Quantum Resistance Estimate Calculator

Work out quantum resistance estimate instantly with clear inputs, formula shown and shareable results.

About Quantum Resistance Estimate Calculator

Quantum algorithms affect primitives unequally. Grover's search halves effective symmetric strength, so AES-256 retains 128 bits while AES-128 falls to 64. Shor's algorithm breaks RSA and elliptic curves entirely, reducing them to zero. The practical question is harvest-now-decrypt-later: if your data must stay secret for longer than the projected quantum horizon, traffic captured today is already at risk.

Formula

Quantum impact

symmetric: post-quantum bits = classical / 2 (Grover); RSA and ECC: post-quantum bits = 0 (Shor); exposure when data lifetime > quantum horizon

Worked example

With the default values below, Quantum Resistance Estimate Calculator returns Security against a quantum adversary of 0. Change any input above and every figure here is recalculated in your browser.

Inputs used

Algorithm in useone of AES-128, AES-256, RSA 2048, ECC P-256, SHA-256: RSA 2048
Years the data must stay confidentialaccepts 1–100: 20
Estimated years until a cryptanalytically relevant quantum computeraccepts 1–100: 15

Results

Security against a quantum adversary: 0 bits
Classical security level: 112 bits
Harvest-now-decrypt-later exposure: Yes - data recorded today may be decrypted within its confidentiality lifetime
Recommended action: Migrate to ML-KEM or ML-DSA, or deploy hybrid key exchange now

Step by step

1Values used
2Quantum impact
3Security against a quantum adversary= 0 bits
4Classical security level= 112 bits
5Harvest-now-decrypt-later exposure= Yes - data recorded today may be decrypted within its confidentiality lifetime
6Recommended action= Migrate to ML-KEM or ML-DSA, or deploy hybrid key exchange now

Assumptions and limits

The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

What should I migrate to?

NIST's standardised ML-KEM (Kyber) for key establishment and ML-DSA (Dilithium) or SLH-DSA for signatures, ideally deployed as a hybrid alongside the existing classical algorithm.

Why is hybrid key exchange recommended?

It keeps classical security if the new scheme turns out to be flawed, while already protecting against future quantum decryption of today's captured traffic.