RSA Key Strength (equivalent symmetric bits)
Estimate the symmetric-bit security level of an RSA modulus, with a NIST SP 800-57 comparison and deprecation flag.
Your recent runs (stored only in your browser)
No calculations yet — results land here so you can compare runs.
The engineering
RSA security rests on the difficulty of factoring the public modulus n. The best known classical attack is the General Number Field Sieve, whose cost grows sub-exponentially in the bit length. This card maps that GNFS work factor to an equivalent symmetric key size so you can compare a 2048-bit RSA key against AES-128 on the same scale, then pins the result to the NIST SP 800-57 / SP 800-131A strength table.
Rule of thumb: 2048-bit RSA ≈ 112-bit strength, 3072-bit ≈ 128-bit. Doubling symmetric strength costs far more than doubling the modulus — going from 128 to 256 equivalent bits means jumping from 3072 to over 15000 bits, which is why 256-bit strength is usually served by ECC or post-quantum schemes instead. Anything below 2048 bits is disallowed for federal use, and none of these estimates survive a large quantum computer running Shor's algorithm.
Where this math comes from
Rivest, Shamir, and Adleman published the RSA cryptosystem in 1977, turning the practical difficulty of factoring large numbers into a public-key scheme. For two decades key-size guidance was informal — 512 bits felt safe until the RSA-155 (512-bit) challenge modulus was factored in 1999 with a distributed sieve, a wake-up call that pushed everyone to 1024 and beyond.
Arjen Lenstra and Eric Verheul's 2001 'Selecting Cryptographic Key Sizes' gave the field a defensible cost model tying modulus size to symmetric-equivalent security. NIST codified the tradeoffs in SP 800-57 and set hard deprecation dates in SP 800-131A, which disallowed 1024-bit RSA for federal systems after 2013.
- 1977Rivest, Shamir & AdlemanPublish the RSA public-key cryptosystem.
- 1994Peter ShorShows a quantum computer could factor in polynomial time — the long-term threat to RSA.
- 1999Te Riele et al.Factor the 512-bit RSA-155 challenge, ending confidence in small moduli.
- 2001A. Lenstra & E. VerheulPublish key-size selection model linking modulus bits to symmetric strength.
- 2015NISTSP 800-131A Rev 1 fixes the RSA deprecation and strength schedule used here.
See the full timeline of the math behind every calculator →
Runs entirely in your browser — nothing you enter leaves this page. Your recent runs are stored only on your device.