A guarded door
The service can rate-limit, require another factor, detect abuse and lock an account. The attacker cannot quietly test every possibility.
- Network delay
- Rate limits
- Detection
- Account lockout
Data × patterns × machines × time
How much guessing power is out there?
SNAPSHOT
2026—08
2026—08
The honest answer is never one speed. Logging into a website, checking a password hash and testing a cipher key are radically different jobs.
2.198exaFLOP/s
A useful scale—not a guessing rate
The June 2026 TOP500 leader.
LineShine recorded 2.198 exaflop/s on the HPL linear-algebra benchmark using 13,789,440 cores and about 42.2 MW. That does not mean 2.198 quintillion AES keys or passwords per second. Different operations have different circuits, memory costs, parallel limits and energy demands.
Same secret, different race
Where the guess happens changes everything.
Defenders often win by making each guess slow, expensive, visible or limited. That is why a modest password can survive online while failing quickly after a database leak.
A copied puzzle
With captured data, an attacker may distribute guesses across CPUs, GPUs or custom hardware without asking the defender again.
- Massive parallelism
- No lockout
- Hardware specialization
- Energy cost
The mathematics of doubling
One more bit doubles the search space.
Bits are useful because adding sounds small while multiplication becomes enormous. But the effective strength is capped by the weakest link: the source, the key space, the algorithm or the implementation.
- 20 bits≈ 1 million
A blink for an offline machine
- 40 bits≈ 1 trillion
Large to a person; modest to specialized compute
- 80 bits≈ 1.2 × 10²⁴
Enormous, but below modern long-term cryptographic targets
- 128 bits≈ 3.4 × 10³⁸
A standard modern security scale
- 256 bits≈ 1.2 × 10⁷⁷
Often capped by some other part of the system
A 256-bit key made from only 32 bits of unpredictable seed has at most about 32 bits of source uncertainty. The long output cannot restore choices that never existed.
Quantum, without the shortcut slogan
“Halve the bits” is not a practical forecast.
Grover’s algorithm provides a theoretical quadratic reduction in sequential search steps. Real attacks must also account for expensive fault-tolerant hardware, circuit depth, error correction and poor parallel scaling.
NIST’s current guidance says the simple square-root story can substantially exaggerate practical advantage and that classical attacks may remain better in many realistic cases.
Now move the assumptions yourself
An answer is only as honest as its threat model.
Change guess rate, number of machines, time horizon, source uncertainty and algorithm strength. The limiting factor and remaining margin update together.
FragileAdequatePlentyOther limits dominateMarker at 63 percent
Past the line, better key storage and correct implementation usually matter more than harvesting extra noise.