Post-Quantum Cryptography Explained, the Complete Plain English Guide

If you bank online, send a work email or open a messaging app, that traffic is protected by two pieces of mathematics that a large enough quantum computer would undo. No such machine exists today, and the honest answer about when one arrives is that nobody knows.

The reason the world is rebuilding its encryption anyway is more interesting than the usual scare story, and it does not depend on predicting a date. This is post-quantum cryptography explained for someone who wants no equations, no algorithm names to memorise and a straight answer about whether any of it is their problem.

Two kinds of encryption, and only one is in trouble

Almost everything you do online is protected by two different kinds of encryption working together, and only one of them is in trouble. If the machine itself is the unfamiliar part, start with our guide to what a quantum computer is and is not. The first kind scrambles the actual contents of your data using a secret both ends already share, and the workhorse there is a cipher called AES. The second kind solves the harder problem of how two strangers who have never met agree on that shared secret in the first place, and of how your browser knows the site really is your bank.

That second kind is public-key cryptography, and in practice it means RSA and elliptic-curve mathematics. It is the part a quantum computer would break, and it is doing the two jobs you would least like to lose, namely setting up the secret and proving identity. The first kind is comparatively safe, because the best known quantum attack on a cipher like AES only halves its effective strength, which is fixed by using longer keys rather than by replacing the design.

So the accurate version of the headline is narrower than the headline. Your data is not suddenly readable by anyone with a quantum computer, but the handshake that protects it and the signature that authenticates it would both fail, and everything downstream of them fails with them. Post-quantum cryptography is the work of replacing that broken half while leaving the half that still works alone.

Why a quantum computer breaks it when a faster laptop would not

A quantum computer does not break RSA by trying possibilities more quickly. This is the single most common error in popular coverage, and it matters. If raw speed were the issue, a big enough conventional supercomputer would eventually get there too, and the whole problem would be a question of patience.

What happens instead is that the mathematics underneath RSA has a hidden regularity, and a quantum computer is unusually good at finding exactly that kind of regularity. Peter Shor showed something else in the 1990s, in what remains the most consequential of the quantum algorithms. Splitting a large number into its factors can be rewritten as the problem of finding a repeating pattern, a period, in a related sequence. A quantum computer can hold many candidate answers at once and arrange for the wrong ones to cancel each other out. Overlapping ripples on water flatten one another the same way. What is left standing is the periodic answer.

The important word is structure. Shor’s method works because factoring and the related discrete logarithm problem have this periodic shape sitting inside them, not because quantum computers are generically fast. A cipher like AES has no such shape to exploit, which is why it survives, and the post-quantum cryptography schemes now being deployed were chosen partly because nobody has found that shape in them either.

The reason this became urgent before the machine exists

Here is the idea that turns a distant problem into a present one, and if you remember nothing else from this piece, remember this. An adversary does not need a quantum computer today in order to benefit from one later, because encrypted traffic can simply be recorded now and stored until a machine capable of opening it exists.

The practice has a name, harvest now, decrypt later, and it appears in NIST’s own transition guidance rather than only in vendor marketing. NIST’s Transition to Post-Quantum Cryptography Standards, an initial public draft published as Internal Report 8547 in November 2024, describes encrypted data as remaining at risk from the “harvest now, decrypt later” threat “in which adversaries collect encrypted data now with the goal of decrypting it once quantum technology matures”. The same report notes that sensitive data often keeps its value for many years. That is a government standards body, not a vendor deck.

That reframes the whole timing question. If something you send today must stay secret for fifteen years, the only date that matters is whether a capable machine appears inside those fifteen years. You are making that bet right now, whether or not you have thought about it. Medical records, legal files, industrial designs and government material all have exactly that kind of long shelf life, which is why the migration to post-quantum cryptography started before the threat did.

Shelf life plus migration time is the sum that decides it

There is a way of settling the post-quantum cryptography timing question that takes three numbers and no forecasting skill, and it is more useful than any predicted date. It comes from Michele Mosca at the Institute for Quantum Computing in Waterloo, and it is usually written as a simple comparison rather than as a formula.

Take the number of years your data has to stay secret and call it the shelf life. Take the number of years your migration will realistically take and call it the migration time. Add those two together. If the sum is larger than the number of years before a capable quantum computer exists, you already have a problem, and it started the day you sent the data.

The value of putting it this way is that two of the three numbers are yours and only one is a guess. A hospital knows roughly how long a patient record stays sensitive. A manufacturer knows how long a design stays commercially useful. NIST’s own estimate is bleaker than most organisations expect. Past cryptographic migrations have taken over a decade, and its draft report says this more complex one will likely take at least that long.

Put plausible numbers in and the answer usually arrives without argument. A record that must stay private for twenty years, in an organisation that needs seven years to migrate, is exposed unless a capable machine is more than twenty-seven years away. Almost nobody is willing to defend that claim in writing. That is the entire case for starting, and it never required anyone to name a year.

The replacement runs on ordinary computers, not quantum ones

The replacement is not quantum technology, which is a point almost everyone gets wrong on first encounter. Post-quantum cryptography is ordinary software running on ordinary computers, built on mathematical problems that neither a conventional machine nor a quantum one currently knows how to solve efficiently.

The leading family is built on lattices, and the loose intuition is a regular grid of points stretching out in several hundred dimensions. You are handed a deliberately awkward description of that grid, then asked to find the point nearest to somewhere you have been dropped. It sounds simple. In several hundred dimensions it is brutally hard. It has no known periodic structure of the sort Shor’s method needs, so the trick that undoes RSA has nothing to grip.

That is as far as the intuition goes without mathematics, and if you want the next level Cloudflare’s engineers have written the best beginner’s guide to lattice cryptography available, though be warned that beginner there means beginner among cryptographers. We have our own longer reference on lattice-based cryptography and a worked example that runs the encryption with real numbers you can follow by hand.

Three finished standards, published August 2024

After an open competition that ran for years and drew submissions from teams around the world, the American standards body published its first finished post-quantum cryptography standards on 13 August 2024. There are three of them, and knowing what each is for is more useful than memorising the names.

One standard covers key encapsulation, which is the job of agreeing on a shared secret over an open connection, and it is the direct replacement for what RSA and elliptic curves do when your browser opens a connection. The other two cover digital signatures, the job of proving that a message or a piece of software genuinely came from who it claims. Two signature standards exist rather than one because they make different trade-offs, with the more conservative option built on nothing more exotic than hash functions. A third, FIPS 206, went for approval in August 2025 and is not final as of August 2026.

A fourth algorithm called HQC was selected in March 2025 as a backup for key agreement, deliberately built on a different branch of mathematics from the main lattice choice. FIPS 207 is assigned to it and no final standard has been published as of August 2026. That redundancy is insurance rather than indecision, and the reasoning behind it is the subject of the next section.

ML-KEM agrees the secret, ML-DSA and SLH-DSA sign

The three names at the heart of post-quantum cryptography are worth ten minutes of your attention because you will meet them in procurement documents for the rest of the decade, and in the literature of every post-quantum cryptography company selling into the migration. FIPS 203 is called ML-KEM, and it is the one that agrees a shared secret over an open connection, taking over the job RSA and elliptic curves do when your browser first reaches a website. During the competition it was known as Kyber, and you will still see that name in older code and blog posts.

FIPS 204 is ML-DSA, formerly Dilithium, and it signs things. A signature is the proof that a message, a software update or a website certificate came from who it claims, and this is the default replacement for the signing that RSA and elliptic curves do today. Both of these rest on the same lattice mathematics, which is efficient and well studied and also means a single breakthrough would weaken both at once.

That shared foundation is exactly why FIPS 205 exists. It is called SLH-DSA, it was SPHINCS+ during the competition, and it signs using nothing but hash functions, the same building blocks that have been studied and attacked for forty years. It produces much larger signatures and is slower, so nobody expects it to become the default. It is the option you reach for when you need a signature that will still be trusted in twenty years, or when you are signing something that cannot be updated afterwards.

The March 2025 selection of HQC follows the same reasoning one level up. It does the same job as ML-KEM but rests on error-correcting codes rather than lattices, so a break in the lattice assumption would not take both down together. Standards bodies are not hedging because they expect a break. They are hedging because the cost of being wrong once is unbounded, and the cost of keeping a spare is merely annoying.

Sizes are in bytes, for one parameter set of each standard: ML-KEM-768, ML-DSA-65 and SLH-DSA-SHA2-128s, the small variant. They come from Table 3 of FIPS 203 and Table 2 of both FIPS 204 and FIPS 205. Every standard offers other parameter sets, and those are larger or smaller, so a size quoted without its parameter set means very little. HQC is not in the table because it was selected in March 2025 and has no FIPS number yet.

How the standards were chosen, and why that took eight years

NIST did not commission the post-quantum cryptography standards, it ran a competition for them, and the difference is the reason to trust the result. The call went out in 2016 and eighty-two submissions arrived from teams around the world. The sixty-nine that were accepted as complete were published in full, so that any cryptographer anywhere could try to break them. The process then ran in rounds over several years, with candidates dropping out as attacks were found on them in public.

That sounds slow, and the slowness is the point. A cryptographic standard is a promise that a very large number of clever people have tried hard to break something and failed, and there is no way to make that promise quickly. The alternative, where a small group designs an algorithm privately and asserts that it is sound, has a poor historical record.

The competition produced one demonstration of its own value that is worth knowing about. An algorithm called SIKE, built on a branch of mathematics quite different from lattices, reached the fourth round as an alternate candidate and was well regarded. In 2022 two researchers at KU Leuven, Wouter Castryck and Thomas Decru, published an attack (IACR ePrint 2022/975) that broke its lowest parameter set in about ten minutes on a single processor core. It was not a quantum attack and it needed no special hardware. Two other groups reached the same result within about three weeks, and all three built on a theorem Ernst Kani proved in 1997, which Castryck and Decru credit in their own paper.

Read that either way and it is instructive. A scheme that had survived years of expert attention fell to classical mathematics on a single processor core, which is a reminder that unbroken is not the same as unbreakable. It also fell during the competition rather than after deployment, in public, to researchers who published their working, which is precisely what the process was designed to make happen.

Lattice security rests on nobody breaking it, not on a proof

Every company selling post-quantum cryptography migration services has a structural reason to present the new algorithms as settled, and mostly they are good algorithms chosen by a careful process. The honest position is still less comfortable than the marketing, and a reader deserves it.

The security of lattice cryptography rests on the fact that nobody has found an efficient attack, not on a proof that no such attack exists. That is a meaningful difference, and the field has already had a rehearsal. In April 2024 Yilei Chen posted a paper claiming a quantum algorithm for a version of the lattice problem the new standards lean on. It would not have broken ML-KEM’s own parameters. It would have shaken confidence in the whole family, and for about a week the question was genuinely open.

It did not survive contact with other cryptographers. Chen added a note to the front of the paper roughly eight days later. Step nine of the algorithm “contains a bug, which I don’t know how to fix”, it said, thanking the two researchers who had found it that day (Quantum Algorithms for Lattice Problems, IACR ePrint 2024/555, update of 18 April 2024). The episode cuts both ways, because it shows the assumption is not proven, and it also shows that a large expert community checks these claims quickly and in public.

A 32-byte key becomes 1,184 bytes and three places feel it

The single most practical difference between the old cryptography and post-quantum cryptography is size, and it is the reason a migration is engineering work rather than a configuration change. An elliptic-curve public key of the sort your browser uses today is 32 bytes. The equivalent ML-KEM key at the commonly chosen security level is 1,184 bytes, and the ciphertext that comes back with it is a similar size.

For a laptop on home broadband that difference is invisible. It stops being invisible in three specific places, and those places are where migration projects run into trouble. The first is anything with a hard limit on message size. A handshake that used to fit in one network packet may now need two, and protocols built on the assumption that it fits in one behave badly when it does not.

The second is constrained hardware. A smart meter, a car component or an industrial sensor may have been specified a decade ago with just enough memory for an elliptic-curve handshake and no more. No software update creates memory that was never fitted. The third is anywhere a certificate chain is sent, because the growth multiplies. A chain carries several signatures and several keys, so a change that adds a kilobyte in one place can add several kilobytes where it counts.

None of this is a reason to delay, and all of it is a reason to find out early which of your systems sit in those three categories. The organisations that have found the migration cheap are the ones whose estate is modern web infrastructure. The ones finding it expensive are the ones with hardware in the field that was never designed to be changed.

Signatures are the harder half of the post-quantum cryptography migration

Most coverage treats the post-quantum cryptography migration as one job, and in practice it splits cleanly into two with very different difficulty. Replacing key agreement is the easier half, because a handshake is negotiated fresh every time two machines connect. Change both ends and the next connection is protected, with nothing left over from before.

The numbers say the same thing. An elliptic-curve signature is 64 bytes. Its lattice replacement, ML-DSA at the middle parameter set, is 3,309 bytes, and the hash-based SLH-DSA starts at 7,856 bytes and runs to 49,856 depending on the parameters chosen. A certificate chain carries several signatures at once, so the growth lands hardest exactly where a browser is least willing to wait.

Signatures do not work that way, because a signature has to be verified by whoever receives it, possibly years after it was made and by software you do not control. A certificate authority cannot simply start issuing post-quantum certificates, because every browser and every embedded client that has not been updated would reject them. The chain runs backwards through root certificates that were installed in devices long ago and that in many cases cannot be replaced at all.

Code signing is the sharpest version of the same problem. Firmware shipped in a device today may be verified by a signature check burned into hardware, which means the algorithm that check uses is fixed for the life of the product. If that product is a car or a medical device or a piece of grid equipment, its life is measured in decades, and the decision about which signature scheme to trust has already been made for it. Our practical guide to enterprise quantum cybersecurity goes through how that decision is usually taken.

This is the practical reason the harvest-now argument matters less for signatures than for encryption, and why the deadlines still bite just as hard. Nobody can retrospectively forge a signature by recording it. What they can do is wait for the day a signature scheme breaks and then forge new ones, which is why the systems that will still be running in 2040 need their signing decided now rather than later.

Chrome, Signal and iMessage switched before users noticed

It is easy to read all of this as something that starts later, and that impression is several years out of date. A large share of everyday web traffic is already protected by a post-quantum key agreement, and most of the people it protects have no idea. Chrome enabled a hybrid key exchange by default in 2024, combining the elliptic-curve method with the lattice one so that an attacker has to break both, and other major browsers followed.

Messaging moved earlier than the web did, which is unusual. Signal shipped a post-quantum layer into its key agreement in 2023, and Apple announced a comparable upgrade to iMessage in early 2024. Both were designed so the new mathematics sits alongside the old rather than replacing it. Large infrastructure providers have reported a rising share of inbound connections arriving with post-quantum protection ever since. The shift now shows up in the roadmaps of the companies building the machines as well as those defending against them.

Notice what all of these deployments of post-quantum cryptography have in common. Every one of them is a case where a single organisation controls both ends of the connection, or close enough to it, and can change them together. That is why the consumer internet moved first and why enterprise estates are moving slowly, and it is a better predictor of migration difficulty than the size of the organisation or the money available.

Nobody knows, and a single year is a sales pitch

Nobody knows, and anyone who gives you a confident single year is selling something. The useful move is to treat every forecast as belonging to whoever made it, rather than as a property of the field.

Estimates of the hardware required have been falling steadily as the algorithms improve. In 2019 Craig Gidney and Martin Ekerå (Quantum 5, 433) put the cost of breaking RSA-2048 at twenty million noisy qubits running for eight hours. By 2025 Gidney had cut that to under a million qubits and under a week. He made the same hardware assumptions both times. The gain came from better algorithms and better error-correcting codes, not from better machines. Machines available today remain far below that, so the gap is real, but it has been closing from the theory side as much as from the engineering side.

Forecasts of the arrival date spread across the 2030s and 2040s. One recent modelling exercise, by the blockchain security firm Project Eleven, published scenarios landing on 2030, 2033 and 2042 depending on how quickly qubit counts and quality improve, with 2033 as its middle case. Expert surveys produce a similar spread rather than a consensus year, and our longer piece on Q-Day goes through the competing estimates in detail.

The policy response has quietly stopped waiting for an answer. NIST’s transition guidance, still an initial public draft, sets out that RSA-2048 and the other algorithms at that strength should be deprecated after 2030 and disallowed after 2035. What gives those dates force for United States federal agencies and their suppliers is not the report but Executive Order 14412 and the Office of Management and Budget’s memorandum M-26-15, both issued in June 2026. The United Kingdom’s National Cyber Security Centre has published its own milestones, asking organisations to define migration goals by 2028, complete their highest-priority work by 2031 and finish by 2035. The standards exist precisely so that the exact date stops mattering.

For an individual, very little

If you are an individual, the honest answer is very little, and you should be suspicious of anyone selling you a personal quantum-safe product. The protection is arriving through software you already use. Major browsers and large parts of the internet’s infrastructure have already switched their connection handshakes to the new algorithms. Keeping your software updated is genuinely most of your contribution.

If you are responsible for an organisation, the first task is knowing what you have, before you buy anything. Almost nobody can currently answer the question of where their systems use public-key cryptography, and that inventory is the prerequisite for every later decision, which is why the published timelines put discovery years before migration.

After that, the sensible order follows the harvest-now logic rather than the calendar. Work out which of your data still has to be secret in 2040, and protect that first. Then ask suppliers for dates. Run a new algorithm alongside a classical one, so that an unexpected break in either still leaves you standing. Germany’s BSI and France’s ANSSI both recommend that hybrid approach as policy, on the grounds that the new schemes are not yet old enough to trust alone.

Migrations stall because cryptography belongs to nobody

Post-quantum cryptography migrations stall for organisational reasons far more often than technical ones, and the pattern is consistent enough to name. Cryptography usually belongs to nobody in particular. It is embedded in products bought from suppliers, in code written by people who have left, and in infrastructure managed by a team that treats it as settled. The result is that the question of who decides gets asked late.

The organisations moving fastest have made one person accountable for the inventory and given them the standing to ask suppliers uncomfortable questions. That is a smaller ask than a migration programme and it is the step that unblocks everything else. Without it, the discovery work is done by whoever has spare time, which means it is done badly or not at all.

Supplier dependency deserves particular attention because it is where the schedule really lives. Most organisations cannot migrate faster than the products they run, so the honest first question is when each of your vendors will support the new standards. The cost question comes second. Ask it in writing, ask for a date rather than a commitment in principle, and treat vagueness as information about how the rest of the project will go.

None of this needs a large budget in its first year. It needs a name against the task, a list that is kept current, and a set of written answers from the suppliers who will determine the timetable whether or not anyone asks them.

Moving too early has a cost as well

Almost every article on post-quantum cryptography argues in one direction, which is that you are late. The honest position has a second half. Migrating badly is expensive, and several of the ways to migrate badly come from moving fast rather than from moving slowly.

The clearest example is buying before discovery. An organisation that does not know where its systems use public-key cryptography cannot specify what it needs, and a vendor is happy to size the contract on its behalf. The published timelines put inventory years ahead of the deadline for exactly this reason, and the sequence is not bureaucratic caution. It is the difference between buying what you need and buying what you were sold.

Replacing rather than adding is the second trap. An organisation that rips out its elliptic-curve handshake and runs the new algorithm alone has bet everything on mathematics that is younger than the systems it protects. Running both together costs a little more bandwidth and removes that bet entirely, which is why Germany’s BSI treats hybrid as a requirement rather than a transitional step.

The third is treating this as a project with an end date. The organisations that will handle the next algorithm change cheaply are the ones that come out of this one with a live inventory and the algorithm choice held in configuration. The ones that treat it as a one-off will have the same conversation again, at the same price, whenever the standards move next.

Crypto-agility, or making the next change cheaper

The phrase you will hear from consultants is crypto-agility, and underneath the jargon is a simple and genuinely useful idea. Most systems that are painful to migrate are painful because the choice of algorithm was written into them in a hundred separate places, and nobody kept a list. Building so that the algorithm is a setting rather than an assumption is what makes the next change a configuration job instead of a rebuild.

This matters more than usual here because there is every reason to expect another change. The current standards are young by cryptographic standards, the backup algorithm was added precisely because the main one might fail, and a serious attack on lattices would start the whole exercise again. An organisation that finishes this migration and learns nothing structural from it will pay the full price a second time.

The cheapest version of this discipline is also the least glamorous. Keep an inventory of where cryptography is used and which algorithm each place calls. Keep it current as routine rather than as a project. Make sure the answer lives somewhere other than in the heads of two engineers. Everything else in a migration plan depends on that list existing, which is why the published timelines put discovery years ahead of the deadline.

Four terms used interchangeably, one of them defined

Four terms get used as if they were interchangeable, and only one of them is defined. Post-quantum cryptography is the specific one, and it means ordinary algorithms believed to resist attack by a quantum computer, which is what NIST standardised. If a document uses that phrase and names FIPS 203, 204 or 205, you know what you are being offered.

Quantum-resistant and quantum-safe are marketing terms for the same idea, and they are not wrong so much as unanchored. Neither carries a claim you can check, because neither says which algorithms are involved or which standard they follow. The useful response is to let the phrasing go and ask the follow-up question, which is which standardised algorithms the product implements and at which security level.

Quantum-proof is the one to treat as a warning. Nobody can prove that any of these algorithms is unbreakable, the cryptographers who designed them say so plainly, and a vendor claiming otherwise is either careless with language or hoping you are. The 2022 break of a well-regarded competition candidate, in ten minutes on one processor core, is the standing argument against anyone using the word.

There is one more distinction worth holding on to. A product that uses quantum technology to distribute keys is doing something different from post-quantum cryptography, needs dedicated hardware, and solves a narrower problem. Both can be reasonable purchases and they are not substitutes for one another, so a proposal that blurs the two is worth reading twice.

New algorithms do nothing about a stolen password

Post-quantum cryptography protects one thing, and the marketing around it tends to imply rather more. New algorithms protect data in transit and the proof of who sent it. They do nothing about a stolen password, a misconfigured storage bucket, an employee who clicks the wrong link or a supplier who is breached and used as a route in. Those remain the way almost every real intrusion begins.

It is worth being blunt about that, because security budgets are finite and a post-quantum programme competes with everything else for them. The argument for doing this work is specific rather than general. It is that recorded traffic has a long life, that some of your data has a longer one, and that the two facts together create an obligation that ordinary security spending does not address.

There is also a distinct technology called quantum key distribution which is frequently confused with this, and the two solve different problems by different means. That approach uses physics and dedicated hardware to share a key, and it needs a fibre link or a satellite. Post-quantum cryptography is software you can deploy this afternoon on the machines you already own, which is the main reason standards bodies chose it as the answer for general use. We cover the distinction in our guide to quantum key distribution.

Frequently asked questions