Can quantum computers break encryption?
The short answer
Not yet. A large, error-corrected quantum computer running Shor's algorithm could break the public-key encryption that protects most internet traffic today, such as RSA and elliptic-curve cryptography. No existing quantum computer is anywhere near big or reliable enough. Symmetric encryption such as AES is far less affected, and new post-quantum standards are already being rolled out.
Learn this step by step in the Quantum Cryptography course, in the free Q-Learn app. Get it on Google PlayGet Q-Learn
What is at risk
Most secure communication uses public-key cryptography to agree on keys and to sign messages. The main systems are RSA, which depends on factoring being hard, and elliptic-curve cryptography (ECC), which depends on a related problem called the discrete logarithm.
Shor's algorithm solves both efficiently on a large enough quantum computer. That machine could:
- read past and future traffic protected by RSA or ECC key exchange,
- forge digital signatures, including those used for software updates and many cryptocurrencies, such as the elliptic-curve signatures used by Bitcoin and Ethereum.
What is mostly safe
Symmetric encryption such as AES, used to encrypt the actual data once a key is agreed, is in much better shape. The best known quantum attack, Grover's algorithm, gives only a square-root speedup, and it is hard to run in parallel. AES with 256-bit keys is considered safe against quantum computers. Hash functions such as SHA-256 are similarly robust.
How far away is the threat?
Nobody knows. Breaking a 2048-bit RSA key needs a fault-tolerant quantum computer with error correction. A 2025 estimate from Google's Craig Gidney put it at under a million noisy physical qubits running for under a week, much less than earlier estimates. Today's largest machines have at most a few thousand physical qubits and are still far too error-prone. Estimates for when the gap closes range from around a decade to much longer.
Be wary of headlines claiming RSA has been broken. So far, quantum computers have only factored tiny numbers with Shor's algorithm.
"Harvest now, decrypt later"
There is a reason to act before a quantum computer exists. An attacker can record encrypted traffic today and store it, hoping to decrypt it once a big enough machine is built. For data that must stay secret for many years, such as medical records, state secrets and long-term business plans, the risk starts now.
Post-quantum cryptography
The fix is post-quantum cryptography (PQC): new public-key algorithms based on maths problems that are believed to be hard even for quantum computers. They run on ordinary computers, so no quantum hardware is needed to use them.
In August 2024, the US National Institute of Standards and Technology (NIST) published its first three PQC standards:
- ML-KEM (based on CRYSTALS-Kyber), for agreeing on keys,
- ML-DSA (based on CRYSTALS-Dilithium), for digital signatures,
- SLH-DSA (based on SPHINCS+), a hash-based signature scheme.
Adoption is already under way. Major web browsers and services such as Cloudflare use hybrid key exchange that combines a classical algorithm with ML-KEM, and messaging apps including Signal and iMessage have added post-quantum protection.
Quantum key distribution is something different
Quantum key distribution (QKD) uses quantum physics itself, typically single photons, to share a secret key. Measuring a quantum state disturbs it, so an eavesdropper introduces errors that the two parties can detect. The best-known protocol, BB84, dates from 1984. QKD needs special hardware and dedicated links, so it complements PQC rather than replacing it.
The bottom line
Your messages are not at risk from quantum computers today. But the switch to post-quantum cryptography is one of the largest upgrades the internet has ever had to make, and it is happening now, years before the threat arrives.