Can quantum computers break encryption? Shor's algorithm threatens RSA and ECC, but today's quantum hardware is still far too small. Here is the 2026 status.
On July 30, 2026, IBM and the University of Chicago announced they had run 70 error-corrected logical qubits to solve a sampling problem that would take a classical supercomputer far longer. The paper, titled "Sampling hard circuits with verifiably high fidelity," is a genuine quantum-advantage demonstration. It is not Shor's algorithm factoring an RSA key. The two achievements are separated by orders of magnitude in qubit count and error-correction overhead.
So can quantum computers break encryption today? No. Breaking RSA-2048 with Shor's algorithm requires thousands of logical qubits and millions of physical qubits for error correction. The best machines in 2026 have tens of logical qubits. The gap is enormous. But the threat is real enough that NIST finalized post-quantum standards in 2024, and agencies are pushing to deprecate RSA and ECC by 2035.
You can check what cipher suites your own systems use with the TLS Cipher Suite Lookup to see whether you are still relying on quantum-vulnerable key exchange.
In 1994, Peter Shor published a paper titled "Algorithms for quantum computation: discrete logarithms and factoring" that changed the trajectory of cryptography. Shor proved that a sufficiently large quantum computer can factor integers and solve discrete logarithms in polynomial time. The paper is available from IEEE. This matters because RSA depends on the difficulty of factoring, and Diffie-Hellman plus elliptic-curve cryptography depend on the difficulty of discrete logarithms. Shor's algorithm breaks RSA and Diffie-Hellman. Elliptic-curve cryptography, including ECDSA and ECDH, falls with it.
The algorithm works by finding the period of a function using a quantum Fourier transform. Once you know the period, classical arithmetic gives you the factors. The quantum part is the period-finding step. The rest is ordinary math.
The key phrase is "sufficiently large." Shor's algorithm running on a quantum computer with enough error-corrected qubits would break RSA-2048 in hours or days. Running it on today's hardware is impossible. Breaking RSA-2048 needs roughly 4,000 to 10,000 logical qubits, and each logical qubit requires hundreds to thousands of physical qubits for error correction. The total physical qubit count is in the millions. Current machines have hundreds of physical qubits producing tens of logical qubits.
The gap between what we have and what Shor needs is not a matter of incremental improvement. It is a difference of several orders of magnitude. Nobody has a credible roadmap to close it in the next few years.
As of September 2026, no. The IBM and University of Chicago result from July 2026 is the strongest quantum-advantage claim to date, and it involved 70 logical qubits solving a sampling problem. That is impressive physics. It is not cryptography. The IBM announcement is here.
The distinction matters. Sampling problems are designed to be hard for classical computers but easy for quantum ones. They prove that quantum hardware can do something a classical machine cannot match. Shor's algorithm is different. It requires sustained, error-corrected computation on a much larger number of qubits, and it must run long enough to complete a full period-finding calculation on a 2048-bit number.
Here is where things stand:
| Algorithm | Quantum-Vulnerable? | Attack | Post-Quantum Replacement |
|---|---|---|---|
| RSA | Yes | Shor's algorithm | ML-DSA (FIPS 204) |
| ECDH / ECDSA | Yes | Shor's algorithm | ML-DSA (FIPS 204) |
| Diffie-Hellman | Yes | Shor's algorithm | ML-KEM (FIPS 203) |
| AES-128 | Partially | Grover's algorithm | AES-256 |
| AES-256 | No | Grover's algorithm leaves 128-bit security | None needed |
| SHA-256 | No | Grover's algorithm (minor effect) | None needed |
Grover's algorithm, published by Lov Grover in 1996, is the other quantum threat. It gives a quadratic speedup for unstructured search, which means it effectively halves the security level of symmetric keys. AES-128 drops from 128-bit to roughly 64-bit security, which is concerning. AES-256 drops to roughly 128-bit, which is still safe. This is why NIST recommends AES-256 for long-term quantum resistance.
The practical takeaway: asymmetric cryptography (RSA, ECC, DH) needs to be replaced. Symmetric cryptography (AES) and hashes (SHA-2) need longer keys at most.
NIST finalized its first post-quantum cryptography standards on August 13, 2024, after an eight-year competition. The announcement is on NIST's site. Three standards were approved.
FIPS 203 specifies ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism), derived from the CRYSTALS-Kyber submission. ML-KEM replaces Diffie-Hellman and ECDH for key establishment. It is a key encapsulation mechanism, not a signature scheme.
FIPS 204 specifies ML-DSA (Module-Lattice-Based Digital Signature Algorithm), derived from CRYSTALS-Dilithium. ML-DSA replaces RSA and ECDSA for digital signatures. It uses lattice-based mathematics that no known quantum algorithm can break efficiently.
FIPS 205 specifies SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), derived from SPHINCS+. SLH-DSA is a hash-based signature scheme. It is slower and has larger signatures than ML-DSA, but it relies only on hash function security, which gives it a different and more conservative security argument.
NIST has also selected HQC for a future fourth standard focused on key establishment, as a hedge against the possibility that lattice-based schemes are broken. The NIST Post-Quantum Cryptography project page tracks the full timeline.
NIST IR 8547 sets a transition timeline that deprecates quantum-vulnerable algorithms by 2035. That is eight years from now, which sounds comfortable, but migrating cryptographic infrastructure in large organizations takes years. The migration is already behind schedule for many systems.
Not everything breaks. Symmetric encryption and hash functions are largely resistant to quantum attacks, with a caveat about key size.
Grover's algorithm gives a quadratic speedup for brute-force search. For a symmetric cipher with an n-bit key, Grover reduces the effective security to n/2 bits. AES-128 drops to 64-bit security, which is below the acceptable threshold for most applications. AES-256 drops to 128-bit, which remains strong.
SHA-256 is in a similar position. Grover's algorithm reduces its preimage resistance from 256-bit to 128-bit, which is still adequate. SHA-384 and SHA-512 are even more comfortable.
The practical implication is that you do not need to replace AES or SHA-2. You need to use longer key sizes. AES-256 becomes the baseline recommendation for systems that need quantum resistance. You can generate SHA-256 hashes with the SHA-256 Hash Generator to see the output format.
This is a much smaller problem than the asymmetric side. Replacing RSA and ECC with lattice-based schemes requires new key formats, new protocols, new hardware support, and new certificate types. Doubling your AES key length is a configuration change.
There is a threat that does not require a working quantum computer today. Adversaries are recording encrypted traffic now, with the intention of decrypting it once sufficiently large quantum computers become available. This is called "harvest now, decrypt later" or SNDL.
The threat applies to any data encrypted with RSA or ECC key exchange that has a confidentiality lifespan longer than the time until quantum computers arrive. Government communications and medical records that must remain confidential for decades are the primary targets, along with long-lived financial data.
The NSA issued a memorandum in 2022 directing national security systems to begin post-quantum migration, with a completion deadline of 2035. The concern is not that quantum computers will appear tomorrow. The concern is that traffic captured today could be decrypted retroactively.
This is why the migration timeline matters even though current quantum hardware is nowhere near breaking RSA. If your data needs to stay confidential for 20 years, and a quantum computer capable of running Shor's algorithm appears in 15 years, your captured traffic is exposed. You can inspect your current RSA key parameters with the RSA Key Inspector to understand what is at stake.
Quantum computers cannot break RSA or ECC today, and the same goes for Diffie-Hellman. The 2026 IBM result with 70 logical qubits is a real advance, but it is orders of magnitude short of what Shor's algorithm requires. AES-256 and SHA-256 are safe even under Grover's algorithm.
The real work is the migration to post-quantum algorithms. NIST has published the standards. The deadline is 2035. If your systems handle data that must stay confidential for more than a decade, you should be planning the migration now. Start by checking your TLS configuration with the TLS Cipher Suite Lookup to see which key exchange algorithms your servers negotiate.
No. As of September 2026, the largest quantum computers have tens of error-corrected logical qubits. Breaking RSA-2048 with Shor's algorithm requires thousands of logical qubits and millions of physical qubits. Current machines are orders of magnitude too small.
Shor's algorithm breaks RSA and Diffie-Hellman, plus elliptic-curve cryptography like ECDSA and ECDH. These all rely on integer factorization or discrete logarithms, which Shor's algorithm solves in polynomial time on a sufficiently large quantum computer.
AES-256 is considered safe. Grover's algorithm halves the effective security level, so AES-256 drops to roughly 128-bit security, which remains strong. AES-128 drops to roughly 64-bit, which is not adequate for long-term protection. Use AES-256 for quantum resistance.
NIST approved three standards in August 2024: FIPS 203 (ML-KEM, key encapsulation from CRYSTALS-Kyber), FIPS 204 (ML-DSA, signatures from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, hash-based signatures from SPHINCS+). These replace RSA and ECC with lattice-based and hash-based schemes.
There is no reliable date. Breaking RSA-2048 requires millions of physical qubits for error correction. Current machines have hundreds. Most estimates put a cryptographically relevant quantum machine somewhere in the 2030s or later, but the timeline is uncertain enough that NIST set a 2035 deprecation deadline.
RSA Key Inspector
Inspect RSA public and private keys to view parameters, format, and security properties.
TLS Cipher Suite Lookup
Search and filter TLS cipher suites by IANA name, OpenSSL name, hex code, or algorithm. See security ratings, forward secrecy, and protocol support.
SHA-256 Hash Generator
Generate SHA-256 cryptographic hashes for secure data verification.
NIST's Post-Quantum Cryptography Standards, Explained for Developers
NIST finalized three post-quantum cryptography standards in 2024: ML-KEM, ML-DSA, and SLH-DSA. Here is what each standard does, why RSA and ECC are at risk, and what developers should do now.
Devs (2020) Uses Quantum Computing and Encryption Concepts, Fact-Checked
Alex Garland's Devs references real quantum physics but conflates determinism with predictability. Here is what the show gets right, what it gets wrong, and how Shor's algorithm actually threatens encryption.
How Encryption Works: From Ancient Scytales to AES-256
A Spartan wrapped leather around a rod in 400 BCE. Your browser does 2,048-bit key exchange and AES-256-GCM. The goal is the same. The math is not. Learn how encryption evolved.
