Quantum encryption most precisely means quantum key distribution, QKD, which uses the physics of individual photons to share a secret key over a dedicated optical link in a way that reveals any eavesdropper. The term is also used, loosely, for post-quantum cryptography, which is ordinary mathematics designed to resist quantum computers and is the technology that will actually protect everyday internet traffic. Nobody knows when quantum computers will break current encryption; estimates span a decade to several, and the risk today is recorded traffic decrypted later. Homomorphic encryption, often mentioned alongside, is a separate idea that allows computing on encrypted data without decrypting it.
The phrase quantum encryption appears in physics papers, standards documents and product brochures meaning different things, and conflating them leads people to worry about the wrong risks or buy the wrong products. This guide defines the three technologies that share the label, explains which matters for whom, addresses the timeline question honestly, assesses the practical risk, and explains homomorphic encryption for readers who encounter it in the same conversations.
Quantum key distribution: encryption from physics
Quantum key distribution uses quantum mechanics rather than mathematics to protect a key exchange. In the best-known protocol, BB84, one party sends photons polarised in randomly chosen states over an optical fibre or free-space link; the other measures them with randomly chosen bases. Quantum mechanics guarantees that measuring a photon disturbs it, so an eavesdropper intercepting the photons introduces errors the two parties can detect by comparing a sample of their results. If the error rate is low, the remaining bits form a shared secret key, which is then used with a conventional cipher such as AES to encrypt data. QKD does not itself encrypt messages; it distributes keys whose secrecy is guaranteed by physics rather than computational hardness.
Its limitations are practical and severe for general use. It requires a dedicated optical channel between the two endpoints, either fibre or line of sight, with distance limits of a few hundred kilometres before trusted relay nodes are needed. It cannot run over the ordinary internet. It authenticates nothing on its own, so it still requires classical authentication to prevent an attacker from impersonating an endpoint. And the implementations, being physical devices, have exhibited side-channel vulnerabilities that the theory does not cover. National security agencies in several countries have stated that they do not recommend QKD for securing government communications and prefer post-quantum cryptography. QKD is used in some banks, government links and research networks, and it is not something an individual will ever configure.
Post-quantum cryptography: encryption from new mathematics
Post-quantum cryptography, PQC, is the practical response to the quantum threat described in the quantum computers guide on this site. It consists of public-key algorithms for key exchange and signatures built on mathematical problems that neither classical nor quantum computers are known to solve efficiently, most prominently structured lattices, along with hash-based and code-based schemes. Standards bodies have finalised algorithms including ML-KEM for key exchange and ML-DSA and SLH-DSA for signatures. They run in software on any device, drop into existing protocols such as TLS, and are already deployed in hybrid mode alongside classical algorithms in major browsers and messaging apps.
When someone asks about quantum encryption algorithms for their organisation or their own security, PQC is almost always the answer. The post-quantum cryptography guide on this site explains how the algorithms work, and the quantum-safe encryption guide covers deploying them.
The marketing label
Some consumer products describe themselves as offering quantum encryption or quantum-proof security. In many cases this means AES-256, which is already considered secure against quantum attack for reasons explained in the quantum computers guide, or it means nothing specific. A product that mentions quantum without naming a standardised post-quantum algorithm and where it is used should be treated as ordinary encryption with an ambitious label. Ask which algorithm, in which part of the protocol, and whether it is hybrid with a classical algorithm.
When will quantum computers break encryption?
The honest answer is that nobody knows, and the reasons are instructive.
Breaking RSA-2048 or a 256-bit elliptic curve with Shor's algorithm requires a fault-tolerant quantum computer with thousands of logical qubits, which in turn requires millions of physical qubits at today's error rates, running coherently for hours. Current machines have at most a few thousand noisy physical qubits and can sustain computations for fractions of a second. Progress is real: qubit counts grow, error rates fall, error-correction demonstrations improve, and algorithmic improvements have reduced resource estimates several times. But there is no established scaling law for quantum hardware comparable to the historical trend in classical chips, and several hard problems in error correction and control remain.
Expert surveys typically find a spread of opinion, with a meaningful minority expecting a cryptographically relevant machine within a decade, a larger group within two decades, and some expecting longer or never. Standards bodies have set migration deadlines for their systems around the early to mid 2030s, not because they know the machine will exist then, but because migration takes a decade and recorded data has a long shelf life. Planning should assume uncertainty: protect long-lived data now, and do not defer because a date has not arrived.
Assessing the quantum computing encryption risk
The risk breaks down by what is protected and for how long.
Data in transit with long-term sensitivity is at the highest risk, because it can be recorded now and decrypted later. This includes communications of governments, companies, journalists, activists and anyone whose messages would still matter in fifteen years. Post-quantum key exchange, already in current browsers and in messengers such as Signal and iMessage, addresses it.
Data at rest encrypted with AES-256 is at low risk. The symmetric cipher survives, and the key was never exchanged over a network. Files, disks and archives protected with strong passphrases, as the file and disk encryption guides on this site describe, are not the quantum problem.
Data at rest encrypted to a public key, such as PGP-encrypted archives or files in some cloud services, inherits the public-key vulnerability. Re-encrypting long-lived archives with symmetric passphrases or post-quantum tools as they mature is prudent.
Signatures and authentication are at risk only once a machine exists, since a forgery must happen at verification time. Software update signing, certificate authorities and hardware key infrastructure need to migrate before that point, and are doing so.
For an individual, the actionable list is short: keep software updated, prefer services adopting post-quantum protocols, use AES-256 for long-lived files, and be sceptical of quantum marketing.
Homomorphic encryption: a different question
Homomorphic encryption has nothing to do with quantum computing but is often grouped with it under the heading of advanced cryptography, so it is worth defining. Ordinary encryption protects data at rest and in transit but requires decryption to compute on it, which is why a cloud service that processes your data must be able to read it. Homomorphic encryption allows specific operations, and in fully homomorphic schemes arbitrary computation, to be performed directly on ciphertext, producing a ciphertext that decrypts to the correct result. The processing party never sees the plaintext.
Applications include privacy-preserving analytics on medical or financial data, private queries to a database, and some secure voting and machine learning schemes. The technology works and is deployed in limited settings, but fully homomorphic computation remains orders of magnitude slower than computing on plaintext, so it is used where the privacy requirement justifies the cost. Notably, the leading fully homomorphic schemes are themselves based on lattice problems, the same family that underlies post-quantum cryptography, which is one reason the two are mentioned together.
A five-point summary
- Quantum key distribution uses physics over dedicated links; it is niche and not for individuals.
- Post-quantum cryptography uses new mathematics on ordinary hardware; it is the real answer.
- Products claiming quantum encryption without naming a standardised algorithm are relabelled ordinary encryption.
- The timeline for quantum computers breaking encryption is uncertain; long-lived data needs protection now regardless.
- Homomorphic encryption enables computing on encrypted data and is unrelated to quantum, though related in mathematics.
What physicists, standards bodies and security agencies say
The distinctions above follow the technical literature and official positions.
Physicists describe quantum key distribution as providing key secrecy grounded in quantum mechanics, subject to distance limits, the need for dedicated channels, classical authentication and implementation security, and several national security agencies have stated they do not endorse QKD for government use and recommend post-quantum cryptography instead.
Standards bodies have published post-quantum key encapsulation and signature standards based on lattice and hash problems and have set migration timelines, while describing the arrival of a cryptographically relevant quantum computer as uncertain.
Cryptographers describe homomorphic encryption as enabling computation on ciphertexts with a substantial performance cost, deployed in specific privacy-sensitive applications, and note that leading fully homomorphic schemes rest on lattice assumptions shared with post-quantum cryptography.
Know which quantum you are being sold
When you see quantum encryption, ask which of the three it is. If it is key distribution, it is for a bank's fibre link, not your laptop. If it is post-quantum cryptography with a named standard, it is the protection your browser already has. If it is neither, it is a label. The post-quantum guides on this site cover the algorithms that matter and how they are reaching your devices.
Frequently asked questions
What is quantum encryption?
Most precisely, quantum key distribution, which uses the physics of photons to share a secret key so that any eavesdropping disturbs the transmission and is detected. The term is also loosely applied to post-quantum cryptography, mathematical algorithms designed to resist quantum computers, and to products that simply mean strong encryption. Only post-quantum cryptography is relevant to ordinary users.
What is a quantum encryption algorithm?
Usually people mean a post-quantum algorithm: a key exchange or signature scheme such as ML-KEM or ML-DSA, based on lattice or hash problems that quantum computers are not known to solve efficiently. They run on ordinary computers. Quantum key distribution protocols such as BB84 are sometimes also called quantum encryption algorithms, though they distribute keys rather than encrypt.
When will quantum computers break encryption?
There is no reliable date. Current quantum computers are far too small and error-prone to run Shor's algorithm at useful scale. Estimates from researchers and standards bodies span roughly a decade to several decades, with real uncertainty. The practical planning assumption is that data needing secrecy beyond the 2030s should be protected with post-quantum key exchange now.
What is the quantum computing encryption risk for ordinary people?
The direct risk is that encrypted traffic recorded today could be decrypted later, exposing anything long-lived. Indirect risks include forged signatures on software updates and impersonation once a machine exists. For most individuals, keeping software updated so that post-quantum protocols arrive automatically addresses the risk; the infrastructure is doing the work.
What is homomorphic encryption?
A form of encryption that lets computations be performed on encrypted data, producing an encrypted result that decrypts to the answer, without the party doing the computing ever seeing the plaintext. It enables outsourcing processing to a cloud without revealing the data. It is unrelated to quantum computing, though the two are often mentioned together as advanced cryptography.
Last reviewed and updated on . Plain text version: /encryption/what-is-quantum-encryption.txt.
