Cybersecurity Calculators
Entropy, key strength, hash collisions, and the math that hardens crypto.
- Password Entropy (bits)Estimate the brute-force strength of a password from its length and character pool, plus a crack-time sanity check.H = L · log₂(N) , keyspace = N^L = 2^H , t_avg = 2^H / (2 · R)
- RSA Key Strength (equivalent symmetric bits)Estimate the symmetric-bit security level of an RSA modulus, with a NIST SP 800-57 comparison and deprecation flag.L(n) = 1.923 · (n·ln2)^(1/3) · [ln(n·ln2)]^(2/3) , bits ≈ L / ln2
- Birthday Collision ProbabilityOdds that two of N items share a hash (or birthday) drawn from a space of D values — the birthday-attack yardstick.p ≈ 1 − e^(−N(N−1)/2D) , N₅₀ ≈ 1.1774·√D , N̄ ≈ √(πD/2)
- bcrypt Cost Factor RuntimeEstimate how long a bcrypt hash takes at a given cost factor and how it scales when you bump the work factor.t(cost) = t₀ · 2^(cost − cost₀) , rounds = 2^cost
- TLS Record OverheadWire-byte cost of pushing application data through the TLS record layer — records, tags, headers, and goodput efficiency.TLS 1.3 AEAD: 5 (header) + 1 (content type) + tag per record · TLS 1.2 GCM: 5 + 8 (explicit nonce) + 16 · TLS 1.2 CBC: 5 + 16 (IV) + 32 (HMAC) + pad(1–16)
- PBKDF2 Iteration Count from Target TimePick a PBKDF2 iteration count that hits a target derivation time given your platform's measured per-iteration cost.t_iter = t_bench / N_bench , N = round( t_target / t_iter )
- CVSS v3.1 Base ScoreScore a vulnerability from its eight base metrics — exact FIRST.org v3.1 math including the Roundup quirk.ISS = 1 − (1−C)(1−I)(1−A) Impact(U) = 6.42·ISS Impact(C) = 7.52·(ISS−0.029) − 3.25·(ISS−0.02)¹⁵ Expl = 8.22·AV·AC·PR·UI Score = Roundup(min(Impact + Expl, 10)) (×1.08 before min if Scope Changed)
- JWT Payload Byte SizePredict the on-the-wire size of a signed JWT before it blows past your cookie or proxy header limits.len_b64url(n) = ⌈4n/3⌉ (unpadded), token = len(header) + len(payload) + len(sig) + 2 dots
- Token Bucket Rate LimiterSize a token bucket for an API or network path — sustained rate, burst allowance, and how long a burst can run before it throttles.tokens(t) = min(C, tokens₀ + r·t − Σcost) , burst = tokens₀ / (arrival·cost − r) , sustained = r / cost
- Brute Force Time (Charset × Length)Estimate how long an exhaustive password search takes given alphabet size, length, and guess rate.N = C^L , H = L·log₂C , t = (f·N) / r