A sufficiently large and error-corrected quantum computer would break the public-key encryption that secures most of the internet, RSA, Diffie-Hellman and elliptic-curve cryptography, by running Shor's algorithm, which solves the factoring and discrete logarithm problems those systems depend on. It would not practically break AES-256 or the SHA-2 hash family, whose quantum weakening through Grover's algorithm leaves them secure. No such machine exists today and estimates of when one might range from a decade to much longer. The reason to act now is that encrypted data recorded today can be decrypted whenever the machine arrives.
Quantum computing and encryption is a subject where marketing, fear and genuine mathematics blur together. This guide separates them: which algorithms are threatened and which are not, how Shor's and Grover's algorithms work at the level of consequences, where quantum hardware actually stands, what harvest-now-decrypt-later means for your data, and the concrete steps that follow, with the migration itself covered in the post-quantum guides on this site.
Two kinds of encryption, two very different fates
Modern cryptography has two families, explained in the symmetric versus asymmetric guide on this site.
Public-key, or asymmetric, cryptography underlies key exchange and digital signatures: RSA, Diffie-Hellman, and elliptic-curve schemes such as ECDH and ECDSA. Their security rests on mathematical problems that are hard for classical computers, factoring large integers and computing discrete logarithms. Every HTTPS connection, VPN handshake, software update signature and messaging key exchange uses one of these to agree on keys or verify identity.
Symmetric cryptography does the bulk encryption once a key is agreed: AES and ChaCha20, and the hash functions such as SHA-256 that accompany them. Their security rests on there being no shortcut to trying every key.
Quantum computers threaten the first family severely and the second only mildly. That asymmetry shapes everything that follows.
Shor's algorithm: why public-key cryptography falls
In 1994 Peter Shor showed that a quantum computer could factor integers and compute discrete logarithms in polynomial time, exponentially faster than the best known classical algorithms. Factoring a 2048-bit RSA modulus classically would take longer than the age of the universe; on a large quantum computer running Shor's algorithm it would take hours or days. The same algorithm solves the discrete logarithm problem in both ordinary and elliptic-curve groups, so Diffie-Hellman and every elliptic-curve scheme fall with RSA. Increasing key sizes does not help meaningfully, because the quantum speedup is exponential. The RSA guide on this site explains what is being broken.
The consequence: an attacker with such a machine could derive private keys from public keys, forge signatures, and recover the session keys of any recorded TLS, VPN or messaging handshake that used these algorithms.
Grover's algorithm: why AES survives
Grover's algorithm, from 1996, speeds up brute-force search over N possibilities to roughly the square root of N steps. Against a symmetric cipher, that halves the effective key length: AES-128 offers about 64 bits of security against a quantum attacker, and AES-256 about 128 bits. 128 bits remains far beyond any feasible attack, and Grover's algorithm is difficult to parallelise, so practical quantum attacks on AES-256 are considered infeasible. Hash functions are affected similarly; SHA-256 retains ample margin. This is why AES-256 is the recommended choice for data that must stay secret for decades, as the AES-256 guide on this site notes, and why the quantum transition is about replacing public-key algorithms, not symmetric ones.
Where quantum hardware actually is
Quantum computers exist and are improving. Current machines have from tens to a few thousand physical qubits, which are noisy and lose their state quickly. Running Shor's algorithm against RSA-2048 requires thousands of logical qubits that are error-free for long computations, and each logical qubit requires many physical qubits for error correction. Published estimates of the physical qubits needed range from a few million to tens of millions with current error rates, though improvements in algorithms and error correction have steadily lowered the estimates. Demonstrations so far have factored only tiny numbers. Bridging the gap is a major engineering challenge with no guaranteed timeline; expert surveys assign a meaningful probability, not a certainty, to a cryptographically relevant quantum computer within ten to twenty years. Anyone claiming a specific date is speculating.
Harvest now, decrypt later
The reason to act before the machine exists is that encryption protects data over time. An adversary capable of recording encrypted traffic today, which well-resourced intelligence agencies do at scale, can store it and decrypt it once a quantum computer is available. Anything whose confidentiality must last beyond that date is already at risk: government and corporate secrets, medical and legal records, journalists' sources, personal archives, and long-lived credentials. This is called harvest now, decrypt later, and it means the deadline for quantum-safe key exchange is not when the machine arrives but when the machine arrives minus how long your data must stay secret. For much data, that deadline has passed, which is why the migration began years ago.
Signatures are different. A forged signature matters only at the time of verification, so signatures need to be quantum-safe by the time a machine exists, not before. Encryption and key exchange are the urgent part.
What is being done
Standards bodies have selected post-quantum algorithms based on problems believed hard for both classical and quantum computers, described in the post-quantum cryptography guide on this site. Browsers and major services already use hybrid key exchange, combining a classical elliptic-curve exchange with a post-quantum one so that both must be broken to recover the key, in a large share of TLS connections. Messaging apps including Signal and iMessage have deployed post-quantum key agreement. Governments have set migration timelines for their systems. The quantum-safe encryption guide on this site describes how these algorithms work, and the purpose guide explains why the migration matters beyond governments.
What you should do
For most people, the quantum threat is addressed by the infrastructure around them, and the practical steps are modest.
- Prefer AES-256 over AES-128 for files and disks that must stay confidential for a long time.
- Keep browsers, operating systems and apps updated; post-quantum key exchange arrives through ordinary updates and is already active in current browsers.
- Choose messaging and storage services that have deployed or committed to post-quantum protection.
- For long-lived secrets you control, such as archives encrypted to a PGP key, recognise that the key exchange is the weak point and re-encrypt with symmetric passphrases or post-quantum tools as they mature.
- Ignore products marketing quantum encryption for consumers; the quantum encryption guide on this site explains why.
- If you run systems for an organisation, inventory where public-key cryptography is used and follow the migration guidance in the post-quantum guides.
A five-point summary
- Quantum computers break RSA, Diffie-Hellman and elliptic curves via Shor's algorithm.
- They do not practically break AES-256 or SHA-256.
- No cryptographically relevant machine exists; the timeline is uncertain.
- Recorded traffic can be decrypted later, so long-lived secrets need quantum-safe key exchange now.
- The fix is post-quantum algorithms, already deploying through browsers, messengers and standards.
What standards bodies, researchers and vendors say
The assessment above follows public statements from the bodies leading the transition and the research literature.
National standards and security agencies state that a cryptographically relevant quantum computer would break currently deployed public-key algorithms, that symmetric algorithms at 256-bit key sizes remain secure, and that migration to standardised post-quantum algorithms should begin now because of the harvest-now-decrypt-later risk.
Quantum computing researchers publish resource estimates for breaking RSA-2048 that require large numbers of error-corrected qubits well beyond current machines, and describe the timeline as uncertain while noting steady progress in both hardware and algorithms.
Browser vendors and messaging providers have documented deployment of hybrid post-quantum key exchange in TLS and in messaging protocols, stating that the goal is to protect today's traffic against future decryption.
The threat is real, the timing is unknown, the response is under way
Quantum computers will break the public-key cryptography we rely on if they reach the necessary scale, and the data you encrypt today may still matter when they do. Symmetric encryption is safe, the replacements for public-key algorithms exist and are deploying, and your part is mostly to keep software current and choose services that are moving. The post-quantum guides on this site explain the algorithms taking over.
Frequently asked questions
Will quantum computers break encryption?
A sufficiently large, error-corrected quantum computer would break RSA, Diffie-Hellman and elliptic-curve cryptography, which protect key exchange and signatures across the internet, by running Shor's algorithm. It would not break AES-256 or SHA-256 in any practical sense. No such computer exists today, and building one is a major unsolved engineering problem.
Can a quantum computer break AES-256?
Not practically. Grover's algorithm gives quantum computers a square-root speedup on brute-force search, which reduces AES-256's effective strength to roughly 128 bits, still far beyond any conceivable attack. AES-128 would fall to about 64 bits of quantum security, which is why AES-256 is recommended for long-term protection.
How does a quantum computer break encryption?
Shor's algorithm, run on a quantum computer, factors large numbers and computes discrete logarithms in polynomial time, problems that take classical computers longer than the age of the universe at current key sizes. RSA's security rests on factoring and elliptic-curve cryptography's on discrete logarithms, so both collapse once such a machine exists.
When will quantum computers break encryption?
Nobody knows. Current machines have hundreds to a few thousand noisy qubits; breaking RSA-2048 is estimated to require millions of physical qubits with error correction. Expert surveys put meaningful probability on a cryptographically relevant machine within 10 to 20 years, which is why standards bodies are directing migration to post-quantum algorithms now.
Should I worry about quantum computers and encryption now?
If your data must remain confidential for a decade or more, yes, because encrypted traffic recorded today could be decrypted once a machine exists. For everyday use, the practical steps are to prefer AES-256, keep software updated so you receive post-quantum protocols as they roll out, and choose services that are adopting them.
Last reviewed and updated on . Plain text version: /encryption/will-quantum-computers-break-encryption.txt.
