Will quantum computers break encryption? The press gives two opposite answers: that nothing is safe, and that it is all hype. Neither holds up well. A specific class of encryption is genuinely vulnerable in theory, a different class is mostly fine, and the machines that could do the damage do not exist yet. This article sets out what quantum computers can do, what they cannot, and what the people responsible for security are doing about it.

What kind of encryption is actually at risk?

Modern encryption has two broad families. Symmetric ciphers, such as the AES standard, use the same secret key to lock and unlock data. Public-key systems let two parties who have never met agree on a secret or verify an identity, and they rely on mathematical problems that are easy in one direction and hard in the other.

The public-key family is the target. RSA depends on the difficulty of factoring a huge number into primes. Diffie-Hellman and elliptic-curve schemes depend on related problems known as discrete logarithms. These are what protect the padlock in your browser, much of software updating, and many digital signatures.

Symmetric encryption sits in a different position, as a later section explains. The public-key layer is the one a sufficiently large quantum computer would put at risk.

What is Shor’s algorithm?

In 1994 Peter Shor described a method that lets a quantum computer find the prime factors of an integer in polynomial time, meaning the work grows modestly as the numbers get bigger. Classical computers are not known to be able to do this efficiently, which is the entire reason RSA works. The same algorithm can be adapted to solve the discrete-logarithm problems behind Diffie-Hellman and elliptic-curve cryptography.

The word “if” matters here. The attack requires a large quantum computer that runs without being overwhelmed by noise, and nobody has built one. Shor’s algorithm is a proven mathematical result about what such a machine could do. Whether and when the machine appears is an engineering forecast, not a mathematical fact.

How big a quantum computer would that take?

Estimates have fallen over the years, and that trend deserves attention. A 2021 paper by Craig Gidney and Martin Ekerå, based on work from 2019, estimated that factoring a 2048-bit RSA number would take about 20 million noisy qubits running for roughly eight hours. In May 2025, Gidney posted a new estimate: fewer than a million noisy qubits and less than a week. The saving came from better arithmetic tricks, a more efficient way of storing idle qubits, and a technique called magic state cultivation. The estimate assumes a square grid of qubits, an error rate of 0.1 percent per gate, and fast control electronics.

Another estimate in the literature puts the requirement at least 3 million physical qubits for a fully error-corrected trapped-ion machine factoring a 2048-bit number in about five months. These figures differ because the hardware assumptions differ. The common thread is that they are all enormous compared with today’s machines.

The largest commercial superconducting systems have scaled to around 2,000 qubits, but error rates for machines that large are reported around 5 percent, far above the 0.1 percent the optimistic estimates assume. Raw qubit counts are a poor guide. A million error-prone qubits would be useless; what counts is how many reliable ones you can build.

What has been factored so far?

Less than you might hope or fear. A 2019 team using an IBM quantum computer factored 15 and 21 but not 35. Those are numbers a child could factor by hand. Other demonstrations since 2001 have been published, but the reference I consulted says that none truly fulfilled the requirements of Shor’s algorithm. Several used circuits compiled with prior knowledge of the answer, and some simplified the algorithm so far that the result was equivalent to a coin flip.

So the record shows toy problems. That does not prove the bigger task is impossible. It does show that the gap between demonstrations and an attack on real keys is very large, and that headline claims about “factoring with a quantum computer” often need careful reading.

Do quantum computers make all encryption obsolete?

No. Grover’s algorithm gives a quantum computer a quadratic speedup when searching through possibilities, which is a real but modest advantage against symmetric keys. The standard countermeasure is simple: double the key length. A system aiming at 128 bits of security can use 256-bit keys.

This is why cryptographers worry about public-key systems far more than about AES. The same idea underlies the broader point that quantum computers are not faster at everything. They can solve any problem a classical computer can, but they add no power to solve undecidable problems, and for most everyday tasks they offer no benefit. Error correction overhead can also cancel out speedups. Some algorithms once seen as promising have been “dequantized,” meaning researchers found classical methods with similar speed. A 2023 summary stated that classical computers had outperformed quantum computers for all real-world applications to date.

What can quantum computers do well?

Researchers expect advantages in simulating physical systems, such as molecules and materials, and in a few specific mathematical tasks. Useful implementations of quantum simulation are still limited by hardware.

The famous supremacy demonstrations were real but narrow. In October 2019 Google and NASA claimed that Google’s 54-qubit Sycamore processor had completed a task more than 3 million times faster than the Summit supercomputer could; IBM disputed the claim, and later classical algorithms may have matched it. In December 2020 a Chinese photonic machine called Jiuzhang made a similar claim for a task known as boson sampling. These tasks were chosen to be hard for classical computers; they have no direct practical use.

Think of them as proofs that the machines work as physics predicts, rather than as steps toward breaking your bank’s website.

What is “harvest now, decrypt later”?

It is the main reason the timeline matters even though the machines are not here. An adversary who records encrypted traffic today could store it and decrypt it years later, once a quantum computer exists. For data that must stay confidential for decades, such as state secrets or some medical and legal records, the clock starts when the data is sent, not when the machine arrives.

Security researchers sometimes use a rule of thumb called Mosca’s theorem: if the years your data must stay secret plus the years your organisation needs to migrate exceed the years until a capable quantum computer, you are already late. The arithmetic is simple. The input that nobody can supply is the number of years until the machine exists.

The existence of actual programs that collect data this way is widely suspected but rumoured, and the reference I consulted describes it only as rumoured. It is reasonable caution rather than a documented fact.

Why not just use bigger keys?

It is a fair question, and the answer is that size alone does not rescue public-key systems. Shor’s algorithm runs in polynomial time, so making an RSA key longer makes the quantum attack only moderately harder, while it makes the legitimate use of the key slower for everyone. Keys would have to grow to impractical sizes to hold the line. That is why the field moved to different mathematics, not merely larger numbers. This is my summary of the standard reasoning, not a claim from a single source, so treat the details as general background.

What are people doing about it?

Cryptographers have spent years designing post-quantum algorithms that run on ordinary computers but rely on different mathematical problems that quantum machines are not known to solve quickly. In August 2024, after an eight-year effort, the US National Institute of Standards and Technology released its first three finalised standards: FIPS 203 (ML-KEM) for general encryption, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA), a backup signature scheme built on a different approach. In 2025 NIST announced plans to standardise a fourth algorithm, HQC, as a code-based backup for encryption. A further signature standard, FIPS 206 (FN-DSA), was still in draft in 2025, with final publication expected in late 2026 or early 2027.

NIST’s advice to organisations was to begin moving as soon as possible, because full integration takes time, and not to wait for later standards. Some experts predicted at the time that a machine capable of breaking current encryption could appear within a decade. That is a prediction, and other experts expect longer.

Companies are already acting. Apple announced in February 2024 that it aimed to move iMessage to a new post-quantum protocol, PQ3, by the end of 2024. NIST also published a draft planning document in November 2024 about moving away from quantum-vulnerable algorithms; I could not confirm its proposed deadlines, so I leave them out here.

Common questions

Can a quantum computer break encryption today?

No. As of 2026, quantum computers lack the power to break widely used cryptographic algorithms. The largest honest demonstrations have factored very small numbers.

What is post-quantum cryptography?

It is a set of encryption and signature methods designed to resist attack by quantum computers while running on ordinary hardware. They rely on mathematical problems that quantum machines are not known to solve quickly. NIST finalised the first three standards in August 2024.

Is AES-256 broken by quantum computers?

No. Grover’s algorithm reduces the effective strength of a symmetric key but not to a practical danger when keys are long enough. Doubling the key length counters it.

When will it happen?

Nobody knows. Estimates for the hardware have shrunk, yet the engineering of reliable, large-scale machines remains unsolved. Anyone quoting a precise year is guessing.

Should ordinary people do anything?

Mostly no action is needed beyond keeping software and devices updated, since browsers, operating systems, and messaging apps are the ones adopting new algorithms. Organisations that hold long-lived sensitive data have more reason to plan now.

What to remember

Shor’s algorithm threatens RSA and elliptic-curve cryptography on paper, and Grover’s algorithm only trims symmetric keys, which longer keys fix. The machines required would need hundreds of thousands to millions of reliable qubits, against a few thousand error-prone ones now. Standards for replacement algorithms exist since August 2024, and the migration is under way. The date a code-breaking machine arrives is unknown, which is exactly why preparation starts before it does.

Further reading

A popular history of codes and cryptography, useful background for the topic. See it on Amazon (affiliate link)

As an Amazon Associate I earn from qualifying purchases. A commission may be earned if you buy through this link, at no extra cost to you.

Sources