Nonce Length Calculator
Compare random and counter nonce strategies for AEAD: message limits, collision probability and rekey thresholds.
Inputs
Message Limit (log₁₀)
9.78
Nonce Length
12bytes
Collision Probability (log₁₀)
-10.00
Headroom
About 10^0.2× more messages available
Assessment
Safe — random 96-bit nonces hold at this volume
Step by step
Values used
Nonce length = 96-bit (12 bytes) — AES-GCM default; Nonce generation strategy = Random per message; Messages per key = 4,000,000,000 messages
Nonce Length
random nonces are safe for about 2^((b + 1 − 32) ÷ 2) messages at a 2⁻³² risk target; a counter gives the full 2^b messages.
Birthday bound
collision probability for random nonces ≈ k² ÷ 2^(b+1).
Message Limit (log₁₀)
= 9.78
Nonce Length
= 12 bytes
Collision Probability (log₁₀)
= -10.00
Headroom
= About 10^0.2× more messages available
Assessment
= Safe — random 96-bit nonces hold at this volume
How it works
A 96-bit random nonce is only good for roughly 2^32.5 messages before the birthday bound bites, which is why NIST SP 800-38D prefers a deterministic construction of a fixed field plus an invocation counter. A 192-bit XChaCha20 nonce makes random generation safe for any practical volume. Distributed encryptors that each generate random 96-bit nonces will eventually collide, and a single AES-GCM nonce repeat leaks the GHASH subkey — giving universal forgery, not just one lost message.
Formulas
Nonce Length
random nonces are safe for about 2^((b + 1 − 32) ÷ 2) messages at a 2⁻³² risk target; a counter gives the full 2^b messages.
- b
- Nonce length in bits
- 2⁻³²
- The conventional acceptable collision risk
- counter
- A monotonic sequence number, never reset across restarts
Birthday bound
collision probability for random nonces ≈ k² ÷ 2^(b+1).
Frequently Asked Questions
How is Nonce Length calculated?
random nonces are safe for about 2^((b + 1 − 32) ÷ 2) messages at a 2⁻³² risk target; a counter gives the full 2^b messages. A 96-bit random nonce is only good for roughly 2^32.5 messages before the birthday bound bites, which is why NIST SP 800-38D prefers a deterministic construction of a fixed field plus an invocation counter. A 192-bit XChaCha20 nonce makes random generation safe for any practical volume.
Why does Nonce Length matter?
Distributed encryptors that each generate random 96-bit nonces will eventually collide, and a single AES-GCM nonce repeat leaks the GHASH subkey — giving universal forgery, not just one lost message.
What values do I need to enter?
This calculator takes 3 inputs: Nonce length, Nonce generation strategy, Messages per key. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why not just use a longer nonce with AES-GCM?
GCM only takes a 96-bit nonce natively; any other length is hashed with GHASH first, which weakens the security proof. If you need random nonces at scale, use XChaCha20-Poly1305 with its 192-bit nonce or AES-GCM-SIV, which is nonce-misuse resistant.
You might also need
- Encryption Overhead CalculatorCommonly used together
- Initialization Vector (IV) CalculatorCommonly used together
- Randomness Entropy CalculatorCommonly used together
- Hash Collision Probability CalculatorCommonly used together
- Key Rotation Interval CalculatorCommonly used together
- TLS Session Key CalculatorCommonly used together