How does quantum keep secrets, and will it break today's encryption?

The internet uses two kinds of lock together.

• Public-key encryption (RSA and elliptic curves, page 13a) lets two strangers agree a secret and prove who they are. Its security rests on problems with hidden repeating patterns, and Shor's algorithm finds such patterns (chapter 7). A large quantum computer would break it.
• Symmetric encryption (such as AES) scrambles the actual data with the shared secret. Quantum computers speed up attacks on it only modestly. Longer keys handle that. It stays safe.

So the danger sits in the handshake, not the scrambling. Break the handshake and you learn the secret key, and then you can read everything.

Researchers publish estimates, and they keep falling as the methods improve:

• 2019: about 20 million noisy qubits to break RSA-2048 in eight hours (Gidney and Ekerå).
• May 2025: under a million noisy qubits, in under a week (Gidney, Google; preprint).
• March 2026: the elliptic curve behind Bitcoin with about 1,200 to 1,450 error-corrected qubits, in minutes on fewer than 500,000 physical qubits (Google researchers and colleagues).
• 2026: several groups proposed designs needing tens of thousands of physical qubits, using newer error-correcting codes or neutral atoms (preprints, not yet peer reviewed).

For comparison, the best machines today run 48 error-corrected qubits (Quantinuum, November 2025). The gap is large, and shrinking from both ends.

Someone can record encrypted traffic today and store it until a quantum computer can open it. If your secret still matters in ten or fifteen years (medical records, state secrets, long-term business plans), it's already at risk. The UK's National Cyber Security Centre, the European Union and US agencies all name this threat in their official guidance.

"Q-Day" is the day a quantum computer first breaks today's public-key encryption. Nobody knows the date. A 2026 survey of 26 experts by the Global Risk Institute put the chance of such a machine at 28% to 49% within ten years, and 51% to 70% within fifteen.

The useful question isn't "when?" but "are we switching in time?". The Canadian researcher Michele Mosca put it as a simple sum: if the years your data must stay secret, plus the years it takes to switch your systems, add up to more than the years until Q-Day, you're already late.

Post-quantum cryptography (PQC) is new public-key maths built on problems that neither ordinary nor quantum computers can solve quickly, as far as anyone knows. It runs on ordinary computers and phones. No quantum hardware needed.

After an eight-year public competition, the US standards agency NIST published the first three standards in August 2024: ML-KEM for agreeing keys, and ML-DSA and SLH-DSA for signatures. In March 2025 it picked a backup, HQC, built on different maths in case the main choice ever falls.

Yes. You may be using it right now:

• Browsers: Chrome, Firefox and Apple's systems combine the old and new key exchange by default (2024 to 2025).
• Messaging: Apple's iMessage (2024) and Signal (2023, upgraded 2025) add post-quantum protection.
• The web: by April 2026 more than 65% of the human traffic through Cloudflare, a company that carries a large share of the web, used post-quantum key exchange.

If your browser is up to date (Chrome 131 or later, Firefox 132 or later, or Apple's 2025 systems), it already uses post-quantum key exchange with sites that support it. In Chrome you can check: open the developer tools, choose the Security panel, and look at the key exchange. A name containing "MLKEM" means post-quantum.

• UK (NCSC): organisations plan by 2028, move the most important systems by 2031, and finish by 2035.
• EU: member states start by the end of 2026, move high-risk uses by 2030, and finish as far as feasible by 2035.
• US: a June 2026 executive order requires federal high-value systems to switch key exchange by 2030 and signatures by 2031.

Quantum key distribution (QKD) uses quantum physics itself to share a secret key. In the first scheme, BB84 (Bennett and Brassard, 1984), Alice sends single photons, each set in one of two ways of measuring, chosen at random. Bob measures each in a randomly chosen way too. Afterwards they compare which ways they used (not the results) and keep only the matches. Those give them identical random bits.

If an eavesdropper, Eve, measures photons on the way, she must guess the way to measure, and a wrong guess disturbs the photon (chapter 3). Alice and Bob check a sample of their bits. Too many mismatches means someone was listening, so they throw the key away.

China has built the largest networks: a 2,032 km backbone between Beijing and Shanghai (2017), a 4,600 km integrated network (2021), and in 2025 a small satellite linked China and South Africa, 12,900 km apart. Europe plans a network called EuroQCI, with its Eagle-1 satellite now due in late 2027 or early 2028. BT and Toshiba trialled a QKD network in London in 2022.

The UK's NCSC "does not endorse the use of QKD for any government or military applications". The US NSA, and the French, German, Dutch and Swedish security agencies, say similar. Their reasons:

• QKD needs special hardware and dedicated links;
• it doesn't prove who's on the other end by itself, so it still needs ordinary signatures;
• long links pass through relay stations that users must trust;
• real equipment can have flaws an attacker targets;
• post-quantum cryptography solves the main problem in software, on the devices people already have.

QKD is clever physics with real uses in specialist links. It isn't a replacement for the new maths.

Good keys need unpredictable numbers. Quantum random number generators take them from quantum measurements, which no one can predict in advance (chapter 2). Samsung's Galaxy Quantum phones in South Korea carry such a chip. In 2025 JPMorganChase and Quantinuum used a quantum computer to produce randomness that anyone can certify. The NCSC notes that today's well-designed ordinary generators remain adequate.

Bitcoin uses elliptic-curve signatures, which Shor's algorithm would break. Coins are most exposed when the owner's public key is already visible on the blockchain, which happens with older address types and when people reuse addresses. One 2026 analysis put that at about 30% of all bitcoin. Bitcoin's developers are discussing a quantum-safe upgrade (a draft proposal, BIP-360, from February 2026), but nothing has switched on yet. Any change needs wide agreement across the network.