What If Quantum Computers Broke All Modern Encryption?

This is a thought experiment, not a prediction. The internet runs on cryptography: every secure website, banking transaction, encrypted message, and authenticated software update depends on math problems that are trivial to set up but practically impossible to reverse on classical computers. Quantum computers running specific algorithms can, in theory, solve some of those problems exponentially faster. If a machine capable of doing this at scale existed today, the fallout would ripple through finance, government, and personal privacy within hours. The good news is that the threat is narrower — and slower — than "all encryption breaks at once."

Thought experiment. This article explores a hypothetical scenario for educational and speculative purposes. The events described are not predictions and should not be interpreted as warnings, advocacy, or instructions.

What encryption actually protects, and why it's breakable at all

Modern digital security rests on two different families of cryptography, and understanding the difference is the whole key to this thought experiment. Think of them as two separate locks on the same house: one lock guards the front door (letting the right people in), and the other locks every room inside (protecting what's in them once someone's already inside).

Asymmetric, or public-key, cryptography is the front-door lock. It lets two strangers — your laptop and your bank's server, say — agree on a shared secret over a public, untrusted network, and it lets a server prove it is who it says it is. It relies on math problems that are easy in one direction and brutally hard in the other:

• RSA relies on the difficulty of factoring the product of two very large prime numbers. Multiplying two 1,024-digit primes together takes a computer a fraction of a second; working backward from the product to find the original primes takes classical computers longer than the age of the universe for large enough keys.
• Elliptic curve cryptography (ECC) relies on a related but structurally different problem called the discrete logarithm, computed over points on an elliptic curve rather than over ordinary integers.
• Diffie-Hellman key exchange relies on the discrete logarithm problem in finite fields, and underlies how two parties agree on a session key without ever transmitting the key itself.

These three algorithms are the quiet infrastructure behind the padlock icon in your browser's address bar (TLS/HTTPS), email and code signing, VPN tunnels, and the public-key addresses that secure cryptocurrency wallets.

Symmetric cryptography is the room-by-room lock. Once two parties have agreed on a shared secret key (often using one of the asymmetric methods above), they switch to a much faster algorithm to encrypt the actual bulk data — the file, the video call, the database row.

• AES (Advanced Encryption Standard), adopted by NIST in 2001, is the default workhorse for almost everything: disk encryption, messaging apps, Wi-Fi (WPA2/WPA3), and cloud storage.
• ChaCha20 is a faster, simpler alternative used heavily in mobile TLS connections and modern VPN protocols like WireGuard.

The asymmetric/symmetric split matters enormously for this thought experiment, because quantum computers attack these two families in completely different ways — one catastrophically, one only mildly.

Cracking a 2048-bit RSA key with Shor's algorithm was estimated in 2021 to need roughly 20 million noisy physical qubits running for about eight hours. A 2019 estimate had put the figure closer to one billion qubits — the 50x drop in just two years shows how fast the resource estimates are still moving. ([Gidney & Ekerå, 2021](https://arxiv.org/abs/1905.09749))

Shor's algorithm: the reason public-key cryptography is the one that breaks

In 1994, mathematician Peter Shor, then at Bell Labs, proved that a sufficiently large quantum computer could factor integers — and solve the related discrete logarithm problem — exponentially faster than any known classical algorithm. This single result is the reason the entire cryptographic community has spent three decades preparing for quantum computers, years before anyone had built one capable of doing real damage.

Here's the intuition, without the linear algebra. Classical factoring algorithms essentially have to guess-and-check their way toward the prime factors of a huge number, and the number of guesses needed grows almost exponentially with the size of the number. Shor's algorithm instead uses a purely quantum trick — a "quantum Fourier transform" that exploits superposition to test many candidate periodicities in the number's structure simultaneously, then reads out the answer with a clever measurement. It's a bit like the difference between searching a library book by book for a name, versus somehow illuminating every page in the building at once and having the right page glow.

Resource estimates for how big a quantum computer would need to be to actually pull this off keep shrinking as algorithms improve. A widely cited 2021 paper by Google researcher Craig Gidney and Martin Ekerå estimated that breaking a 2048-bit RSA key — the standard strength for most secure websites today — would take about 20 million noisy physical qubits running continuously for roughly eight hours (arXiv:1905.09749). A follow-up 2025 analysis by Gidney pushed the estimate down further, to under a million physical qubits, thanks to smarter circuit designs (The Quantum Insider, 2025).

How does this compare with the quantum computers that actually exist?

IBM's largest single-chip superconducting processor, Condor, reached 1,121 physical qubits in December 2023 — the first to cross the 1,000-qubit mark (IBM Quantum Blog). Its newer Heron chips prioritize error rates over raw count, running at 156 qubits with far higher fidelity. None of today's machines does meaningful error-corrected computation at anywhere near the scale Shor's algorithm needs; existing qubits are "noisy," meaning they lose their quantum state (decohere) after microseconds to milliseconds, long before a cryptographically useful calculation could finish. The gap between "a thousand noisy qubits" and "a million reliable, error-corrected logical qubits" is closer to an engineering canyon than a gap.

When could a cryptographically relevant quantum computer actually exist?

There is no consensus date, but expert surveys and government agencies consistently put the risk window between roughly 2030 and 2050. The U.S. National Security Agency's CNSA 2.0 transition schedule assumes cryptographically relevant quantum computers could plausibly emerge within that period and requires all new National Security System equipment to run quantum-resistant algorithms by default starting January 1, 2027 (NSA CNSA 2.0 guidance, via Encryption Consulting).

Grover's algorithm: why symmetric encryption barely flinches

Quantum computers do not get a free pass against symmetric encryption like AES — there's a second quantum algorithm, discovered by Lov Grover in 1996, that applies here — but its effect is drastically smaller. Grover's algorithm searches an unsorted list (in this case, the space of all possible encryption keys) quadratically faster than brute force, not exponentially faster.

In practice, that means Grover's algorithm effectively halves the bit strength of a symmetric key, not the key length itself:

Table: how Grover's algorithm affects symmetric key security

Algorithm	Classical security	Quantum security (Grover's algorithm)	Practical verdict
AES-128	128 bits	~64 bits	Weak against a mature quantum attacker
AES-192	192 bits	~96 bits	Borderline; not recommended for long-term secrets
AES-256	256 bits	~128 bits	Still considered strong post-quantum
ChaCha20 (256-bit)	256 bits	~128 bits	Still considered strong post-quantum

Table: Grover's algorithm search speedup halves the effective security bits of symmetric ciphers, but AES-256 still lands at roughly the same quantum-resistant strength as AES-128 is today against classical computers.

The fix here is almost boringly simple: use longer keys. The U.S. National Security Agency's CNSA 2.0 suite specifies AES-256 as the mandatory symmetric standard for national security systems precisely because it comfortably clears the post-quantum bar without needing a new algorithm at all (Encryption Consulting, CNSA 2.0 overview). This is the clearest illustration in the whole quantum-encryption story of why "quantum computers will break all encryption" is an overstatement: one entire branch of cryptography needs nothing more dramatic than a longer password.

"Harvest now, decrypt later": the threat that is already happening

Here is the part of this thought experiment that isn't hypothetical at all. Even though no quantum computer today can break real-world RSA or ECC, intercepting and storing encrypted traffic costs almost nothing, and storage is cheap. Intelligence agencies, well-funded criminal groups, and state-sponsored actors don't need to break the encryption now — they just need to capture it now and wait.

US intelligence officials, along with counterparts in allied nations, have publicly confirmed that nation-state actors are actively collecting and archiving encrypted communications for future decryption once quantum capability matures — a strategy commonly called "harvest now, decrypt later" or "store now, decrypt later" (The Quantum Insider, 2026). Palo Alto Networks' threat intelligence unit describes the same pattern: adversaries intercept VPN traffic, TLS handshakes, and archived email, banking on the fact that a decade or two from now, a quantum computer will make the ciphertext readable (Palo Alto Networks, Cyberpedia).

This is why the risk calculation isn't really about "when will quantum computers exist" — it's about "how long does this specific piece of data need to stay secret." Think of it like a time-release safe: an attacker who steals the safe today doesn't need to crack it today, only before whatever's inside stops mattering.

The single most surprising fact in this whole scenario is not about quantum computers at all — it's that the attack is already underway, using nothing but ordinary internet surveillance. The "quantum" part hasn't even started yet.

Data with long shelf-life sensitivity is the highest-value target for this strategy:

• Military and intelligence communications, which can remain classified and damaging for 25 to 75 years
• Personal medical records, which are protected by law for decades and reveal permanently sensitive information
• Trade secrets, unpublished patents, and long-horizon business strategy documents
• Diplomatic cables and treaty negotiation records
• Any communication protected today by RSA or ECC key exchange without post-quantum hybrid protection

What is "harvest now, decrypt later" in one sentence?

It's the practice of collecting and storing today's encrypted data with the explicit intent of decrypting it once a quantum computer capable of breaking RSA or ECC becomes available, even if that's ten or thirty years away.

A hypothetical timeline: what would actually happen if it broke tomorrow

If a cryptographically relevant quantum computer existed today and was deployed against the internet at scale, the unraveling wouldn't be instant, but it would be fast by the standards of critical infrastructure.

Hour one. Any previously captured TLS handshake that used classical RSA or ECC key exchange (rather than a post-quantum hybrid) becomes decryptable, meaning archived web traffic, VPN sessions, and email from the "harvest now" stockpile is suddenly readable. Cryptocurrency wallets that have ever broadcast a transaction — which exposes their public key on-chain — become vulnerable to having funds drained, though wallets that have never spent (only received) remain protected by the hash-based address format used by Bitcoin and most major chains.

Day one. Financial exchanges detect anomalous authentication patterns and begin manually reviewing transactions. Major browser vendors and certificate authorities start emergency campaigns pushing already-developed post-quantum TLS configurations, which several — including Google, Cloudflare, and Apple — had already begun rolling out in hybrid form years earlier as a precaution (Cloud Security Alliance, 2024).

Week one. Cryptocurrency markets see severe volatility as confidence in wallet security wavers, prompting emergency migrations to post-quantum-safe address formats. Banks fall back on manual and out-of-band fraud verification for high-value transfers while automated systems are patched. Diplomatic and defense communications shift, where possible, to pre-shared physical keys and couriered material — the same fallback used during earlier eras of suspected cryptographic compromise.

Month one. The bulk of internet-facing infrastructure — browsers, operating systems, cloud providers — completes an emergency transition to post-quantum key exchange, largely because, as described below, most of that groundwork had already been laid years in advance. Old archives captured under "harvest now, decrypt later" campaigns are progressively decrypted, and a wave of historical data breaches surfaces: intellectual property, older classified material, and personal records once believed permanently secure.

Year one. Nearly all actively used systems have completed the migration to quantum-resistant algorithms. A messy transition period persists where legacy devices — older medical equipment, embedded industrial controllers, unsupported IoT hardware — remain stuck on vulnerable classical cryptography because they can't be remotely updated, creating a long tail of exposure that mirrors what happened with unpatched Windows XP machines years after its 2014 end-of-support date.

The realistic version of this scenario, worth repeating, is not an instant global collapse. It's closer to how a levee failure plays out: sudden in the headlines, but the water had been rising for years, and the people paying attention had already been reinforcing the parts most likely to give way first.

Post-quantum cryptography: the defense that's already three decades in the making

The reassuring half of this story is that cryptographers didn't wait for quantum computers to show up before building the replacement. Research into "post-quantum cryptography" (PQC) — algorithms designed to resist both classical and quantum attacks — dates back to the early 2000s, and NIST launched a formal public competition to standardize PQC algorithms in 2016.

That process concluded in August 2024, when NIST finalized its first three PQC standards, each based on math problems believed to be hard even for quantum computers (NIST/CSRC announcement, 2024; Federal Register, 2024):

• FIPS 203 (ML-KEM), based on the CRYSTALS-Kyber algorithm, standardizes key encapsulation — the quantum-safe replacement for Diffie-Hellman and RSA key exchange.
• FIPS 204 (ML-DSA), based on CRYSTALS-Dilithium, standardizes digital signatures.
• FIPS 205 (SLH-DSA), based on SPHINCS+, offers a conservative, hash-based signature scheme as a backup approach that doesn't rely on lattice math at all.

Most of these new algorithms rely on lattice-based cryptography, which bases its hardness on the difficulty of finding the shortest vector in an extremely high-dimensional lattice — a geometric structure so tangled that even a quantum computer's superposition trick doesn't offer a shortcut analogous to Shor's algorithm. It's the cryptographic equivalent of hiding a needle not in one haystack, but in a million-dimensional haystack where "distance" itself works differently than intuition suggests.

Not every candidate has survived scrutiny, which is itself a useful reminder that "post-quantum" is a design goal, not a guarantee. SIKE, an isogeny-based algorithm that had advanced deep into NIST's evaluation process, was broken in 2022 — not by a quantum computer, but by an ordinary laptop running a classical mathematical attack that exploited a structural weakness researchers had missed for years. It's a sobering case study: a scheme can be "quantum-resistant" in the specific sense of resisting Shor's algorithm and still fall to a completely different, classical insight.

How is the migration to post-quantum cryptography actually going?

It's underway but staggered by sector. Google, Cloudflare, Apple, and Signal have already deployed hybrid post-quantum key exchange (combining a classical algorithm with a PQC one for defense in depth) in production. The U.S. government's CNSA 2.0 timeline requires new national security equipment to be compliant by January 1, 2027, software and firmware signing to run exclusively on CNSA 2.0 by 2030, and web browsers, cloud platforms, and operating systems to complete the transition by 2033 (QuSecure, CNSA 2.0 timeline breakdown).

Why does NIST recommend "hybrid" encryption during the transition?

Because post-quantum algorithms are newer and less battle-tested than RSA or ECC, which have survived nearly three decades of attacks. Hybrid schemes run a classical and a post-quantum algorithm side by side, so an attacker has to break both to succeed — protecting against a quantum breakthrough without abandoning decades of classical cryptanalysis confidence.

Where quantum computing actually stands today, and why the panic headlines outrun the hardware

It's worth being specific about the gap between "quantum computer exists" and "quantum computer that threatens your bank." IBM's roadmap illustrates the distinction well. Condor, unveiled in December 2023, packed 1,121 physical qubits onto a single chip — a milestone crossing, but one built from noisy, error-prone qubits with no error correction (IBM Quantum Blog, 2024). IBM's subsequent Heron generation deliberately traded raw qubit count for much lower error rates, because for real cryptographic attacks, reliability matters more than headline qubit numbers. The company's public roadmap targets a large-scale, fault-tolerant quantum computer around 2029 (Forbes/Moor Insights, 2025) — and even that machine would still be well short of the roughly one million high-quality physical qubits current estimates suggest are needed to break RSA-2048. Another quantum-related thought experiment is what if we could teleport matter.

The comparison worth holding onto: today's most advanced quantum computers have roughly one-thousandth of the raw qubit count that even the most optimistic recent estimate says is needed to threaten RSA-2048, and none of them have the error-correction maturity to sustain a computation that would take real quantum hardware hours to complete. That's not a reason for complacency — it's a reason the 2027–2035 policy deadlines exist at all: the transition is being timed to finish comfortably ahead of the hardware, not in a scramble after it arrives.

What people get wrong about "quantum breaks encryption"

The most common misunderstanding is treating quantum computing as a single dial that, once turned high enough, breaks every digital lock simultaneously. In reality, it's two distinct algorithms with two very different blast radii: Shor's algorithm is a specialized key that fits exactly one class of locks (integer factoring and discrete logarithms), while Grover's algorithm is a blunt, modest speedup that applies more broadly but barely dents anything with a sufficiently long key.

A second common error is assuming quantum computers need to be "generally intelligent" or broadly powerful the way people imagine artificial general intelligence. They don't. A quantum computer capable of running Shor's algorithm at cryptographic scale could still be useless at most other computational tasks — quantum advantage is deeply problem-specific, and the same machine that factors a 2048-bit number might offer no benefit whatsoever for, say, optimizing a delivery route or training a neural network.

A third misconception is that the threat is purely theoretical and therefore not urgent. That's backward. The theoretical breaking of RSA is decades away by most estimates, but the practical risk — data being harvested today for future decryption — is already documented and already running. Waiting for the quantum computer to arrive before migrating to post-quantum cryptography means the data you're protecting right now is already exposed for anything with a multi-decade shelf life.

Finally, people often assume "quantum-resistant" means "unbreakable forever." It doesn't. SIKE's 2022 collapse shows that a scheme judged resistant to quantum attack can still fail to a classical one nobody anticipated. Cryptography has never offered permanent security — only security that's currently unbroken and believed hard to break, revisited continuously as the field learns more.

Frequently asked questions

Q: Can quantum computers break encryption right now, in 2026? A: No. No existing quantum computer has the scale or error-correction maturity to break real-world RSA, ECC, or AES encryption. The largest chips have around 1,000 to 1,400 physical qubits, while breaking 2048-bit RSA is estimated to require on the order of one million reliable physical qubits, per recent resource estimates.

Q: Which type of encryption is most at risk from quantum computers? A: Public-key (asymmetric) cryptography — specifically RSA, elliptic curve cryptography, and Diffie-Hellman key exchange — is the most vulnerable, because Shor's algorithm solves the exact math problems these schemes depend on exponentially faster than classical computers can.

Q: Is AES encryption safe from quantum computers? A: Largely, yes, if the key length is long enough. Grover's algorithm only provides a quadratic speedup against symmetric ciphers like AES, effectively halving the security bits. AES-256 is widely considered quantum-resistant for the foreseeable future; AES-128 is not recommended for data that needs to stay secret for decades.

Q: What does "harvest now, decrypt later" mean, and is it really happening? A: It refers to adversaries capturing and storing encrypted data today with the intent of decrypting it once quantum computers mature. US and allied intelligence agencies have publicly stated that nation-state actors are already conducting this kind of collection at scale, making it a present-day risk rather than a future one.

Q: What has NIST actually standardized for post-quantum cryptography? A: In August 2024, NIST finalized three standards: FIPS 203 (ML-KEM, for key exchange, based on CRYSTALS-Kyber), FIPS 204 (ML-DSA, for digital signatures, based on CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, a hash-based signature scheme based on SPHINCS+).

Q: How many qubits would it take to break RSA-2048 encryption? A: Estimates have shrunk quickly as algorithms improve. A 2021 analysis by Google's Craig Gidney and Martin Ekerå put the figure at roughly 20 million noisy physical qubits running for about eight hours; a 2025 refinement by Gidney lowered that to under one million physical qubits.

Q: Are Bitcoin and other cryptocurrencies vulnerable to quantum attacks? A: Partially. Wallets that have never broadcast a transaction are protected because their address is a cryptographic hash of the public key, not the key itself, and hashing is far more quantum-resistant. Wallets that have spent funds expose their raw public key on the blockchain, making them theoretically vulnerable to a mature quantum attacker running Shor's algorithm.

Q: Was any "post-quantum" algorithm ever actually broken? A: Yes. SIKE, an isogeny-based algorithm that had advanced far into NIST's standardization process, was broken in 2022 using a classical (non-quantum) mathematical attack on ordinary computer hardware. It's a reminder that "post-quantum" describes resistance to a specific quantum algorithm, not an absolute security guarantee.

Q: What's the realistic timeline before quantum computers threaten today's encryption? A: Most expert estimates place cryptographically relevant quantum computers somewhere between 2030 and 2050. Government timelines reflect that uncertainty: the NSA's CNSA 2.0 policy requires new national security systems to run quantum-resistant algorithms by January 1, 2027, with full transitions for operating systems and cloud platforms mandated by 2033.

The takeaway

Quantum computers breaking "all" encryption is a myth built from a real and serious threat. Shor's algorithm genuinely does put RSA, elliptic curve cryptography, and Diffie-Hellman on a collision course with obsolescence, but symmetric encryption like AES-256 survives the quantum era largely intact simply by using long enough keys. The part of this story that deserves real attention isn't a future event at all: encrypted data is being harvested and archived today, specifically so it can be decrypted once quantum computers catch up, which makes the migration to NIST's 2024 post-quantum standards a present-tense project, not a future contingency. The transition won't be instant or painless, but unlike most infrastructure crises, this one is being addressed years ahead of the hardware that would trigger it.

---

Read next:

• What If AI Became Smarter Than All Humans Combined?
• What If the Internet Disappeared Tomorrow?
• What If We Could Upload Human Consciousness?