Quantum computers could eventually break some of the encryption that protects online banking, private messages, digital identities, and sensitive government communications. But they would not break every form of encryption, and the quantum computers available today are not capable of carrying out the attacks needed to defeat widely used modern cryptographic systems at practical scale.
The main risk comes from a specific mathematical vulnerability. Much of today’s internet security depends on problems that ordinary computers struggle to solve, including finding the prime factors of enormous numbers and calculating discrete logarithms. A sufficiently powerful, fault-tolerant quantum computer could solve certain versions of these problems dramatically faster, undermining important methods used to establish secure connections and verify digital identities.
Other cryptographic methods, particularly properly implemented symmetric encryption and cryptographic hash functions, face a less severe threat. They may need stronger parameters, but they are not vulnerable to the same quantum algorithm that threatens public-key cryptography.
The distinction matters because the future of encryption is not a simple contest between quantum computers and cybersecurity. It is a question of which mathematical protections remain reliable, which must be replaced, and how quickly organizations can make that transition before powerful quantum machines become available.
How encryption protects everyday digital life
Encryption transforms readable information, called plaintext, into an unintelligible form, called ciphertext. The intended recipient can reverse the transformation using the appropriate key.
The security of a modern encryption system generally depends on both its mathematical design and the secrecy or management of its keys. Strong encryption can make intercepted information computationally impractical to recover, even when an attacker knows which algorithm was used.
This protection supports far more than private messages. It helps secure online purchases, banking transactions, medical records, corporate networks, government communications, cloud storage, and software updates. Cryptographic systems also help establish that a website is genuine, a message has not been altered, or a software update came from its legitimate publisher.
Two broad categories of cryptography play different roles.
Symmetric cryptography uses the same secret key, or closely related key material, to encrypt and decrypt information. The Advanced Encryption Standard, commonly known as AES, is a widely used example. Symmetric encryption is efficient enough to protect large amounts of data, making it suitable for files, databases, and the information exchanged during secure internet sessions.
Public-key cryptography, also called asymmetric cryptography, uses mathematically related keys. One key can be shared publicly, while another is kept private. Depending on the system, this arrangement can help establish shared secrets, authenticate participants, or create digital signatures that others can verify.
Public-key systems solve a practical problem: two parties who have never met need a way to establish trust or agree on a secret without first sharing a confidential key through a secure channel.
That convenience rests on mathematical problems believed to be difficult for conventional computers. Quantum computing threatens some of those problems far more directly than it threatens symmetric encryption.
Why quantum computers pose a different kind of threat
Ordinary computers process information using bits, which represent either 0 or 1. Quantum computers use quantum bits, or qubits, whose states can involve quantum superposition and entanglement.
Superposition allows a qubit to occupy a combination of the states represented by 0 and 1. Entanglement creates correlations between quantum systems that have no direct equivalent in ordinary classical information processing. Quantum algorithms exploit these properties to perform certain computations in ways that conventional algorithms cannot efficiently reproduce.
This does not mean a quantum computer simply tries every possible answer simultaneously and reads out the correct one. Measurement produces limited information, and a useful quantum algorithm must arrange its operations so that the desired result can be extracted with high probability.
The practical advantage is highly dependent on the problem. Quantum computers are not expected to outperform conventional machines at every task. For many everyday calculations, a classical computer will remain more practical.
Cryptography is different because some of its security assumptions are particularly vulnerable to known quantum algorithms.
The most important example is Shor’s algorithm, developed by mathematician Peter Shor in 1994. It provides a quantum method for efficiently factoring large integers and solving the discrete logarithm problem. These are precisely the mathematical problems underlying several widely deployed public-key cryptographic systems.
A quantum computer does not need to break encryption by guessing passwords, stealing keys, or exploiting a software flaw. It could instead attack the mathematical foundation that makes recovering a private key infeasible for a conventional computer.
Which encryption systems are most vulnerable?
The most serious quantum threat concerns public-key cryptography built on integer factorization and discrete logarithms.
RSA, one of the best-known public-key cryptographic systems, relies on the difficulty of factoring a large number formed by multiplying two secret prime numbers. Multiplying the primes together is straightforward. Recovering them from their product becomes extremely difficult as the numbers grow, assuming conventional computing methods.
Shor’s algorithm changes that calculation. A sufficiently capable quantum computer could factor the relevant number efficiently enough to recover an RSA private key from its public key, potentially allowing an attacker to decrypt protected information or forge digital signatures.
Elliptic-curve cryptography, or ECC, faces a similar threat. It uses mathematical operations on elliptic curves to support key agreement and digital signatures. Its security depends on the difficulty of solving a related discrete logarithm problem. Shor’s algorithm can solve that problem efficiently on a sufficiently powerful quantum computer.
These systems are deeply embedded in digital infrastructure. RSA and elliptic-curve methods have been used in secure web connections, virtual private networks, digital certificates, software authentication, secure messaging, and numerous other applications. Their exact roles vary, and not every implementation uses them in the same way, but the consequences of a practical quantum attack could be extensive.
The threat also applies to important key-establishment mechanisms based on discrete logarithms, including those used in finite-field Diffie–Hellman. Such mechanisms allow two parties to derive a shared secret over a channel that other people can observe. If a sufficiently powerful quantum computer could solve the underlying problem, the attacker might reconstruct that secret.
The central issue is not that every encrypted message would automatically become readable. Rather, an attacker could potentially recover the keys or forge the credentials that certain cryptographic protocols rely on. What becomes possible would depend on the algorithm, how it was used, what information the attacker possessed, and whether other safeguards were in place.
Why symmetric encryption is less vulnerable
AES and other symmetric encryption systems face a different quantum threat.
The best-known general quantum attack on symmetric cryptography is Grover’s algorithm. It can speed up certain brute-force searches, including searching for a secret key, from roughly NNN possibilities to a number of quantum operations on the order of N\sqrt{N}N, under the algorithm’s idealized assumptions.
For example, an exhaustive classical search through a key space containing 21282^{128}2128 possibilities could require work on the order of 21282^{128}2128 key trials in the worst case. Grover’s algorithm offers a theoretical quadratic speedup, reducing the corresponding quantum search effort to roughly 2642^{64}264 oracle operations.
That is a substantial reduction, but it is not comparable to Shor’s algorithm’s effect on RSA and elliptic-curve cryptography. A quadratic speedup still leaves an exponentially large search problem for sufficiently large keys, and a practical quantum implementation of Grover’s algorithm would face substantial hardware and operational costs.
AES-256, which uses a 256-bit key, therefore retains a substantial security margin against this general quantum search threat. The same cannot be said of every cryptographic design, but it illustrates why quantum computing does not make all encryption obsolete.
Hash functions also require a more nuanced assessment. A cryptographic hash function maps data of arbitrary length to a fixed-length output and is designed to make certain attacks, such as finding a matching input or a collision, computationally difficult. Quantum algorithms can accelerate some hash-related searches, but the effects depend on the security property being considered and the attack being attempted.
For that reason, the response to quantum computing is not necessarily to replace every cryptographic algorithm. Some systems can remain secure with appropriate key sizes and parameters, while others require fundamentally different mathematical constructions.
What a powerful quantum computer could actually do
The consequences of breaking vulnerable public-key cryptography extend beyond reading messages. Several distinct capabilities are at stake, and they should not be confused with one another.
Decrypting intercepted communications. If an attacker records a protected connection and later obtains the secret needed to decrypt its traffic, the attacker may be able to recover the information exchanged during that session. Whether this works depends on the protocol and its key-management design. In particular, modern connections that use properly implemented ephemeral key exchange with forward secrecy can limit the damage from a later compromise of a server’s long-term private key. Forward secrecy is designed to prevent that key compromise, by itself, from revealing previously established session keys.
Impersonating trusted parties. Public-key cryptography helps browsers authenticate websites and systems verify identities. If an attacker could derive a private key or forge a digital signature under a vulnerable scheme, the attacker might impersonate a legitimate service or produce fraudulent credentials. Certificate systems and protocol protections can complicate an attack, but they do not restore the mathematical security of a broken signature scheme.
Forging digital signatures. Digital signatures allow software publishers, businesses, governments, and individuals to demonstrate that a message or document was signed using a particular private key. They also help verify the integrity and origin of software updates. A successful quantum attack on a vulnerable signature algorithm could undermine that assurance, potentially enabling counterfeit updates, forged documents, or fraudulent transactions where the affected signature system is trusted.
Exposing protected long-term information. Sensitive records may remain valuable for decades. Medical histories, intellectual property, diplomatic communications, financial records, and personal information can retain their value long after the original connection has ended. Data that appears safe today may therefore carry a future risk if its confidentiality depends on a cryptographic method that a later quantum computer can defeat.
These outcomes are possible consequences of specific cryptographic failures, not automatic results of building a quantum computer. Attackers would still need the right capabilities, data, access, and opportunity. Systems may also use multiple layers of protection, and breaking one component does not necessarily defeat every other safeguard.
The risk of “harvest now, decrypt later”
One of the most important reasons to prepare for quantum computing before a cryptographically relevant machine exists is the possibility of a harvest-now, decrypt-later attack.
In this scenario, an attacker collects encrypted information today and stores it for future analysis. If the information was protected using a vulnerable public-key key-establishment system, a sufficiently powerful quantum computer might later allow the attacker to recover the session secrets needed to decrypt the recorded traffic.
The attack does not require the attacker to understand or use the information immediately. It depends on the possibility that the data will remain valuable and that future technology will make decryption feasible.
This creates a different timeline for different kinds of information. A temporary message that loses its value after a few hours presents a different risk from confidential government plans, trade secrets, or medical information that must remain private for decades.
Organizations therefore need to consider not only how long their current encryption is expected to resist attack, but also how long the information must remain confidential. The longer that required confidentiality period, the more important it becomes to assess exposure to future cryptographic advances.
Not every intercepted connection can necessarily be decrypted later. Protocols that use forward secrecy, implementation details, and the attacker’s ability to collect the relevant traffic all affect the outcome. Nevertheless, the possibility of delayed decryption means that waiting until a powerful quantum computer is publicly demonstrated could be too late for some sensitive data.
Why quantum computers cannot break today’s encryption yet
A theoretical algorithm and a practical machine capable of running it are two different things.
Shor’s algorithm establishes that a sufficiently powerful quantum computer could undermine RSA and elliptic-curve cryptography. It does not establish that currently available quantum computers can break the key sizes used in real-world systems.
Qubits are fragile. Interactions with their surroundings, imperfect control operations, and measurement errors can corrupt quantum computations. These problems become particularly demanding when a calculation requires many operations to be performed reliably.
A useful cryptographic attack would generally require a large number of high-quality logical qubits and an enormous number of reliable quantum operations. A logical qubit is a more reliable unit of quantum information constructed from multiple physical qubits using quantum error correction. The physical resources needed to support one logical qubit can be substantial, and the requirements depend on the hardware, error rates, algorithm, and desired reliability.
Quantum error correction is therefore central to the threat. It uses carefully encoded information and repeated checks to detect and correct errors without simply measuring away the quantum information needed for the computation. The challenge is not merely to build a machine with many physical qubits, but to operate it reliably enough to complete an exceptionally demanding algorithm.
There is no dependable date for when a machine capable of breaking widely used cryptographic keys will exist. Estimates depend on technological progress and assumptions about hardware quality, error correction, architecture, and the resources an attacker could command.
The absence of a practical attack today should not be mistaken for proof that vulnerable algorithms will remain safe indefinitely. At the same time, claims that quantum computers can already break ordinary internet encryption exaggerate the capabilities of existing technology.
How cybersecurity is adapting to the quantum threat
The main defense is to replace vulnerable cryptographic methods with algorithms designed to resist attacks by both classical and quantum computers. This approach is known as post-quantum cryptography.
Post-quantum cryptography does not require a quantum computer. These algorithms run on conventional hardware but rely on mathematical problems for which researchers have not identified efficient quantum attacks. Their security rests on the best current understanding of those problems, supported by cryptanalysis and continuing research rather than a mathematical guarantee that no future attack can succeed.
In 2024, the U.S. National Institute of Standards and Technology finalized its first three principal post-quantum cryptography standards. They cover key establishment and digital signatures, two essential functions in modern security systems.
FIPS 203 specifies ML-KEM, a key-encapsulation mechanism based on structured lattice mathematics. A key-encapsulation mechanism allows parties to establish a shared secret using public information and private key material. ML-KEM was formerly known as CRYSTALS-Kyber.
FIPS 204 specifies ML-DSA, a digital-signature algorithm based on lattice problems, formerly known as CRYSTALS-Dilithium. FIPS 205 specifies SLH-DSA, a stateless hash-based digital-signature algorithm formerly known as SPHINCS+.
These standards provide established options for systems that need to move away from vulnerable public-key techniques. They do not mean that every application can switch algorithms instantly or that all migration questions have been solved. Implementations still need careful testing, secure key management, compatibility planning, and protection against ordinary software and operational vulnerabilities.
Migration is a major undertaking because cryptography is built into many layers of technology. An organization may depend on algorithms supplied by operating systems, cloud providers, hardware devices, network equipment, software libraries, and third-party vendors. Some devices are difficult to update, and some cryptographic uses are hidden inside systems that were not originally designed to accommodate new algorithms.
The transition therefore requires more than changing a setting. Organizations need to identify where vulnerable cryptography is used, determine which systems protect the most sensitive or long-lived information, and establish a practical replacement plan.
What individuals and organizations should do
For most individuals, the quantum threat does not call for abandoning online banking, avoiding encrypted messaging, or buying specialized security products. The most effective immediate protections remain the ordinary ones: keep software updated, use reputable services, enable multifactor authentication where available, and protect account recovery methods.
These measures address current threats such as phishing, credential theft, malicious software, and compromised accounts. Quantum-resistant encryption will not prevent someone from stealing a password through a fraudulent website or taking over an account through social engineering.
Individuals should also be cautious about products claiming to offer uniquely quantum-proof security without explaining the cryptographic methods they use. Security depends on sound algorithms, correct implementations, trustworthy key management, and a realistic threat model—not on quantum terminology in marketing.
Organizations responsible for sensitive data have more extensive obligations. They should inventory cryptographic systems, identify where RSA and elliptic-curve methods are used, determine which information must remain confidential for many years, and ask vendors about their post-quantum migration plans.
They should also distinguish between systems that use cryptography to protect stored data, systems that establish secure network connections, and systems that authenticate software or digital identities. These uses have different operational requirements and may need different migration schedules.
A further priority is cryptographic agility: the ability to replace cryptographic algorithms and keys without redesigning an entire system. Architectures that make algorithms difficult to change can turn a future security upgrade into a costly infrastructure project. Planning for replaceability can reduce that burden, although it does not eliminate the need for careful implementation and testing.
Some systems may use a hybrid approach during the transition, combining a conventional key-establishment method with a post-quantum method. When correctly designed, a hybrid system can preserve security if at least one of its components remains secure, subject to the protocol’s assumptions and implementation details. Hybrid deployment is not a universal solution, but it can help organizations transition while maintaining compatibility with existing infrastructure.
What is at risk—and what is not
Quantum computing poses a serious, specific challenge to modern cryptography. Its most consequential known threat is to public-key systems whose security depends on integer factorization or discrete logarithms. If sufficiently powerful, fault-tolerant quantum computers become available, those systems could no longer be relied on to provide their current level of protection.
That does not mean all encryption will stop working. Symmetric encryption such as AES, cryptographic hashes, and post-quantum algorithms face different mathematical risks. Many can continue to provide strong protection when appropriate algorithms and parameters are used.
Nor does the threat mean that every encrypted record will become readable, every digital signature will be forgeable, or every secure connection will be compromised. The consequences depend on the cryptographic system, how it is implemented, and what an attacker is trying to obtain.
The central challenge is timing. Building a quantum computer capable of breaking widely deployed public-key cryptography remains a substantial engineering problem, but cryptographic systems take years to replace across complex infrastructure. Sensitive information collected today may also need protection long after current algorithms become vulnerable.
The practical response is to prepare before the threat becomes immediate: develop and deploy quantum-resistant cryptography, preserve the ability to change algorithms, and prioritize data whose confidentiality must endure. Quantum computers need not defeat every form of encryption to change cybersecurity profoundly. They need only make some of the mathematical assumptions on which the digital world depends no longer safe.