“Technology” is a very wide topic, so this article takes one of the most consequential technology shifts of the decade and explains it plainly: the move to post-quantum cryptography, the new generation of encryption designed to hold up against quantum computers.
If that sounds like a problem for the 2040s, the central idea is worth understanding early: the clock is not tied to the day a powerful quantum computer switches on. As one 2026 guide puts it, the deadline is not the day quantum computers break RSA. For data that must stay secret for years, the risk already exists.
Below you’ll find what is actually at stake, which standards exist, what the timelines say (and how uncertain they are), and what both ordinary users and IT teams can reasonably do.
What quantum computers actually threaten
Not all encryption is equally exposed. The vulnerable part is public-key cryptography, the maths behind key exchange and digital signatures. Algorithms such as RSA and elliptic-curve cryptography protect the handshake that sets up a secure connection and verify who you are talking to. One source explains that public-key cryptography, covering key exchange and digital signatures, must be replaced, while AES-256 is considered already quantum-safe for bulk data encryption.
That distinction matters. The worry is not that every encrypted file becomes readable overnight. It is that the mechanism used to agree on keys, and to prove identity, relies on mathematical problems a large enough quantum computer could solve.
“Harvest now, decrypt later” explains the urgency
The reason this is a present-day issue has a memorable name. In what’s known as harvest now, decrypt later (HNDL), attackers capture encrypted data now and decrypt it once a cryptographically relevant quantum computer exists.
Nothing about that requires a quantum computer today. As one practitioner playbook frames it, the theft happens now and the loss lands later. It also makes a point that surprises many people: perfect forward secrecy does not prevent this kind of attack.
So the practical question isn’t “when will quantum computers arrive?” but how long your data needs to stay confidential. Medical records, government secrets, long-term contracts, and intellectual property can all outlive any plausible arrival date. A text message about lunch cannot.
The standards that already exist
The tools are not hypothetical. After an eight-year public competition, NIST published its first three post-quantum standards in August 2024:
| Standard | Algorithm | What it does |
|---|---|---|
| FIPS 203 | ML-KEM | Key establishment (the handshake) |
| FIPS 204 | ML-DSA | Digital signatures |
| FIPS 205 | SLH-DSA | Digital signatures, based on a different mathematical approach |
One guide notes that ML-KEM is the one appearing first in real products, because key exchange is where harvest-now-decrypt-later hurts, and because swapping it out doesn’t require reissuing every certificate. A further standard, FIPS 206 (FN-DSA, based on FALCON), is described by one vendor guide as expected later in 2026, so check NIST for its status.
Many deployments are using hybrid approaches, running a classical algorithm and a post-quantum one together. The logic is simple: if a flaw is found in the newer algorithm, the classical one still provides protection.
The timelines, and how uncertain they really are
Two sets of dates are worth separating, because they are often blended together in articles.
Policy dates. NIST’s transition plan, IR 8547, proposes deprecating RSA, ECDSA, and Diffie-Hellman after 2030 and disallowing them after 2035. One analysis stresses that IR 8547 was released as an initial public draft in November 2024 and that its wording could still shift, so confirm its current status on NIST’s site. Another source points out that the difference between “deprecated” and “disallowed” is the one most people skim past, and that it determines your real deadline. On the European side, a vendor summary of Commission guidance says to start transitioning by the end of 2026 and to protect critical infrastructure no later than the end of 2030.
Quantum capability dates. This is where nobody knows. One guide says every serious forecast now places a cryptographically relevant quantum computer somewhere in the 2030 to 2035 window; another gives a projection of 2033 to 2037. Gartner has been quoted moving its own estimate for when conventional asymmetric cryptography becomes unsafe from 2029 to 2030. These are forecasts from different sources with different assumptions, so treat the spread as a sign of uncertainty, not a countdown with a known end.
The sensible reading is that migration is slow, so planning should begin well before capability arrives.
Where organizations stand
Entrust’s 2026 Global State of Post-Quantum and Cryptographic Security Trends report found that just 38 percent of organizations globally are actively transitioning to post-quantum cryptography, and 68 percent say managing cryptographic assets is already extremely or very difficult.
Other headlines cite much lower readiness figures, and survey results on this topic vary widely depending on how “prepared” is defined and who is asked. Entrust sells security products, so view its findings as one data point from an interested party, not a census.
The second number is arguably the more revealing one. Many organizations simply don’t know where all their cryptography lives: in applications, hardware, certificates, embedded devices, and third-party services.
What migration actually involves
Swapping an algorithm is only part of the job. Practitioner guidance keeps returning to the same sequence:
- Inventory. Find every system that uses public-key cryptography, including the forgotten ones.
- Prioritize by data lifespan. Protect first what must stay confidential longest.
- Pilot, then roll out. Test hybrid key exchange on selected systems before wider deployment.
- Build crypto-agility. One source stresses that migration won’t be a one-time event, because algorithms may need to change again. Systems should be designed so cryptography can be swapped without rebuilding everything.
- Pressure vendors. Ask suppliers for their post-quantum roadmaps and dates.
One guide also reports that a six-step migration playbook has been published jointly by CISA, NSA, and NIST. Check those agencies’ sites for the current version.
What this means for ordinary users
If you aren’t running an IT department, there is little to configure and no need to panic. The main protection is boring: keep your operating system, browser, and apps updated, because post-quantum protections will mostly arrive through software updates. Several major browsers and secure messaging apps have already added hybrid post-quantum key exchange, though it’s worth checking each product’s own documentation for what is currently covered.
Be sceptical of “quantum-proof” marketing for consumer gadgets, VPNs, or cloud storage. Without specific, verifiable details about which standard is used, the label tells you little. Also remember that this topic is separate from quantum computing as a consumer technology. You don’t need a quantum computer, and nothing you own needs to be replaced because of it today.
What this means for businesses and developers
The more concrete task falls on organizations. One compliance-focused guide cautions that post-quantum cryptography is not a current requirement for certain assessments, such as CMMC Level 2, so check what regulations actually apply to you rather than assuming. The stronger driver is risk: if you hold data with a long confidentiality lifetime, your exposure begins when that data is transmitted, not when quantum computers arrive.
A realistic first-year plan is modest: build a cryptographic inventory, identify your longest-lived sensitive data, ask critical vendors about their plans, and test hybrid key exchange where it’s supported. Small teams with mostly cloud-based services may find that the biggest gains come from choosing providers who handle this transition for them.
Frequently Asked Questions
Can quantum computers break encryption today?
No. Sources describe the threat as arising once a cryptographically relevant quantum computer exists, with forecasts clustered between roughly 2030 and the late 2030s. The concern today is that data could be captured now and decrypted later.
Is all encryption at risk?
No. The exposed part is public-key cryptography used for key exchange and digital signatures. Symmetric encryption such as AES-256 is generally regarded as quantum-resistant at adequate key sizes.
What is “harvest now, decrypt later”?
It’s a strategy where an attacker stores encrypted data today in the hope of decrypting it once quantum computers are capable enough. It matters most for data that must remain confidential for many years.
What are ML-KEM and ML-DSA?
They are two of NIST’s first post-quantum standards, finalized in August 2024. ML-KEM (FIPS 203) handles key establishment, and ML-DSA (FIPS 204) handles digital signatures.
Do I need to do anything as an individual?
Mainly keep your devices and apps updated so that post-quantum protections reach you as they roll out. There’s no setting to switch on and nothing to buy.
Where can I read the official standards?
NIST publishes the FIPS documents and its post-quantum cryptography project pages at nist.gov, and CISA publishes related migration guidance at cisa.gov.