Quick Answer: Will quantum computers break encryption?
It depends on which encryption you mean. A large, fault-tolerant quantum computer running Shor’s algorithm would break RSA, Diffie–Hellman, and elliptic-curve cryptography, which protect most of today’s internet traffic. Symmetric ciphers like AES are only weakened, not broken, and doubling key sizes largely fixes that. Organizations can act now by inventorying where public-key crypto is used, piloting post-quantum algorithms, and planning migration years ahead of any real threat.
The practical question is less “will it happen” and more “when, and what should be done before then.” The factors to weigh are migration lead time, data shelf life, vendor support, standards maturity, and budget.
In 1994, a mathematician named Peter Shor published an algorithm that quietly redrew the security map of the internet. It showed that a quantum computer, if built at sufficient scale, could factor large numbers and solve discrete logarithms efficiently. Those two problems underpin nearly every padlock icon a browser has ever displayed. Three decades later, no such machine exists, yet governments and standards bodies are already rewriting the cryptographic rulebook as if it does.
That gap between theoretical certainty and engineering reality is where most of the confusion lives. Headlines swing between “encryption is already broken” and “this is decades away, ignore it.” Neither is quite right. The honest answer sits in the middle, and it depends heavily on which kind of encryption is being discussed.
What Shor’s algorithm actually threatens
Shor’s algorithm targets asymmetric cryptography — the public-key systems used for key exchange and digital signatures. RSA, Diffie–Hellman, and elliptic-curve cryptography (ECC) all rest on mathematical problems that a quantum computer could solve far faster than any classical machine. When people ask whether quantum computers will break encryption, this is the encryption they usually mean.
The threat is not gradual. A classical attacker chipping away at RSA-2048 would need longer than the age of the universe. A quantum attacker running Shor’s algorithm would need hours, assuming the hardware existed. That asymmetry is why cryptographers treat it as a cliff edge rather than a slope.
The hardware bar is steep. Peer-reviewed resource estimates have put breaking RSA-2048 at roughly 20 million noisy physical qubits running for about eight hours, and later analyses have pushed that figure down considerably. Even the optimistic numbers sit orders of magnitude beyond today’s machines, which operate in the hundreds to low thousands of physical qubits. Understanding what quantum computing is and how it works helps explain why scaling up is so hard: qubits are fragile, error-prone, and need constant correction.
Symmetric encryption survives, with a haircut
Here is the nuance that most coverage skips. AES and SHA-2/SHA-3 are not broken by Shor’s algorithm. They are not built on factoring or discrete logarithms.
The relevant tool is Grover’s algorithm, published in 1996, which provides a quadratic speedup for unstructured search. In practice, that roughly halves the effective security of a symmetric key. AES-128 behaves like AES-64 against a quantum attacker. The fix is straightforward: move to AES-256, which retains a comfortable margin.
| Cipher type | Quantum impact | Practical fix |
|---|---|---|
| RSA, Diffie–Hellman, ECC | Broken by Shor’s algorithm | Replace with post-quantum algorithms |
| AES-128 | Effective strength halved | Upgrade to AES-256 |
| SHA-256 | Reduced collision margin | Move to SHA-384 or SHA-512 |
| Hash-based signatures | Minimal | Already quantum-resistant |
This distinction matters because it changes the urgency. Symmetric crypto needs tuning; asymmetric crypto needs replacing. Anyone who says “quantum breaks all encryption” is flattening a genuinely important difference. For a broader grounding, it helps to revisit what encryption is and why it is important before deciding which systems deserve attention first.
The real deadline is migration time, not the machine
The most useful way to think about this is not “when will the quantum computer arrive” but “how long does a migration take.” Replacing public-key cryptography across an enterprise is a multi-year slog. Certificate inventories, hardware security modules, embedded firmware, legacy protocols, supplier contracts — each is a bottleneck.
That is why the migration has already started. In August 2024, NIST published its first three finalized post-quantum standards: FIPS 203 (ML-KEM, for key encapsulation), FIPS 204 (ML-DSA, for signatures), and FIPS 205 (SLH-DSA, hash-based signatures). Draft transition guidance has floated deprecating RSA and ECC at the 112-bit security level by 2030 and disallowing them by 2035. Those dates are guidance, not physics, but they set the planning clock.
Government mandates reinforce the point. The US National Security Agency’s CNSA 2.0 guidance targets a full quantum-resistant transition for national security systems by 2035, and the EU’s coordinated roadmap aims to begin migration by the end of 2026. None of these bodies expect a working cryptanalytic quantum computer on that schedule. They are budgeting for the migration, not the machine.
Harvest now, decrypt later
There is a second clock running that has nothing to do with future hardware. Harvest now, decrypt later describes an adversary recording encrypted traffic today and storing it until decryption becomes feasible. If a medical record, a trade secret, or a diplomatic cable needs to stay confidential for twenty years, it is already exposed.
This is the argument that finally moves budget holders. The question stops being “is my data at risk in 2040” and becomes “is my data at risk right now, because someone is archiving it.” For anyone weighing end-to-end encryption in messaging or storage products, the shelf life of the data is the variable that matters most.
What post-quantum cryptography looks like in practice
Post-quantum algorithms are not quantum algorithms. They run on ordinary classical hardware and rely on mathematical problems believed to resist both classical and quantum attack — lattice problems, hash functions, and error-correcting codes among them.
The trade-offs are real, and they show up in the field:
- Larger keys and signatures. ML-KEM public keys run around 800 bytes versus 32 bytes for a comparable elliptic-curve key. On a browser this is invisible; in a low-bandwidth sensor network or a constrained smart card, it is a genuine engineering problem.
- Performance variance. Some schemes are fast at key generation but slow at signing, or vice versa. Benchmarking on real hardware beats trusting a spec sheet.
- Hybrid mode is the default for now. Most deployments combine a classical algorithm with a post-quantum one, so security holds if either turns out to be weaker than expected. This is the pragmatic path, and it is what most browser and cloud vendors have shipped.
The practical mistake organizations make is treating this as a pure cryptography-team task. It is not. Certificate lifecycle management, code signing pipelines, VPN concentrators, and IoT firmware all need to move together. A common failure mode is migrating the web tier while forgetting the machine-to-machine links behind it.
A second common mistake: waiting for perfect standards. Algorithms will be refined, and some earlier candidates have already been broken or downgraded. But the inventory work — knowing where public-key crypto lives in your estate — is valuable regardless of which algorithm wins. Start there.
The relationship between quantum hardware and AI is also worth watching, since how quantum computing could change artificial intelligence may accelerate hardware roadmaps in ways that shift the timeline. Similarly, tracking the latest breakthroughs in quantum computing gives a clearer picture than any single headline. And for readers comparing paradigms, quantum computing versus classical computing frames why error correction, not raw qubit count, is the real bottleneck. (Post-Quantum Cryptography)
How long do we actually have?
Nobody knows, and anyone who states a confident date is guessing. Published estimates for a cryptographically relevant quantum computer range from roughly a decade to thirty-plus years. The variance comes from assumptions about error correction, engineering breakthroughs, and funding.
| Timeline scenario | Implication |
|---|---|
| 10–15 years | Migration must start now; 2030s deadlines are realistic |
| 20–30 years | Still start now; data shelf life drives urgency |
| Never at scale | Hybrid post-quantum deployment costs little and hedges fully |
Notice that the advice barely changes across scenarios. That is the sign of a decision that is robust to uncertainty. The cost of early migration is modest and mostly absorbed into normal refresh cycles. The cost of being late is catastrophic and irreversible for already-captured data.
It is also worth separating two questions that get conflated. Will quantum computers break encryption? Almost certainly yes, for asymmetric schemes, if the hardware arrives. Will they break it soon? Probably not soon enough to justify panic — but comfortably soon enough to justify planning. The gap between those two answers is where sensible strategy lives.
Conclusion
Quantum computers will break the public-key encryption that secures most of the internet, but they will not break all encryption, and they have not broken it yet. The threat is concentrated in RSA, Diffie–Hellman, and elliptic-curve cryptography; symmetric ciphers like AES survive with larger keys. The binding constraint is not the arrival date of the hardware but the years required to replace cryptographic infrastructure that is woven through every layer of modern computing.
The organizations handling this well are not waiting for certainty. They are building cryptographic inventories, testing hybrid post-quantum deployments in low-risk corners, and pressing vendors for roadmaps. That work pays off under every timeline scenario, which is precisely why it is worth doing now rather than after the headlines turn from speculation to incident.
FAQ
What is the difference between post-quantum and quantum cryptography?
Post-quantum cryptography uses classical computers and classical mathematics, chosen so that quantum attacks offer no advantage. Quantum cryptography, by contrast, uses quantum physics itself — quantum key distribution is the best-known example — to detect eavesdropping. Post-quantum is the practical path for most organizations because it runs on existing hardware.
Is AES-256 safe from quantum computers?
Yes, with a wide margin. Grover’s algorithm roughly halves the effective key length, so AES-256 retains around 128 bits of security against a quantum attacker. That is still far beyond any feasible attack. AES-128 is the one that needs upgrading.
What does “harvest now, decrypt later” mean?
It describes an attacker storing encrypted traffic today with the intention of decrypting it once quantum hardware matures. Because the data is already captured, the exposure exists now regardless of when the machine arrives. Long-lived secrets — health records, intellectual property, state communications — are the primary concern.
Do I need to replace my TLS certificates today?
Not immediately, but the planning should start. Most guidance points to hybrid deployments first, then full post-quantum once interoperability and vendor support mature. The prerequisite step is knowing where certificates, keys, and hardcoded algorithms live across your systems — an inventory that takes longer than most teams expect.
Will quantum computers break blockchain cryptography?
Public-key signatures on blockchains, including ECDSA, are vulnerable to Shor’s algorithm in principle. The practical risk depends on whether public keys are exposed before funds move. Many chains have discussed migration paths to post-quantum signatures, but coordinated upgrades across decentralized networks are slow and contentious.
How is quantum computing different from classical computing for security?
Classical computers solve problems step by step, so some mathematical problems stay effectively out of reach no matter how fast the hardware gets. Quantum computers exploit superposition and interference to attack certain problem structures directly. That is why the threat is narrow but severe: it lands precisely on the math that public-key cryptography depends on.
For organizations that want a concrete starting point, the sequence is unglamorous but effective: inventory first, then risk-rank by data shelf life, then pilot hybrid key exchange where rollback is cheap, then push vendors for firm post-quantum timelines in contracts. None of these steps require a quantum computer to exist, and all of them reduce exposure under every scenario above. The organizations that treat this as a multi-year engineering program rather than a headline-driven scramble will be the ones still operating normally when the hardware finally arrives.
