The useful answer is not a year. Quantum computers cannot break the encryption protecting ordinary internet traffic today, and nobody can responsibly name the day when that changes. What security teams can see is a mismatch in timing: a capable machine may still be years away, but replacing vulnerable cryptography across governments, banks, cloud services, devices, and software supply chains also takes years.
That is why the migration has already begun. The deadline is set by how long data must stay secret and how slowly real systems can change—not by a public demonstration of broken RSA.
Quantum does not threaten every lock in the same way
Secure internet connections usually combine two families of cryptography. Symmetric encryption uses the same secret key on both sides and efficiently protects the bulk of a conversation. Public-key cryptography lets parties that have never met establish secrets and verify identities. RSA and elliptic-curve cryptography are widely used examples of the second family.
A sufficiently powerful quantum computer running Shor’s algorithm could solve the mathematical problems that make RSA and elliptic-curve systems secure. That would endanger key exchange, certificates, and digital signatures—the mechanisms that establish trust before symmetric encryption protects the data.
Symmetric encryption faces a different quantum attack. Grover’s algorithm can reduce the effective strength of a brute-force search, but it does not dismantle the scheme as dramatically as Shor’s algorithm dismantles RSA. Larger keys are the practical response; AES-256 is commonly treated as providing a strong margin against known quantum attacks.
The distinction matters. “Quantum breaks encryption” sounds as if one machine will suddenly decode every protected file. The narrower and more urgent problem is the public-key layer that authenticates systems, exchanges keys, signs software, and authorizes transactions.
Shor’s algorithm changes the hard part
RSA depends on an imbalance: multiplying two large prime numbers is easy, while recovering those primes from their product is extremely difficult for an ordinary computer. Elliptic-curve cryptography relies on another one-way mathematical problem. Classical machines know the rules but cannot efficiently reverse the calculation at useful key sizes.
Shor’s algorithm uses quantum operations to expose hidden periodic structure in those problems. It is not a machine trying every possible key at once. Quantum states can hold many possible outcomes, but measurement does not reveal all of them. The algorithm must arrange interference so that unhelpful possibilities cancel and evidence about the hidden pattern becomes more likely to appear.
For a gentler explanation of that machinery, see Qubits Explained Without the Math. The important point here is that the attack is mathematically credible even though the required hardware does not yet exist.
Today’s qubit counts are not attack capacity
Real qubits are noisy. Heat, imperfect control, manufacturing variation, and interactions with the environment introduce errors. Factoring a real RSA key would require an enormous sequence of operations to remain reliable from start to finish.
Quantum error correction addresses that problem by building a dependable logical qubit from many imperfect physical qubits. The overhead depends on the hardware, error rates, operation speed, connectivity, and correction method. A headline announcing thousands—or even a million—physical qubits therefore says little by itself about whether the machine could sustain a cryptographic attack.
Resource estimates make this concrete. A 2025 analysis by Craig Gidney described a design that could factor a 2,048-bit RSA integer in under a week using fewer than one million noisy qubits under stated assumptions. That was a major reduction from an influential earlier estimate of roughly 20 million noisy qubits and an eight-hour run. It was not a forecast that any machine with a million qubits will break RSA. It showed that better algorithms and error-correction designs can lower the target while hardware developers work from the other direction.
This is also why quantum processors are better understood as specialized accelerators than replacements for ordinary computers. The broader limits are explained here.
The risk can arrive before the computer
Some encrypted data loses value quickly. Other information—medical records, military plans, diplomatic traffic, industrial designs, legal files—may need to remain confidential for decades. An attacker can record encrypted traffic now and store it until a future machine can recover the old secrets. This is known as harvest now, decrypt later.
The planning question is therefore not simply “When will the machine exist?” It is: how long must the data remain secret, how long will migration take, and how long might the quantum breakthrough take? If the first two periods together extend beyond the third, waiting creates exposure today.
Digital signatures add another concern. Recovering a vulnerable signing key could let an attacker impersonate a service, forge a certificate, authorize a transaction, or make malicious software appear trusted. The damage depends on the protocol and on whether old keys, certificates, and signatures can be retired safely.
Post-quantum cryptography runs on normal computers
In 2024, NIST finalized its first three major post-quantum standards: ML-KEM for establishing shared secrets, plus ML-DSA and SLH-DSA for digital signatures. Despite the name, these algorithms do not require a quantum computer. They are designed to run on ordinary servers, phones, laptops, and network equipment while resisting the best known classical and quantum attacks.
Migration is still difficult because cryptography is embedded in browsers, certificates, cloud platforms, payment systems, secure chips, vehicles, industrial equipment, archives, and software-signing pipelines. Some devices can be updated; others must be replaced. Connected systems also need compatible changes without breaking communication.
Large organizations are being given staged targets. The UK’s National Cyber Security Centre recommends completing discovery and planning by 2028, migrating high-priority systems by 2031, and finishing by 2035. A June 2026 US order set a December 31, 2030 target for post-quantum key establishment in high-value and high-impact federal systems. These are risk-management dates, not claims that RSA will fail in 2030 or 2035.
Hybrid deployments can combine a familiar classical method with a post-quantum one during the transition. Crypto agility matters too: organizations need to know where algorithms live and be able to replace them without rebuilding every system. One live example is NEAR’s optional post-quantum wallet signature support, which shows what migration can look like without pretending the whole ecosystem has already moved.
The honest timeline is a range, not a countdown
A date estimate depends on several advances arriving together: larger hardware, lower error rates, consistent manufacturing, continuous error correction, and enough reliable logical operations for the attack. Better attack algorithms can lower the required resources as hardware improves. Read a projected date alongside those assumptions, rather than treating the date as an independent result.
Three conclusions are firmer than any calendar prediction. Shor’s algorithm gives the threat a credible mathematical foundation. No publicly known machine can carry out the attack against real-world keys today. And replacing vulnerable cryptography across long-lived systems will take years.
So the practical answer is: quantum computers do not break today’s internet encryption yet, but organizations with long-lived secrets or slow replacement cycles cannot wait for a dramatic proof before starting the move.
Visual guide
How the pieces fit together
