Keyspace Size Calculator: K = R^L Possible Keys and Bits

It’s a single clean question: How many unique passwords or keys are possible using a certain design? That’s the keyspace, the answer to that question, and it’s the base for all talk about cryptographic strength. The equation is precise and straightforward: K = R^L, where K is the keyspace (the number of unique combinations), R is the size of alphabet (the number of unique symbols each character can contain) and L is length (how many characters).

With this, it calculates that number and its equivalent in bits. It also finds the number of decimal digits it will contain and how big that huge number realy is compared to something we can understand, like atoms and grains of sand. It takes mathematical abstraction and makes it concrete.

How to Calculate Your Keyspace Size

Think about creating that key position by position: For example, suppose it has L positions, where each can be one of R different symbols. Then the first position can be any of those R symbols; the second can be any of those R symbols; etc., right? And they’re all independent choices, so you just multiply them together. You get R times R times … times R (L times).

Ten possible digits in a four-position PIN gives us ten times ten times ten times ten, a ten-thousand-combo keyspace. Six digits in a one-time code gives you one million. Keyspace means the full set of possible keys, and it is simply the size of the space you have to search.

Cryptographers don’t work with raw keyspaces; those become astronomically large very quickly, and we measure them in bits instead. K = R^L. Taking the base-two logarithm of this number gives you its bit strength, which factors out nicely: the bit strength = L * log2(R).

How many bits does each symbol provide? It provides one bit per binary digit, 3.32 bits per decimal digit, four bits per hex character, and approximately 6.57 bits per full-ASCII character. Bits are handy in that they (1) double the keyspace for each additional bit, and (2) add up linearly.

Thus when someone says “128-bit” key, they’re referring to something that might be literal 128 binary digits long, or maybe only about 20 full-ASCII characters long; but either way its keyspace is 2^128. Why do people speak in terms of bits? Because bits are handy.

The calculator will show four numbers about your setup. Because it’s impractical to spell out a keyspace that has dozens of digits, the first card displays the entire count as a number in scientific notation. The second card converts that to bits and shows you its equivalent bit strength… The number quoted most often in security circles.

The third card breaks down how many decimal digits are part of that count: it’s floor(log10()) plus one. If you wanted to write out every digit in the whole number, you’d know exactly how long that is. The fourth card takes that keyspace and turns it into a real world measure, assigning a name to the next-larger physical quantity so you can visualize this abstract exponent.

Hit compare mode and you can put them side-by-side. Now comes the important lesson: The keyspace increases much faster with length than with width. An eight character alphanumeric key gains around 23.8 bits if we expand it to twelve characters, multiplying its keyspace by approximately fifteen-million. That’s almost double the length of the key!

Compare that with converting the exact same eight character key from lower case to all ASCII, which only adds ~15 bits. Length is the big winner; that’s why long passphrases trump short but complex passwords. Most people think to tack in symbols. They should of been thinking to tack in length.

These numbers get incredibly large very quickly, but it’s hard to see that as an exponent. This calculator ties the size of bits to physical references for scale. There are approximately 63 bits worth of grains of sand on earth. There are approximately 80 bits worth of stars in the universe. There are about 166 bits worth of atoms on planet Earth. About 266 bits (on the order of) worth of atoms in the observable universe.

These markers illustrate how far short you’ll fall before getting to the size of even moddern ciphers, there is no hope of trying all possible keys on a laptop because it would be physically impossible. Brute forcing a universe sized keyspace? Not gonna happen.

Its preset settings reflect actual crypto history. A 56-bit key for DES could be searched by current computing machines and was eventually retired. A 128-bit keyspace (AES-128) is equal to around 3.4e38 keys; a 39 digit number beyond the reach of any imaginable computer. With 256 bits (AES-256), we’re at around 1.2e77, or 78 digits, still dwarfed by the amount of atoms in the observable universe (and just below).

For anyone interested, a string of 32 characters in hex format is equal to same 128-bit keyspace of AES-128: 16^32 = 2^128. This tool demonstrates this nice coincidence well. And that’s it! That is where knowing your keyspace begins; it doesn’t end there.

The goal here is to force you to see the plain raw size of your keyspace first, before adding in crack times or attacker speeds or anything else. If you’re going to have security based off keys, a large keyspace is necessary, but it’s only meaningful if keys are picked from that space uniformly at random.

Use these as reference tables to know your token sizes and API key sizes with confidence. Also, remember how huge a good keyspace should feel from the magnitude comparisons alone.