Why Your Passwords and Encryption Will Need to Change Soon
Most of the encryption protecting your online banking, private messages, email, and sensitive data right now relies on mathematical problems that classical computers cannot solve in a reasonable time. Quantum computers, once they reach sufficient capability, can solve some of these problems efficiently — meaning the encryption that seems unbreakable today could become breakable in the near future. This is not a distant theoretical concern — governments and major technology companies are already actively transitioning to post-quantum cryptography, and the transition affects everyone who uses the internet. Here is what you need to know.
1. How Current Encryption Works (And Why Quantum Breaks It)
Most current encryption — including RSA and elliptic curve cryptography — depends on mathematical problems that are easy to create but extremely hard to reverse. RSA, for example, relies on the fact that multiplying two large prime numbers is simple, but factoring the result back into its original primes is computationally infeasible for classical computers at the key sizes used today. A sufficiently powerful quantum computer running an algorithm called Shor's algorithm could factor these numbers efficiently, breaking RSA encryption. The same applies to elliptic curve cryptography used in most HTTPS connections and digital signatures.
2. How Long Until This Actually Becomes a Threat
The honest answer is: uncertain, but the planning horizon is now. Most experts believe cryptographically relevant quantum computers — powerful enough to break current encryption at scale — are 10 to 15 years away. However, a threat called "harvest now, decrypt later" means the risk exists today: adversaries are recording encrypted communications now, intending to decrypt them once quantum computers are capable enough. For communications that need to remain confidential for 10+ years — state secrets, long-term financial records, sensitive personal data — the window has already closed on quantum-safe security if those communications were transmitted unprotected.
3. What NIST Has Already Done
The US National Institute of Standards and Technology (NIST) finalized its first set of post-quantum cryptography standards in 2024, after an eight-year evaluation process involving cryptographers from around the world. The finalized algorithms — including CRYSTALS-Kyber for key exchange and CRYSTALS-Dilithium for digital signatures — are designed to be secure against both classical and quantum computer attacks. These are now the recommended standards for government systems and are being adopted by technology companies and security vendors globally.
4. What Organizations Need to Do
Businesses and organizations that handle sensitive data need to begin their post-quantum cryptography transition now — not when quantum computers become a demonstrated threat. The transition involves auditing where cryptography is currently used across your systems, identifying which systems use quantum-vulnerable algorithms, prioritizing high-value and long-lived data for early migration, testing post-quantum algorithm implementations, and planning for the operational complexity of running hybrid classical and post-quantum systems during the transition period. This is a multi-year program for most organizations, which is why starting now is the right call.
5. What Everyday Users Should Know
For most everyday users, the transition to post-quantum cryptography will happen largely invisibly — your browser, your apps, and your online services will update their cryptographic implementations in the background, and you will not need to take action for most consumer-facing applications. Where you may need to pay attention is in password managers and authentication apps, which will likely prompt updates as they migrate to post-quantum algorithms. Keeping your software updated — as always — is the most important action for everyday users.
6. What to Watch For
Over the next two to three years, watch for post-quantum cryptography announcements from major technology platforms including Google, Apple, Microsoft, and major cloud providers — these will signal that the transition is actively underway at scale. VPN providers, password managers, and secure messaging apps are likely to be early movers, as their entire value proposition depends on cryptographic security. When you see these updates, the practical action is simply to install them promptly rather than deferring updates as many users do.
Conclusion
Post-quantum cryptography is not a future problem — it is a current planning imperative for anyone responsible for long-lived sensitive data, and a background transition that everyday users will experience through software updates over the next several years. Understanding the basic threat model helps you take the right actions: keep software updated, support organizations that prioritize cryptographic security, and recognize that the encryption protecting most of your digital life is being actively upgraded to remain secure in a post-quantum world.
