How long should an encryption key be?

It depends on the type of algorithm, because lengths are not comparable across types. For symmetric encryption, AES-128 is still considered strong and AES-256 gives extra margin, including against future quantum computers; use 256 bits for data that must stay secret for many years. For RSA, 2048 bits is the usual minimum today, and agencies such as Germany's BSI recommend at least 3000 bits for longer protection. Elliptic-curve keys are far shorter for the same strength: a 256-bit curve such as P-256 or X25519 is roughly comparable to RSA with about 3000 bits. For hashing, use SHA-256 or stronger. Two caveats matter more than the numbers. Key length does not help if the key is badly generated, kept in a script or never rotated. And RSA and elliptic curves of any length fall to a large quantum computer, which is why their long-term replacement is post-quantum algorithms, not bigger keys. Follow your national agency's current guidance for exact values.

← All 40 questions on Encryption and encrypted trafficAll topics