The worry is simple: some of the quantum algorithms already known to researchers could, in theory, crack the encryption standards that protect nearly everything we do online. Governments, cybersecurity experts, and technology companies have begun sounding the alarm, not because the threat is here today, but because preparation takes time, and time may be shorter than many realise.
So is this a real and present danger, or a distant concern? The honest answer is: both – depending on who you are, what data you hold, and whether you start preparing now or wait. This article unpacks the science, the risks, the timelines, and most importantly what can actually be done about it.
What Is Encryption and Why It Matters
Encryption is the process of transforming readable data (called plaintext) into a scrambled form (called ciphertext) using a mathematical algorithm and a key. Only someone with the correct key can reverse the process and read the original data. There are two major families of encryption in widespread use today.
Symmetric Encryption (e.g., AES)
Symmetric encryption uses the same key for both encrypting and decrypting data. Think of it like a padlock where the same physical key both locks and unlocks it. The sender and receiver must both possess the same secret key — and keeping that key secret is everything.
Symmetric encryption is fast and efficient, making it ideal for bulk data. It’s used to protect stored files, encrypt hard drives, secure Wi-Fi networks, and protect data in transit once a secure channel has been established. When you encrypt a file on your laptop or connect to a VPN, symmetric encryption is almost certainly doing the heavy lifting.
Asymmetric Encryption (e.g., RSA, ECC)
Asymmetric encryption solves a fundamental problem: how do two parties who have never met securely exchange a secret key? The solution is to use two mathematically linked keys a public key and a private key.
Asymmetric encryption underpins almost every secure interaction on the modern internet: the padlock in your browser (HTTPS), encrypted email, code-signing certificates, cryptocurrency wallets, and digital signatures. When you visit a banking website, asymmetric encryption is used first to securely exchange a symmetric session key after which symmetric encryption takes over for speed.
What Is Quantum Computing?
Classical vs Quantum Computers
Classical computers the kind in your pocket and on your desk process information as bits, each of which is either a 0 or a 1. Everything a classical computer does, from loading a webpage to rendering a video, is ultimately built from these binary switches being flipped on and off millions of times per second.
Quantum computers use qubits (quantum bits). Thanks to the principles of quantum mechanics, a qubit doesn’t have to be just 0 or just 1 — it can exist in a combination of both states simultaneously. This property, called superposition, is the foundational difference that gives quantum computers their potential power.
Key Concepts (Simplified)
- Superposition means a qubit can represent 0 and 1 at the same time, until it is measured and “collapses” into one definite state. This isn’t simply a computer being uncertain it’s a genuine physical property of quantum systems. A system of n qubits in superposition can simultaneously represent 2ⁿ states, giving quantum computers the ability to explore a vast number of possibilities in parallel.
- Entanglement is a phenomenon where two or more qubits become correlated in such a way that the state of one instantly influences the state of the other, regardless of the physical distance between them. Entanglement allows quantum computers to coordinate information between qubits in ways that have no classical equivalent, enabling powerful computational shortcuts.
- Quantum speed advantage does not mean quantum computers are faster at everything. They are not general-purpose speed demons. Rather, for specific types of problems — particularly those involving searching through possibilities or finding patterns in mathematical structures — certain quantum algorithms can achieve exponential or polynomial speedups over the best known classical methods.
How Quantum Computing Threatens Encryption
Shor’s Algorithm and Public-Key Cryptography
In 1994, mathematician Peter Shor published a quantum algorithm, now called Shor’s Algorithm that can factor large numbers exponentially faster than any known classical algorithm. This is a direct and devastating threat to RSA encryption, whose security depends entirely on factoring being hard.
Shor’s Algorithm can also solve the discrete logarithm problem, threatening ECC in the same way. In practical terms: a sufficiently powerful quantum computer running Shor’s Algorithm could break a 2048-bit RSA key in hours or even minutes, rather than the billions of years a classical computer would need.
This is not a theoretical curiosity. It means that all asymmetric encryption currently protecting the internet such as HTTPS, email encryption, digital signatures, and cryptocurrency wallets could eventually be broken by a powerful enough quantum computer.
Grover’s Algorithm and Symmetric Encryption
For symmetric encryption, the threat is less severe but still significant. In 1996, Lov Grover published an algorithm that provides a quadratic speedup for unstructured search problems like searching for the correct encryption key.
Grover’s Algorithm doesn’t break symmetric encryption outright, but it effectively halves the key length in terms of security. This means:
- AES-128 would offer approximately 64 bits of effective security against a quantum attacker which is potentially achievable, and considered risky.
- AES-256 would offer approximately 128 bits of effective security that is still considered robust even in a quantum world.
The practical response is straightforward: migrate from AES-128 to AES-256 where not already done. Unlike the situation with public-key cryptography, symmetric encryption can be “quantum-hardened” simply by doubling the key length.
“Harvest Now, Decrypt Later” Risk
Perhaps the most underappreciated threat today is the “Harvest Now, Decrypt Later” (HNDL) strategy. Nation-state adversaries and well-resourced actors may already be collecting encrypted internet traffic, intercepting and storing data that is currently unreadable with the intention of decrypting it once quantum computers become capable enough.
This transforms quantum computing from a future problem into a present problem for anyone whose data has long-term sensitivity. Medical records, state secrets, intellectual property, legal documents, and confidential financial data that is encrypted and transmitted today could be exposed years or decades from now.
Any information that needs to remain confidential for more than a decade should be considered at risk if it is being transmitted using today’s asymmetric encryption.
What Would Happen If Encryption Breaks?
Impact on the Internet
The internet, as we know, depends on public-key cryptography. HTTPS, the protocol that secures every website you visit, uses asymmetric encryption to establish secure sessions. Online banking, e-commerce, social media logins, cloud services, and API communications would all be compromised.
If quantum-capable adversaries could break HTTPS in real time, they could silently intercept and modify web traffic, steal credentials at scale, impersonate legitimate websites, and conduct man-in-the-middle attacks with impunity.
Financial Systems and Cryptocurrencies
Online platforms that handle real money transactions including banking services, e-commerce platforms, and even online gaming sites, rely heavily on encryption to protect user data and financial activity. For instance, platforms like Pokies Australia highlight the importance of secure connections, fair play systems, and encrypted transactions to ensure user safety in digital environments. A break in public-key cryptography would expose transaction data and enable fraudulent authorisations.
Governments, Defense, and Privacy
Classified government communications, diplomatic cables, military orders, and intelligence data protected by today’s encryption would all be at risk from a sufficiently advanced quantum adversary. The geopolitical implications are severe: nations that achieve cryptographically relevant quantum computing first would gain an unprecedented intelligence advantage.
There are also significant civil liberties concerns. If private communications can be broken retroactively, the historical record of private individuals, journalists, dissidents, and activists becomes permanently exposed to any future government or actor with quantum capabilities.
Everyday Users
For ordinary individuals, a quantum break in encryption would mean exposed passwords, compromised cloud storage, readable private messages, and vulnerable email archives. Apps like Signal and WhatsApp, which use end-to-end encryption based on asymmetric cryptography, would no longer guarantee privacy without a migration to quantum-safe protocols.
How Close Are We to a Real Threat?
Current Quantum Capabilities
To run Shor’s Algorithm against a 2048-bit RSA key, researchers estimate that a quantum computer would need roughly 4,000 logical (error-corrected) qubits, which translates to millions of physical qubits given current error rates. Today’s most advanced quantum processors have hundreds to a few thousand physical qubits, with error rates far too high for cryptographic attacks.
No quantum computer today comes remotely close to breaking real-world encryption. The gap between current hardware and what would be required is enormous, not a matter of incremental improvement, but of fundamental engineering breakthroughs yet to be achieved.
The Race for Quantum-Safe Encryption
What Is Post-Quantum Cryptography (PQC)?
Post-quantum cryptography (PQC) — also called quantum-resistant or quantum-safe cryptography, refers to cryptographic algorithms designed to be secure against attacks from both classical and quantum computers. Crucially, PQC algorithms run on classical computers, meaning they can be deployed with today’s hardware.
The goal is to replace current public-key algorithms (RSA, ECC, Diffie-Hellman) with new algorithms whose underlying mathematical problems cannot be efficiently solved by Shor’s Algorithm or other known quantum methods. Research in this field has accelerated dramatically over the past decade.
Examples of Quantum-Resistant Algorithms
- Lattice-based cryptography is currently the most promising family of PQC algorithms. Lattice problems involve finding short or near-shortest vectors in high-dimensional geometric structures — problems believed to be hard for both classical and quantum computers. Algorithms like CRYSTALS-Kyber (for key exchange) and CRYSTALS-Dilithium (for digital signatures) are leading examples.
- Hash-based signatures use the properties of cryptographic hash functions — already considered quantum-resistant — to construct digital signature schemes. SPHINCS+ is a prominent hash-based signature algorithm. While typically larger in signature size than lattice-based alternatives, hash-based schemes have very well-understood security properties.
Should You Be Worried Right Now?
Short-Term Risk (Next 5 Years)
For the vast majority of individuals, the near-term risk is essentially zero. No quantum computer exists today that can break any meaningful encryption. The vulnerabilities discovered in this period will come from conventional threats — phishing, malware, weak passwords, unpatched software — not quantum attacks.
The one exception is the HNDL threat: if your personal data is highly sensitive and you need it to remain private for decades, even your current communications could theoretically be at risk from patient, well-resourced adversaries collecting encrypted traffic today.
Medium-Term Risk (5–15 Years)
This is the transition period where action becomes urgent at the institutional level. Organisations that have not migrated critical systems to PQC by the end of this window may find themselves rushing to patch vulnerabilities under pressure, or worse, caught unprepared when the first practically relevant quantum computers emerge.
For individuals, the risk begins to rise as more devices, services, and communications may be using legacy encryption that vendors have not yet upgraded. The quality of your software providers’ PQC migration plans increasingly matters.
Long-Term Risk (15+ Years)
If quantum computing reaches cryptographic relevance in this window, organisations that have not completed their PQC migrations will face severe exposure. Governments, enterprises, and critical infrastructure operators that have delayed transition will face costly, disruptive emergency remediation — or live with the consequences of broken encryption protecting their most critical systems.
Historical data from previous cryptographic transitions — such as the move from SHA-1 to SHA-256, or from DES to AES — shows that these migrations take 10 to 20 years to complete across all affected systems. That is precisely why the urgency is now, even though the threat is not immediate.
Who Should Be Most Concerned?
- Governments and defence agencies face the highest risk and the highest stakes — classified data, national security communications, and the HNDL threat make this an existential concern.
- Financial institutions and critical infrastructure operators (energy, water, healthcare, telecommunications) hold data and systems whose compromise would have cascading societal effects. Their migration timelines must be treated as strategic priorities.
- Enterprises holding long-lived sensitive data — intellectual property, legal and medical records, strategic plans — need to begin cryptographic audits now.
- Cryptocurrency holders and developers face unique exposure through the ECC-based wallet structure of most blockchain systems. Projects that do not migrate to quantum-safe signature schemes before a CRQC emerges risk catastrophic theft.
- Ordinary individuals have more time, but should stay informed, keep software updated, and choose privacy tools from vendors with credible PQC migration plans.
What Can You Do Today?
- Use strong encryption tools
- Keep all software updated.
- Use strong, unique passwords and a password manager.
- Be aware of what data you share
Conclusion
Quantum computing does not pose an immediate threat to ordinary individuals. Today’s quantum computers cannot break the encryption protecting your bank account, your messages, or your passwords. The threat that experts are responding to is a future one — real and credible, but measured in years and decades rather than days and weeks.
Should you be concerned? Yes — because concern drives the careful, sustained action this transition demands. Should you be panicking? No — because the timeline, while uncertain, gives us room to act. The threat is real. The response is underway. The question is whether organisations and individuals will engage with it seriously enough, and soon enough, to navigate the transition with their security intact.
