Can a quantum computer break encryption?
Not today. But a sufficiently large, error-corrected quantum computer could break the methods that exchange keys on the internet today, such as RSA. That is why the switch to quantum-safe encryption is already under way. Symmetric methods such as AES with long keys, on the other hand, are still considered secure.
Two kinds of encryption
On the internet, two methods usually work together. With a public-key method such as RSA or elliptic curves, two devices agree on a shared secret key. A symmetric method such as AES then uses this key to encrypt the actual data.
For quantum computers, these two parts are very different in difficulty.
Shor: the danger for RSA and similar methods
RSA relies on the fact that ordinary computers practically cannot split very large numbers into their factors. In 1994 Peter Shor showed that a quantum computer can do exactly this efficiently. The same applies to methods based on elliptic curves.
How large the quantum computer would have to be is estimated ever more precisely. A paper by Craig Gidney from May 2025 arrives at fewer than one million noisy qubits and a run time of under a week for 2048-bit RSA. The largest devices today have around a thousand qubits, and these are considerably noisier than assumed there. The gap is still large, but it is shrinking.
Grover: little danger for AES
Against symmetric methods such as AES, a quantum computer only has Grover’s quantum search. Its advantage is quadratic: a 128-bit key would then have roughly the strength of 64 bits against an ordinary computer, a 256-bit key still about 128 bits. On top of that comes the enormous effort of running Grover error-free over so many rounds.
Anyone who wants to protect data for a very long time therefore uses 256-bit keys. Grover’s algorithm is no reason to panic about AES.
Store now, decrypt later
So why act now? Anyone who records encrypted data today could decrypt it later as soon as a suitable quantum computer exists. For data that must stay secret for many years, such as health, business or state secrets, this is already a risk today.
The US standards agency NIST therefore published the first three standards for quantum-safe encryption on 13 August 2024. Some services already use such methods, for example Apple in iMessage since 2024. Usually a classical and a quantum-safe method are combined, so that the connection stays secure as long as one of them holds.
Try the principle safely
On Qubitwerk you can see how a quantum search finds a code without anything real being cracked. You set a test code yourself on the virtual combination lock, and our simulator searches for it with 24 qubits.
Try it: does the quantum search find your code? Frequently asked questions about quantum computers and encryption
Can a quantum computer break encryption today?
No. According to current estimates, this would require much larger and error-corrected quantum computers than exist today.
Which encryption is at risk from quantum computers?
Mainly public-key methods such as RSA and elliptic curves, which are used to exchange keys and create signatures. Shor’s algorithm could break them with a sufficiently large quantum computer.
Is AES safe from quantum computers?
With long keys, yes. Grover’s quantum search only speeds up trying keys quadratically. For very long protection, AES with 256 bits is recommended.
What is post-quantum cryptography?
Encryption methods that run on ordinary computers but are designed to be secure against quantum computers as well. NIST published the first three standards for them in August 2024.
What does “store now, decrypt later” mean?
Attackers could collect encrypted data today and decrypt it later with a quantum computer. Data that must stay secret for a long time should therefore be protected with quantum-safe methods early.
- What is a quantum computer? Explained simply
- What is a qubit?
- Superposition explained simply
- Entanglement explained simply
- Grover’s algorithm explained
- Quantum computer simulator
Sources
- Peter W. Shor: Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer (1994/1995)
- Craig Gidney: How to factor 2048 bit RSA integers with less than a million noisy qubits (arXiv, May 2025)
- NIST: First 3 Finalized Post-Quantum Encryption Standards (13 August 2024)
- Apple Security Research: iMessage with PQ3 (February 2024)
- Lov K. Grover: A fast quantum mechanical algorithm for database search (Bell Labs, 1996)
As of 31 October 2026
Watch a quantum search.
Set your own test code on the combination lock. No real lock, no real data. No sign-up.