up:: Start Here MOC

What is technically happening to your data?

Every encrypted connection you make runs on 2 different kinds of encryption doing 2 different jobs. Only 1 of them is in danger, and understanding which is the whole story.

The vulnerable part is the opening moment, where your device and the far end agree on a shared secret while a stranger could be listening. The part that stays safe is everything after that, where the actual content gets scrambled using the secret they agreed on.

Someone recording your connection captures both parts together, in 1 file. Years from now, a machine that can break the opening moment recovers the shared secret, and the shared secret opens everything else in the recording.

The short version:

• A connection has 2 stages. The key exchange agrees on a secret. The bulk encryption uses it to scramble your content.
• The key exchange is the vulnerable stage, because it relies on public-key mathematics that a quantum computer can solve.
• The bulk encryption survives. The scrambling itself, usually AES, stays strong with a larger key.
• The recording contains both stages, which is why breaking the first one retroactively opens the second.
• The mathematics was published in 1994 by Peter Shor. What’s missing is a machine large enough to run it.
• Your password is a separate story, because most services store a fingerprint of it rather than the password itself.

What actually happens when you open an encrypted connection?

Six steps, and step 2 is the one that matters.

1. Your device contacts the server. It says which encryption methods it supports.
2. The 2 sides agree on a secret over an open line. This is called a key exchange, and it’s genuinely strange: your device and a server that have never communicated before produce an identical secret number, while somebody watching every message between them learns nothing. That works because of public-key mathematics, where a calculation is easy to perform and effectively impossible to reverse.
3. The server proves who it is. It presents a certificate, which is a document signed by an authority your device already trusts. The signature is checked using the same family of public-key mathematics.
4. The shared secret becomes a session key. A short-lived key used only for this connection.
5. Your content gets scrambled with that session key. This is symmetric encryption, almost always AES, and it’s a completely different kind of mathematics from steps 2 and 3.
6. The connection closes and the session key is discarded.

Steps 2 and 3 are the exposure. Step 5 is the part that holds.

Source: Shor, SIAM J. Computing 26(5), 1997; NIST IR 8105.

What does a quantum computer actually do to that?

It solves the 2 mathematical problems that steps 2 and 3 depend on, and it leaves step 5 nearly untouched.

The break. Public-key encryption rests on 2 problems being slow to solve: factoring a very large number back into the primes that produced it, and a related problem called a discrete logarithm. A conventional computer would need longer than the age of the universe on either one at real key sizes, and that slowness is the security. In 1994 Peter Shor published a method that lets a quantum computer solve both efficiently. Running it recovers the private key directly from the public key.

Source: Peter W. Shor, “Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer,” SIAM Journal on Computing 26(5), 1997, arXiv:quant-ph/9508027.

What survives. The scrambling in step 5 has no factoring problem hidden inside it, so Shor’s method finds nothing to work with. The only quantum attack against it is a general search speedup published by Lov Grover, and it’s far weaker: it roughly halves the effective strength of a key. NIST’s assessment is that this “does not render cryptographic technologies obsolete,” and that “doubling the key size will be sufficient to preserve security.” A 256-bit key drops to about 128 bits of strength, which stays comfortably out of reach.

Source: NIST, “Report on Post-Quantum Cryptography,” NISTIR 8105, April 2016, csrc.nist.gov.

The piece	What it does	What a quantum computer does to it
Key exchange (RSA, Diffie-Hellman, elliptic curve)	Agrees on a secret over an open line	Breaks it completely
Certificates and signatures	Proves the server is who it claims	Breaks them completely, allowing forgery
Bulk encryption (AES)	Scrambles your actual content	Halves the strength, which a larger key absorbs
Password fingerprints (hashing)	Stores proof of a password without the password	Halves the strength, which larger outputs absorb

Source: NIST IR 8105 (2016); NSA CNSA 2.0 FAQ.

Why does breaking it later still expose data from today?

Because the recording contains the key exchange.

An eavesdropper sitting on a network path copies the entire encrypted conversation, including step 2. They can’t read any of it at the time, and they don’t need to. What they’ve stored is a mathematically complete record: the key exchange that produced the session key, followed by everything that session key encrypted.

When a capable machine exists, they run it against the stored key exchange, recover the session key, and decrypt the rest of the recording. The reading happens in the future, and the exposure was created in the past, on the day you made the connection.

This has a name in the field: harvest now, decrypt later. Three agencies described it in a joint statement in August 2023, saying attackers “could be targeting data today that would still require protection in the future… using a catch now, break later or harvest now, decrypt later operation.”

Source: CISA, NSA, and NIST, “Quantum-Readiness: Migration to Post-Quantum Cryptography,” August 21, 2023, cisa.gov.

There’s a feature of modern connections worth understanding here, because it protects against a different attack and doesn’t protect against this one. Forward secrecy means each connection uses a fresh, temporary key exchange, so stealing the server’s long-term key later reveals nothing about past conversations. It’s a genuine improvement and it’s widely deployed. It doesn’t help here, because a quantum computer breaks the temporary key exchange itself rather than working backward from the long-term key.

What about my files sitting on a company’s servers?

A different arrangement, and it fails through a different door.

Stored data is normally scrambled with symmetric encryption, the kind that survives. The key that unlocks it is typically protected by a second key, which is protected by a third, and somewhere in that chain a public-key operation usually appears, especially when keys move between systems or when a service holds a copy on your behalf.

Two practical consequences:

1. A copy of encrypted stored data that includes the key-protection layer is exposed in the same way as recorded traffic. This is why stolen encrypted backups matter.
2. Data that never leaves a system and whose keys never travel is in a substantially better position, because the vulnerable operation may not appear in its chain at all.

The category that changes least is your password. Well-run services never store the password itself. They store a hash, a one-way fingerprint that can verify a password without revealing it, and hashing is on the surviving side. See Are my passwords at risk.

What can’t a quantum computer do to my data?

Four things worth stating plainly, because the popular version of this story overreaches.

• It can’t read data it never recorded. Breaking encryption in the abstract accomplishes nothing. Someone has to have captured your specific traffic and kept it.
• It can’t reach into your device. This attacks data in transit and data someone else copied, rather than the phone in your hand.
• It can’t break the scrambling itself. Modern symmetric encryption survives with a larger key, which is why the same agencies retiring public-key algorithms keep AES-256 in place.
• It can’t do any of this today. No machine capable of it exists. Estimates have moved sharply, from 20 million noisy qubits in a 2019 analysis to under 1 million in a 2025 revision, and the largest machines built so far are in the low thousands of noisy qubits.

Source: C. Gidney and M. Ekerå, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits,” Quantum 5, 433, 2021, arxiv.org; C. Gidney, “How to factor 2048 bit RSA integers with less than a million noisy qubits,” 2025, arxiv.org.

Questions people ask

So the padlock in my browser is meaningless? It’s accurate about what it claims, which is that this connection is encrypted right now against anyone reading it live. It makes no claim about whether a recording of it stays unreadable in 20 years.

If they recorded my traffic in 2015, is that at risk too? Yes, on the same mechanism, and older connections used weaker parameters. Whether anybody recorded your particular traffic is unknowable.

Does a VPN protect me from this? It moves the vulnerable point rather than removing it. Your traffic is encrypted to the VPN provider using the same kind of key exchange, so a recording of that connection has the same exposure.

Why can’t they just make the keys bigger? For the scrambling, they can, and that’s the fix. For the key exchange, larger keys make the quantum attack slower by a manageable amount rather than infeasible, so the mathematics has to change rather than the size.

What replaces it? New algorithms built on mathematical problems with no known efficient quantum solution. NIST finalized the first 3 on August 13, 2024, and they’re already deployed in Signal, iMessage, Chrome, and Firefox. See Did my phone already fix this.

How would I know if my data was recorded? You wouldn’t. Copying traffic breaks nothing and triggers nothing. See Will anyone tell me if it happens.

Is my old email at risk? If it crossed a network under the old key exchange and someone recorded it, yes. Mail sitting in a mailbox is a storage question rather than a traffic question.

Where to go next

• What of mine is worth stealing covers which of your data this actually matters for.
• Did my phone already fix this covers what’s already been replaced.
• When is this going to happen covers the timeline for the machine.
• Is this overhyped covers the strongest case against all of this.
• Start Here MOC is the full introductory route.

Go deeper into the technical detail

The technical layer: Shor’s Algorithm, Harvest Now, Decrypt Later (HNDL), What Can a Quantum Computer Actually Break, and TLS 1.3 Hybrid Key Exchange.

These open the Post-Quantum Field Guide, a separate site written for security professionals.

---

Last verified 2026-07-30 · Maintained by Addie LaMarr, LaMarr Labs.