IT lexicon › Security › Schneier's law

Schneier's law

Security På svenska → Updated: 2026-10-16

Anyone can design a security system they themselves cannot break — which tells you nothing about whether anyone else can.

The idea comes from Bruce Schneier's 1998 Crypto-Gram essay Memo to the Amateur Cipher Designer, written for the steady stream of people mailing him their homemade ciphers. An algorithm is worth something only after it has survived years of attack by others, and the way to earn that attention is to have broken other people's designs first. Cory Doctorow gave it the name "Schneier's law" in a 2004 talk.

It is the reasoning behind the industry mantra "don't roll your own crypto" and a natural companion to Kerckhoffs's principle: a system should stay secure when everything but the key is known, and the only way to show that is public cryptanalysis.

← Back to the lexicon