How long would a supercomputer take to crack AES-256?

A fair question

After we wrote about how our apps seal files at rest with AES-256, a fair question came up: fine, but how long would it actually take a supercomputer to crack it?

We love this question, because the honest answer stops being about time and becomes about physics.

The straight arithmetic

An AES-256 key is one choice out of 2²⁵⁶ possibilities — about 1.2 × 10⁷⁷, a number in the neighborhood of the count of atoms in the observable universe.

Take the fastest supercomputer on Earth today, an exascale machine doing roughly 2 × 10¹⁸ operations per second. Pretend, absurdly generously, that a single operation could test a full key (in reality one trial takes hundreds of operations). On average you'd find the key halfway through the space, so:

Half of 2²⁵⁶ keys, at 2 × 10¹⁸ per second, is about 3 × 10⁵⁸ seconds. The universe is 4 × 10¹⁷ seconds old.

That's roughly 10⁴¹ ages of the universe. Not 10⁴¹ years — 10⁴¹ universes, run back to back.

Throwing more hardware at it doesn't help

Scale is the usual rescue in computing, so let's try it.

• Every phone, laptop, and server on Earth — call it ten billion devices, each implausibly testing ten billion keys per second — still needs on the order of 10⁴⁹ years.
• The Bitcoin mining network, the largest brute-force engine humanity has ever assembled, performs about 6 × 10²⁰ hash computations per second. Pointed at a single AES-256 key, it grinds for around 10⁴⁸ years.

When adding nine orders of magnitude of hardware doesn't move the answer off "never," the problem isn't your budget.

The physics version, which we like better

There's a thermodynamic floor called Landauer's principle: erasing one bit of information at room temperature costs a minimum amount of energy, no matter how clever the computer. Just counting from 0 to 2²⁵⁶ — doing no decryption at all, only incrementing a counter — costs about 3 × 10⁵⁶ joules.

For comparison, the Sun's entire energy output for the rest of its life is around 10⁴⁴ joules.

So a perfect computer, wasting nothing, would need to capture the complete lifetime output of about a trillion suns just to run the counter. Brute-forcing AES-256 isn't slow. It's forbidden by thermodynamics in this universe.

The question isn't "how long would it take" — it's "how many stars are you willing to spend."

The quantum asterisk

Quantum computers deserve their honest footnote. Grover's algorithm square-roots a brute-force search, which turns AES-256 into effectively 128-bit security. But 2¹²⁸ quantum operations is still about 10³⁸ of the slowest, most delicate, most error-corrected operations ever devised — and Grover's speedup barely parallelizes, so you can't just build more machines to share the work.

This is exactly why 256-bit keys exist. AES-256 is considered safe even in a post-quantum world; it's the shorter key lengths that Grover makes people nervous about.

Nobody attacks the math

Here's the part that keeps us honest: no real attacker brute-forces AES. They steal a key. They exploit a sloppy implementation — a reused nonce, an unauthenticated mode, a debug endpoint. They compromise the machine while the key is in memory. Or they just ask a person for the password.

That's why our paranoia goes where the actual risk is: fresh keys derived per file, every chunk authenticated before a byte is served, master keys held outside the apps, and no recovery back door. The math is the one part of the system we never have to think about again — the 10⁴¹ universes have that covered.