Do I need 40- or 128-bit encryption?

40-bit is not a safe encryption level anymore. 40-bit encryption can be broken via a brute-force attack within a few days using one computer and within a few hours using several dozens of computers!

128-bit encryption is 2^88 times longer to break via a brute-force attack (equaling 309.485.009.821.345.068.724.781.056 times longer), meaning it cannot be broken via a brute-force attack.

Therefore it is advised, whenever possible, to use 128-bit encryption with a BXA certificate (see How enabling 128-bit encryption with a SuperCert (BXA) certificate?) or with a standard certificate with appropriate settings. If you cannot use 128-bit encryption, 40-bit is better than no encryption at all!