good for roughly 2^32.5 messages before the birthday bound bites, which is why NIST SP 800-38D prefers a deterministic construction of a fixed field plus an invocation counter. A 192-bit XChaCha20 nonce makes random generation safe for any practical volume.

Why does Nonce Length matter?

Distributed encryptors that each generate random 96-bit nonces will eventually collide, and a single AES-GCM nonce repeat leaks the GHASH subkey — giving universal forgery, not just one lost message.

What values do I need to enter?

This calculator takes 3 inputs: Nonce length, Nonce generation strategy, Messages per key. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why not just use a longer nonce with AES-GCM?

GCM only takes a 96-bit nonce natively; any other length is hashed with GHASH first, which weakens the security proof. If you need random nonces at scale, use XChaCha20-Poly1305 with its 192-bit nonce or AES-GCM-SIV, which is nonce-misuse resistant.