For most of us, encryption is something that quietly exists in the background.
You open WhatsApp, make an online payment, log into your bank account, push some code to GitHub, or simply visit a website using HTTPS. Somewhere underneath all of that, cryptography is making sure that the information moving between you and the server cannot easily be read or modified by someone else.
And for decades, this system has worked remarkably well.
The problem is that computers are changing.
Not just becoming faster in the usual way. We are developing an entirely different kind of computer — quantum computers.
If sufficiently powerful quantum computers become practical, some of the mathematics protecting today's internet may suddenly become much easier to solve.
That doesn't mean encryption is about to disappear.
It means encryption itself is going to change.
First, What Exactly Is Encryption?
Suppose I want to send you this message:
Meet me at 8 PM.
Sending it directly over an insecure network isn't ideal. Someone monitoring the connection could potentially read it.
Encryption transforms that readable information, called plaintext, into something that looks meaningless:
8f94a7c219b33d1e...
Only someone with the correct cryptographic key should be able to turn it back into:
Meet me at 8 PM.
Modern systems use several types of cryptography, but two broad categories are especially important.
Symmetric Cryptography
Both sides use the same secret key.
A well-known example is:
AES
AES is extremely fast, which makes it useful for encrypting large amounts of data.
The obvious problem is:
How do two people safely exchange the secret key in the first place?
That is where public-key cryptography becomes useful.
Public-Key Cryptography Changed the Internet
Public-key cryptography uses two keys:
Public Key Private Key
As the names suggest, the public key can be shared with everyone.
The private key must remain secret.
A simplified example might look like this:
Bob publishes: Public Key → Everyone can see it Private Key → Only Bob knows it
Alice can use Bob's public information as part of establishing secure communication.
This basic idea sits underneath technologies we use every day, including:
- HTTPS
- TLS
- SSH
- VPNs
- digital certificates
- software signatures
- secure messaging
- cryptocurrency wallets
- authentication systems
Two of the most important families of public-key cryptography are RSA and elliptic-curve cryptography (ECC).
They are secure because they depend on mathematical problems that ordinary computers find extremely difficult.
RSA, for example, relies heavily on the difficulty of factoring very large numbers.
Multiplying two large prime numbers is easy.
Going backwards and discovering those original primes can be extremely difficult when the numbers become large enough.
That difference is important.
Modern cryptography is often built around problems that are easy to perform in one direction but painfully difficult to reverse without additional information.
Then Quantum Computing Enters the Picture
A normal computer works using bits.
A bit has one of two states:
0
or
1
Quantum computers work with quantum bits, usually called qubits.
And qubits behave differently.
Through a property known as superposition, a quantum system can represent combinations of states rather than behaving exactly like a normal bit.
There are other important quantum effects too, including:
- superposition
- entanglement
- interference
You'll often hear the simplified explanation that a qubit is "0 and 1 at the same time."
That's useful for getting the basic idea, but it can also give the wrong impression.
A quantum computer isn't simply trying every possible answer simultaneously and magically returning the correct one.
Quantum algorithms have to manipulate probabilities and interference very carefully so that useful answers become more likely when the system is measured.
That's what makes quantum computing both fascinating and incredibly difficult to build.
Why Should Encryption Care?
Because certain problems that are incredibly expensive for classical computers can be attacked much more efficiently using the right quantum algorithm.
One algorithm in particular caused cryptographers to pay very close attention.
Shor's Algorithm
In 1994, mathematician Peter Shor introduced a quantum algorithm capable of efficiently solving mathematical problems related to:
- integer factorization
- discrete logarithms
Those terms may sound harmless.
Unfortunately, they happen to sit underneath a huge amount of modern public-key cryptography.
That includes systems based on:
RSA
and
ECC
So imagine we eventually build a large, reliable and error-corrected quantum computer.
An attacker may no longer need to attack RSA in the same way a conventional computer would.
Instead, a quantum algorithm could attack the mathematical foundation that makes the system secure.
And that's a much bigger problem.
Does That Mean Quantum Computers Can Break Everything?
No.
This is one of the biggest misconceptions around the subject.
You sometimes see headlines that make quantum computing sound like this:
Quantum computers will instantly break all encryption.
That's not really accurate.
Different cryptographic systems react differently to quantum attacks.
Public-key cryptography has the bigger problem
Algorithms such as RSA and ECC are particularly vulnerable because Shor's algorithm directly attacks the mathematical structures they depend on.
Symmetric encryption is in a better position
Algorithms such as AES face a different quantum threat.
One important algorithm here is Grover's algorithm.
Grover's algorithm can provide roughly a quadratic speedup when searching through possible keys.
Very loosely, a key space containing:
2^256
possibilities might offer security closer to searching something on the scale of:
2^128
under an idealized quantum attack.
That is still an absurdly large number.
So rather than abandoning symmetric encryption entirely, using sufficiently large keys gives us considerably more room to work with.
AES-256 isn't expected to suddenly become useless simply because quantum computers exist.
The bigger immediate migration challenge is public-key cryptography.
The Internet Has Another Problem: Old Data
Here's where the situation becomes more interesting.
Imagine someone intercepts encrypted internet traffic today.
They can't decrypt it.
So they simply save it.
Capture encrypted data ↓ Store it for years ↓ Wait for better quantum computers ↓ Try decrypting it later
This idea is commonly called:
Harvest Now, Decrypt Later
The attack isn't particularly useful for information that stops being valuable tomorrow.
But think about information that may remain sensitive for 10, 20 or even 30 years:
- government documents
- military communications
- medical records
- intellectual property
- corporate secrets
- research data
- long-term identity information
An attacker doesn't necessarily need a capable quantum computer today.
They only need to believe one may exist before the stolen information becomes worthless.
NIST specifically highlights this "harvest now, decrypt later" problem as one reason migration cannot simply wait until a cryptographically useful quantum computer exists.
So What Replaces RSA and ECC?
This brings us to one of the most important areas of modern cryptography:
Post-Quantum Cryptography
The name can be slightly confusing.
Post-quantum cryptography doesn't mean cryptography that runs on a quantum computer.
Most post-quantum algorithms are designed to run on the normal computers, phones, servers and processors we already use.
The difference lies in the mathematics.
Instead of depending on problems that quantum algorithms like Shor's can solve efficiently, researchers are developing systems based on other mathematical problems believed to be difficult for both classical and quantum computers.
Some approaches involve:
- lattice-based cryptography
- hash-based cryptography
- code-based cryptography
- multivariate mathematical problems
Among these, lattice-based cryptography has become particularly important.
We're Already Moving Toward Post-Quantum Encryption
This isn't just theoretical research anymore.
In August 2024, the U.S. National Institute of Standards and Technology (NIST) finalized its first three major post-quantum cryptography standards.
They include:
StandardAlgorithmMain PurposeFIPS 203ML-KEMKey establishmentFIPS 204ML-DSADigital signaturesFIPS 205SLH-DSADigital signatures
Let's simplify what those actually mean.
ML-KEM
ML-KEM stands for:
Module-Lattice-Based Key-Encapsulation Mechanism
It is based on the algorithm previously known as CRYSTALS-Kyber.
Its job is primarily to help two systems establish shared secret information securely.
In practical terms, technologies that currently depend on RSA or elliptic curves for parts of their key exchange process can eventually transition toward quantum-resistant alternatives such as ML-KEM.
NIST describes ML-KEM as its primary standard for this type of post-quantum key establishment.
ML-DSA
Encryption isn't the only thing we need cryptography for.
We also need to prove that information actually came from the person or organization claiming to have sent it.
That's where digital signatures come in.
ML-DSA stands for:
Module-Lattice-Based Digital Signature Algorithm
It is based on the system previously known as CRYSTALS-Dilithium.
Digital signatures are used everywhere.
For example, when your operating system downloads an update, a digital signature can help verify:
Yes, this update really came from the expected publisher. No, someone hasn't secretly modified it.
The same concept appears in software packages, certificates, secure communication and many authentication systems.
SLH-DSA
SLH-DSA takes a different approach.
It is based on hash functions rather than the same lattice structure used by ML-DSA.
Having fundamentally different cryptographic approaches is useful.
If researchers someday discover a serious weakness in one mathematical family, the entire ecosystem shouldn't depend on that single idea.
Cryptography tends to appreciate backup plans.
Especially when the backup plan may be responsible for securing half the internet.
Why Don't We Just Switch Tomorrow?
This part is easy to underestimate.
Changing a cryptographic algorithm isn't like updating a JavaScript package.
Cryptography appears deep inside infrastructure.
Consider how many systems depend on it:
Browsers Servers Operating systems Routers VPNs Banking systems Cloud platforms IoT devices Government systems Certificates Smart cards Mobile applications APIs Password managers Developer tools Hardware security modules
Now consider old systems that may remain deployed for 10 or 20 years.
Industrial equipment is a good example.
So are vehicles, embedded hardware and infrastructure systems.
Some devices cannot simply receive a software update.
Others may not have enough memory or processing power for newer algorithms.
Then there are compatibility problems.
Your browser may support post-quantum cryptography, but the server it connects to might not.
The server may support it, but a networking appliance sitting between the two might behave incorrectly.
Changing the cryptographic foundation of the internet is less like replacing an application and more like replacing parts of a bridge while traffic continues driving over it.
NIST is already encouraging organizations to inventory the cryptography they use and begin preparing for migration rather than waiting for a quantum computer to appear.
Hybrid Cryptography Could Make the Transition Easier
One practical approach is to combine old and new cryptographic techniques during the transition.
Imagine establishing a secret using:
Traditional Algorithm + Post-Quantum Algorithm
Instead of trusting only one system, the resulting connection can depend on both.
This gives engineers an interesting advantage.
Suppose the new post-quantum algorithm unexpectedly turns out to contain a weakness.
The traditional cryptography still contributes protection.
Now imagine the traditional algorithm eventually becomes vulnerable to quantum computers.
The post-quantum portion can still provide protection.
This kind of hybrid strategy gives the industry some breathing room while newer algorithms gain years of real-world testing.
And cryptographers love testing.
A cryptographic system isn't trusted simply because somebody publishes a clever-looking equation.
Researchers attack it.
Then other researchers attack it.
Then security engineers implement it and accidentally create entirely different problems.
Then more researchers attack those implementations.
Only after surviving years of criticism does confidence really start to build.
What About Quantum Encryption?
This is where two subjects are often mixed together.
There is:
Post-Quantum Cryptography
and there is:
Quantum Cryptography
They're not the same thing.
Post-quantum cryptography uses mathematical algorithms designed to resist attacks from quantum computers.
Quantum cryptography actually uses properties of quantum physics.
One famous example is:
Quantum Key Distribution
Quantum Key Distribution, or QKD, can use quantum states to help two parties establish secret keys.
One fascinating property of quantum mechanics is that measuring a quantum system can affect it.
That means certain types of interception could theoretically be detectable.
It sounds almost perfect.
But there are practical problems.
Quantum communication can require specialized hardware and infrastructure.
Post-quantum cryptography, on the other hand, can often be deployed through software across infrastructure we already have.
That's a huge advantage.
For most of the internet, the near-term answer is therefore much more likely to involve post-quantum algorithms than replacing every fiber cable with some giant quantum network.
Could Quantum Computers Actually Improve Security?
Interestingly, yes.
Quantum computing isn't purely an enemy of cybersecurity.
Quantum technologies could eventually contribute to areas such as:
- generating high-quality randomness
- quantum communication
- specialized security protocols
- scientific simulations
- discovering new materials
- optimization
- cryptographic research itself
The relationship between quantum computing and cybersecurity is therefore a little more complicated than:
Quantum computer = encryption destroyed
It's more accurate to say:
Quantum computers change which mathematical assumptions we can safely rely on.
And cryptography will evolve around those assumptions.
We've done this before.
Cryptographic algorithms have been replaced many times as computing power increased and weaknesses were discovered.
DES was once widely used.
Eventually, its key size became inadequate.
AES replaced it.
Hash functions have gone through similar transitions.
Security is never really a finished product.
It's a moving target.
Quantum computing is simply going to force one of the largest moves we've ever had to make.
When Will Quantum Computers Actually Break RSA?
This is probably the question everyone wants answered.
Unfortunately:
Nobody really knows.
Today's quantum machines are impressive research systems, but breaking widely deployed cryptography at meaningful scale would require machines far beyond simply having a few noisy qubits.
Real systems deal with:
- noise
- decoherence
- hardware errors
- control complexity
- error correction
- enormous physical resource requirements
A cryptographically relevant quantum computer would need to perform incredibly large computations reliably enough for algorithms such as Shor's to become practical against real-world keys.
That is a very different engineering challenge from demonstrating a small quantum algorithm in a laboratory.
Maybe major breakthroughs will happen faster than expected.
Maybe engineering challenges will delay them for decades.
Predictions vary enormously.
And that's exactly why the security industry can't base its strategy on guessing the correct year.
If migration takes years, waiting until someone announces:
"We finally built the computer capable of breaking RSA."
would be a terrible migration plan.
The Bigger Challenge Is Crypto Agility
There's another lesson hidden inside all of this.
Systems shouldn't be designed with the assumption that one cryptographic algorithm will remain secure forever.
Instead, software should be built with crypto agility in mind.
In simple terms:
Today's algorithm becomes weak ↓ Replace it without rebuilding everything
That sounds obvious.
In practice, many systems have cryptographic assumptions buried deep inside protocols, databases, certificates, hardware and application logic.
Quantum migration gives the industry an opportunity to fix that.
Future systems should make it easier to change cryptographic algorithms when necessary.
Because quantum computing probably won't be the last thing that forces us to replace one.
What Does This Mean for Regular Users?
Probably less than you might expect.
You aren't going to wake up one morning and manually replace the encryption algorithm on your phone.
Most of this transition will happen underneath the technologies you already use.
Browser developers will update TLS implementations.
Cloud providers will upgrade infrastructure.
Operating systems will introduce new cryptographic libraries.
Messaging applications will update their protocols.
Certificate authorities will support new signatures.
VPN providers will adopt new key-establishment mechanisms.
Ideally, the average user won't even notice.
You may someday update your browser and quietly gain protection against a class of computers that didn't practically exist when the browser was originally designed.
That's actually one of the beautiful things about good infrastructure.
The complicated parts disappear underneath the interface.
The Internet Isn't About to Become Unencrypted
Quantum computing often gets presented in dramatic terms:
Quantum apocalypse. The end of passwords. All encryption broken. Internet security destroyed.
The reality is much more interesting.
Yes, sufficiently capable quantum computers could seriously threaten some of today's most important public-key cryptographic systems.
That's a genuine security problem.
But cryptographers didn't suddenly discover this yesterday.
Researchers have spent years designing alternatives, attacking them, testing them and turning the strongest candidates into standards.
The first major post-quantum standards already exist and organizations are beginning the long migration toward them.
So the future probably isn't:
Quantum computers arrive ↓ Encryption dies ↓ Internet collapses
It's much more likely to look like:
Quantum computers improve ↓ Existing cryptography becomes risky ↓ Internet infrastructure gradually migrates ↓ Post-quantum cryptography becomes normal
And eventually we'll probably stop calling it post-quantum cryptography.
It'll just be cryptography.
Final Thoughts
One thing I find particularly interesting about this whole transition is that we're preparing defenses against a machine that doesn't fully exist yet.
Normally cybersecurity feels reactive.
Someone discovers a vulnerability.
Someone exploits it.
Then everyone starts patching.
Quantum computing gives us a rare opportunity to work in the opposite direction.
We know the mathematical threat.
We understand which technologies are vulnerable.
We already have candidate replacements.
And we have some time to deploy them.
How much time?
That's the part nobody can answer confidently.
But perhaps that's not the question that matters.
The better question is:
Can we rebuild the cryptographic foundations of the internet before quantum computers become powerful enough to make the old ones unsafe?
For the first time in decades, a large part of the technology world is quietly working on exactly that problem.
And most people using the internet will probably never notice the transition happening underneath them.