Quantum Computers: What They Can and Cannot Break

Updated 8 November 2026 · Standard formula, shown below

Today’s quantum computers cannot break the encryption protecting ordinary internet traffic, bank accounts, or stored data at practical scale. A sufficiently large, fault-tolerant quantum computer could threaten widely used public-key systems such as RSA and elliptic-curve cryptography, but it would not automatically defeat every encryption method, password, or security measure.

What “breaking” encryption means

Modern digital security uses several kinds of cryptography, and quantum computers affect them differently. Public-key cryptography lets people establish trust or exchange keys using a public key and a related private key. RSA and elliptic-curve cryptography are common examples. Symmetric encryption, such as AES, uses a shared secret key to encrypt and decrypt information. Hash functions turn data into fixed-length digests and are used for integrity checks, signatures, and password storage.

“Break” can mean recovering a secret key, forging a digital signature, or finding a collision in a hash function. These are distinct tasks. A quantum algorithm that weakens one mathematical problem does not thereby solve all the others, and a theoretical speedup does not guarantee an attack that is feasible in practice.

Why Shor’s algorithm threatens RSA and elliptic curves

RSA security depends on the difficulty of factoring a large composite number. Elliptic-curve cryptography depends on the difficulty of a related discrete-logarithm problem. Classical computers are not known to solve these problems efficiently for properly chosen, sufficiently large keys.

Peter Shor’s quantum algorithm can solve both problems in polynomial time in an ideal, sufficiently powerful quantum computer. In principle, that means such a machine could derive an RSA private key from its public key, or recover an elliptic-curve private key from public information. Consequences could include decrypting captured communications, impersonating a server, or creating forged signatures.

The crucial qualifier is “sufficiently powerful.” A useful attack would require a large number of reliable, error-corrected logical qubits, built from many physical qubits, and the ability to run a long computation without errors overwhelming the result. Present-day machines do not meet the requirements for breaking ordinary large RSA or elliptic-curve keys. Estimates of the resources needed vary with hardware, error rates, and algorithm improvements; there is no single dependable countdown to a working attack.

What quantum computers can do to symmetric encryption and hashes

Grover’s algorithm offers a quadratic speedup for searching an unstructured set of possibilities. It does not make symmetric encryption instantly transparent. In an idealized comparison, searching a key space of size 2ⁿ takes about 2^n/2 quantum operations rather than 2ⁿ classical trials. That changes the security margin, but practical attacks also face hardware, error-correction, and implementation costs.

This is why larger symmetric keys provide a straightforward countermeasure. For example, AES-256 has a much larger key space than AES-128; even when discussing Grover’s theoretical advantage, the larger key retains a substantial brute-force margin. This is not a guarantee against every possible attack: weak passwords, stolen keys, software flaws, and poor configuration can still defeat encryption without solving its underlying mathematics.

Quantum search can also affect some hash-function security goals, including preimage search, but the exact impact depends on the task and the hash construction. Hashes are not simply “decrypted,” and collision resistance, preimage resistance, and password hashing are different properties. Choosing a suitable hash or password-hashing scheme remains important regardless of quantum computing.

What remains vulnerable even without a quantum attack

Quantum computing is not a universal key to digital systems. It does not automatically reveal a password, bypass multifactor authentication, defeat access controls, or exploit a software vulnerability. Attackers can often pursue easier routes: phishing, compromised devices, leaked credentials, misconfigured cloud storage, or theft of a signing key.

Cryptography also protects only the parts of a system that use it correctly. If an endpoint is infected or a secret is stored in plain text, the strength of the encryption algorithm may not matter. Likewise, quantum computers do not make encrypted data readable merely because it has been intercepted; an attacker still needs a viable method and the necessary resources.

Harvest now, decrypt later

A realistic long-term concern is “harvest now, decrypt later.” Someone could record encrypted traffic today and keep it in case a future quantum computer can decrypt data protected by vulnerable public-key key exchange. This matters most for information that must remain confidential for many years, such as sensitive personal, government, or commercial records.

The risk depends on the protocol and how keys are established. Replacing a public-key handshake with a quantum-resistant one can help protect future communications, but it cannot necessarily rescue old traffic that was recorded and whose key exchange can later be broken. Organizations therefore assess how long information needs protection, where public-key cryptography is used, and how difficult it will be to update systems.

Post-quantum cryptography and practical preparation

Post-quantum cryptography (PQC) uses algorithms designed to run on ordinary computers while resisting known attacks from both classical and quantum computers. It is different from quantum cryptography, which relies on quantum devices and communication channels. PQC is intended to be deployable in familiar software and networks.

NIST published its first principal post-quantum standards in 2024, including ML-KEM for key establishment and ML-DSA and SLH-DSA for digital signatures. Standards adoption is a transition, not an instant switch: systems must update protocols, libraries, hardware, certificates, and operational processes. Organizations should inventory cryptographic dependencies and follow authoritative standards and vendor guidance rather than inventing their own algorithms.

Identify where RSA and elliptic-curve key exchange or signatures are used, including devices and long-lived systems.
Prioritize information with long confidentiality requirements and systems that are difficult to replace.
Plan for tested migrations and interoperability; do not assume that adding a new algorithm automatically secures an entire system.
Continue using sound security practices, including strong key management, updates, and protection against credential theft.

Frequently Asked Questions

Can a quantum computer hack my bank account today?
No known quantum computer can practically break the public-key cryptography commonly used to protect banking systems. Account compromise is more likely to involve stolen credentials, phishing, malware, or other conventional weaknesses.

Can quantum computers break AES?
There is no known practical quantum method that simply breaks AES. Grover’s algorithm gives a theoretical quadratic search speedup, so key size matters; AES-256 retains a substantial margin against that kind of search.

When will quantum computers break RSA?
No one can state a reliable date. It would require a large, fault-tolerant machine capable of a sufficiently long computation, and estimates depend on technical assumptions that can change.

Should I stop using encrypted messaging?
No. Current encryption remains useful, and secure systems are transitioning toward post-quantum protections. Keep software updated and use reputable services; the possibility of future attacks is a reason to plan, not to abandon encryption.

Does quantum computing make passwords obsolete?
No. Quantum algorithms do not eliminate the need for authentication. Long, unique passwords, multifactor authentication, and secure password storage still help protect accounts against common attacks.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.