Average Brute-Force Time

Divide the number of guesses by the guesses per second. The only subtlety is the $-1$ in the exponent: an exhaustive search finds the answer halfway through on average, so the expected effort is $2^{H}/2 = 2^{H-1}$. The equation is trivial. Everything difficult about it is in the two numbers you feed it, and one of them is unknowable.

$R$ is the entire answer. The same secret can be trivial or unbreakable depending only on the guessing rate, and nothing about the secret tells you which situation you are in. Against a login form that rate-limits to five attempts and then locks the account, a rate of a few guesses per hour makes even a weak password survive indefinitely. Against a stolen database of unsalted MD5 hashes, a single consumer graphics card manages tens of billions of guesses a second, and a rented cluster does far more. Between those two extremes lies a factor of $10^{13}$, which is 43 bits — more than the entire strength of the xkcd passphrase. So the honest way to use this page is to assume the worst realistic case: an offline attack on a fast hash with no rate limiting, because that is the case you cannot control once your database leaves the building.

Exhaustive search is what an attacker does last. Before that come dictionaries, leaked-password corpora ranked by frequency, and mangling rules that capitalise, append years, and make the letter-to-digit substitutions everyone makes. A human-chosen password is usually found in a small multiple of the dictionary's size, which is billions rather than the $10^{23}$ that a formal count of the character space suggests. Treat the time above as a ceiling on effort, never as an estimate of it — it is exactly right for a value your software chose at random and wildly optimistic for anything else.

$R$ grows, and it grows in the attacker's favour. An estimate made today for an attack in 2040 is optimistic by orders of magnitude: hardware improves, purpose-built accelerators arrive, and cloud capacity gets cheaper to rent by the hour. Worse, "harvest now, decrypt later" means the ciphertext copied this morning will face the hardware of whatever year the attacker chooses. Anything that must stay confidential for decades has to be sized against decades of hardware improvement, not against this afternoon's benchmark.

And every number here is classical. Grover's algorithm searches an unstructured space of $2^{H}$ in about $2^{H/2}$ operations, which halves the effective strength of a symmetric key or a hash preimage — the standard response is to double the key, which is why AES-256 is specified alongside AES-128. Shor's algorithm is a different matter: it does not weaken RSA, Diffie-Hellman or elliptic curves, it ends them, solving factoring and discrete logarithms in polynomial time. No arithmetic on this page models either. For parameters intended to survive that, the references are FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), all published in 2024.

One last note on reading very large answers. This site's time units stop at the year, so a 128-bit key at a trillion guesses a second comes back as about $5.4 \times 10^{18}$ years and stays there. For scale, the universe is roughly $1.4 \times 10^{10}$ years old, so that figure is around 400 million times the age of everything. That is the correct answer and it is not softened here with some larger invented unit, because the point of the number is that it does not fit on a human scale. What the number does not mean is that the system is safe: keys leak, endpoints get compromised, and the attacker walks past the arithmetic entirely. A 128-bit key means brute force is not the way in. It says nothing about the other ways in.