Compare random and counter nonce strategies for AEAD: message limits, collision probability and rekey thresholds.
A 96-bit random nonce is only good for roughly 2^32.5 messages before the birthday bound bites, which is why NIST SP 800-38D prefers a deterministic construction of a fixed field plus an invocation counter. A 192-bit XChaCha20 nonce makes random generation safe for any practical volume. Distributed encryptors that each generate random 96-bit nonces will eventually collide, and a single AES-GCM nonce repeat leaks the GHASH subkey — giving universal forgery, not just one lost message.
Nonce Length
random nonces are safe for about 2^((b + 1 − 32) ÷ 2) messages at a 2⁻³² risk target; a counter gives the full 2^b messages.
Birthday bound
collision probability for random nonces ≈ k² ÷ 2^(b+1).
random nonces are safe for about 2^((b + 1 − 32) ÷ 2) messages at a 2⁻³² risk target; a counter gives the full 2^b messages. A 96-bit random nonce is only good for roughly 2^32.5 messages before the birthday bound bites, which is why NIST SP 800-38D prefers a deterministic construction of a fixed field plus an invocation counter. A 192-bit XChaCha20 nonce makes random generation safe for any practical volume.
Distributed encryptors that each generate random 96-bit nonces will eventually collide, and a single AES-GCM nonce repeat leaks the GHASH subkey — giving universal forgery, not just one lost message.
This calculator takes 3 inputs: Nonce length, Nonce generation strategy, Messages per key. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
GCM only takes a 96-bit nonce natively; any other length is hashed with GHASH first, which weakens the security proof. If you need random nonces at scale, use XChaCha20-Poly1305 with its 192-bit nonce or AES-GCM-SIV, which is nonce-misuse resistant.