Everyday Encryption and the Arrival of Quantum Computers

Summary. Encryption has two halves and they age differently. AES-256 scrambles the contents of your data, and a quantum computer barely dents it. RSA and elliptic-curve cryptography let two strangers agree on a key over an open network, and a large quantum computer breaks them completely. No such machine exists in 2026. Google, Apple, and Signal have started replacing the vulnerable half anyway, because an attacker can record encrypted traffic today and decrypt it once the machine arrives. This piece explains which half breaks and why, what a stolen password costs an attacker on current hardware, and the concrete steps a phone owner, a desktop user, and a company should take before the timelines close.

Why a machine that does not exist already matters

Consider a letter sealed in a strongbox and handed to a courier who will hold it, unopened, for fifteen years. The courier is honest. The risk is the person waiting at the depot in 2041 with tools the courier never had.

Encrypted traffic sits in exactly this position. An intelligence service or a well-funded criminal group can copy an encrypted stream today, store it for the price of a hard drive, and wait. Cryptographers call the strategy harvest now, decrypt later. It is the reason the absence of a quantum computer in 2026 does not mean there is time to spare. What matters is not when the machine arrives but how long the data needs to stay secret. A password you rotate next week is safe. A diplomatic cable, a patent filing, a medical record, or a private key that unlocks a decade of archives has a shelf life long enough to outlast the wait.

The job AES-256 does

AES-256 is a symmetric cipher. One key both locks and unlocks, so your phone and Apple's servers hold the same 256-bit secret and each can scramble or restore the same file. It is fast, it runs on every operating system and messaging app and cloud service, and it protects the contents of data at rest and in transit. The United States adopted it in 2001 after a five-year open competition, and nothing has dislodged it since.

The strength of a 256-bit key comes from its size. There are 2²⁵⁶ possible keys, a number with seventy-eight digits. Bruce Schneier worked out the physical floor in Applied Cryptography. Erasing one bit of information costs a minimum quantity of energy fixed by thermodynamics, the Landauer limit. A perfect computer running at the temperature of deep space, colder than anything you could build, would consume more energy than the Sun emits across its whole lifetime merely counting through a fraction of the keyspace, before testing a single key against the ciphertext [1, 9]. Brute force was never a software problem. It is bounded by the energy budget of the observable universe.

Why a quantum computer does not change that

Quantum computers do not evaluate every key at once, which is the common misconception. The relevant tool against a symmetric cipher is Grover's algorithm, published in 1996 [2]. Grover searches an unsorted space in about the square root of the number of tries a classical machine would need. Against AES-256 that turns 2²⁵⁶ into roughly 2¹²⁸, which happens to be the strength of today's AES-128 [3, 4].

The square root sounds alarming and is not. The UK National Cyber Security Centre modelled the real cost in 2024 and found that a Grover attack on AES demands so many physical qubits, so much error correction, and so long a serial runtime that it stays out of reach for the foreseeable future [3]. The consensus in the field has held since 2014: AES-256 will remain secure for decades against any quantum computer that can be imagined [5]. One practical consequence follows. If you already use AES-256, you change nothing. If you use AES-128, move to AES-256, and most software already defaults there.

Why RSA and elliptic-curve keys do not survive

The exposed half of encryption is asymmetric. RSA and elliptic-curve cryptography solve a problem AES cannot: they let a laptop and a bank's server agree on a shared secret across a network neither one trusts, having never met. Their security rests on problems that are punishing for a classical computer, such as factoring a large number back into its two prime factors.

In 1997 Peter Shor published a quantum algorithm that dissolves that class of problem in polynomial time [6]. Shor's algorithm does not slow RSA down the way Grover slows AES. It breaks it. A sufficiently large, error-corrected quantum computer could factor a 2048-bit RSA key in roughly eight hours [3]. Every padlock in a browser, every HTTPS session, every VPN handshake, every code-signing certificate that leans on RSA or ECC to establish that first shared secret falls the moment such a machine runs.

No such machine runs today. The 2025 Quantum Threat Timeline survey of twenty-six experts and a separate 2026 cross-methodology analysis place the arrival of a cryptographically relevant quantum computer in a wide band, with most weight from 2030 to the middle of that decade and a smaller chance of something sooner [7, 8]. The threshold keeps dropping without any new hardware. Better algorithms have cut the estimated physical-qubit cost of breaking RSA-2048 from about twenty million qubits to under one million [8]. The uncertainty is the point. A defender cannot wait for a date that no one will announce in advance.

What has already shipped

The replacement is not a future event for the largest platforms. Three products already run hybrid post-quantum protection, which pairs a classical algorithm with a quantum-resistant one so an attacker must break both.

A current iPhone or a current Chrome already negotiates some connections with post-quantum protection and asks nothing of the user. Where the migration has landed, it is invisible by design.

The new standards

The National Institute of Standards and Technology finalized three replacement standards in August 2024, the end of an eight-year open competition among cryptographers worldwide [9, 10].

A fourth standard, HQC, was selected in March 2025 as a structurally different backup should lattice mathematics ever weaken [9]. The three finalized standards descend from the CRYSTALS submission, whose 2018 paper set out the underlying idea: security no longer rests on factoring a number but on finding a short vector in a lattice of hundreds of dimensions, a problem with no known quantum shortcut [11]. The geometry is optional for the user. What counts is whether the software vendor ships it, and vendors increasingly do.

The National Security Agency's CNSA 2.0 suite sets the sharpest enterprise deadlines. Software and firmware signing must use quantum-resistant algorithms exclusively by 2030, web browsers and cloud services by 2033, and national security systems complete the transition by 2035 [12, 13]. A June 2026 executive order set matching civilian dates: a federal migration pilot by 2027, key establishment by 2030, signatures by 2031 [10]. These are government mandates, and they act as the industry's shared clock the way the card networks' deadlines drove chip adoption years before any merchant faced a legal requirement.

What to run, by who you are

The right setup depends on how much of your day you want to give this.

The cost of guessing a password in 2026

Every year since 2020, Hive Systems rents current consumer GPUs and measures how long a brute-force attack takes against passwords of varying length and character set, hashed with bcrypt [14, 15]. The 2026 table ran on a rented fleet of sixteen Nvidia RTX 5090 cards.

The eight-character mixed password looks durable until the trend comes into view. It held for 225 years in the 2024 table, 164 in 2025, and 132 in 2026, a decline of twenty to twenty-five percent a year as GPUs grow faster and cheaper to rent [14, 15]. The 132-year figure also assumes blind exhaustion. When Hive Systems timed a predictable eight-character password of the kind people choose, a single RTX 5090 recovered it in about three seconds by trying likely patterns first [14]. This is why length beats complexity. A guessing attack drains a short keyspace almost at once regardless of how many symbols it holds, while every added character multiplies the work no strategy can skip.

Storage decides the rest. A password hashed with a slow, memory-hard function such as Argon2id costs the attacker real time per guess even after a database leak. A password kept as a fast SHA-256 hash, or in plaintext, offers no such cost and the breach is immediate. For any new system in 2026 OWASP recommends Argon2id with at least 19 MiB of memory and two iterations, tuned to be expensive on the parallel hardware attackers use [16]. bcrypt at a work factor of 12 or higher remains fine for systems already built on it, scrypt serves where Argon2 is unavailable, and PBKDF2 persists only for its FIPS-140 certification in regulated settings [16, 17].

How password strength is measured

Strength has a formula, and it is short. A password drawn at random has an entropy measured in bits:

E = L × log₂(N)

L is the length in characters. N is the size of the alphabet the characters were drawn from. Each added character multiplies the number of possible passwords by N, and log₂(N) is how many bits that one character contributes. The alphabet size depends on which kinds of characters are in play.

Take a 12-character password chosen randomly from all 95 printable characters. Its entropy is 12 × log₂(95) = 12 × 6.57 ≈ 78.8 bits, and the number of possible passwords is 95¹² ≈ 5.4 × 10²³. That is the count an attacker faces with no shortcut.

The word random is load-bearing. The formula measures the strength of a password a machine generated by rolling for each character. A password a person invented, such as P@ssw0rd123, contains far fewer real bits, because the capital at the front, the digits at the end, and the @-for-a substitution are the first patterns any cracking tool tries. This is why the predictable eight-character password in the Hive Systems test fell in three seconds while a random one of the same length and alphabet holds for far longer. The length is identical. The entropy is not.

How long a password survives

Entropy converts directly into time once you fix an attack rate. The table below assumes an offline attack against a fast, unsalted hash such as MD5 or NTLM, at 100 billion guesses per second, which is within reach of a single high-end GPU (an RTX 5090 benchmarks above 200 billion MD5 hashes per second) [14]. Average time to crack is half the keyspace divided by that rate.

Two lessons fall out of the table. Length outruns everything: adding characters multiplies the keyspace, while adding symbol variety only widens the alphabet a little. And storage changes the whole picture. These times are for a fast hash. A slow hash such as bcrypt or Argon2id cuts the guess rate by a factor of a million or more, which is why the eight-character mixed password that falls in nine hours against MD5 held for 132 years in the bcrypt-based Hive Systems table.

Building one you can use

NIST's 2025 revision of its digital identity guidance (SP 800-63B-4) sets the modern shape: a minimum of 8 characters, a recommended length of 15 or more, support for anything up to 64 characters, no mandatory composition rules, and no forced periodic resets [21]. Two constructions clear that bar.

A random string from a generator, 16 or more characters across all four character types:

qT7#pL2@wR9!kZ4x

A passphrase of six or more words chosen at random from a fixed list, the method the Electronic Frontier Foundation publishes as diceware [22]:

river-antler-copper-mosaic-lantern-drift

The passphrase is easier to type and remember and reaches the same strength through length rather than symbols. Its math is the entropy formula with the word list as the alphabet. The EFF long list holds 7,776 words, so each word adds log₂(7,776) ≈ 12.9 bits. Four words give 51.7 bits, which is weak. Six words give 77.5 bits, on par with the 12-character random string above. Seven give 90.5 bits. Do not shorten a phrase because the words look ordinary; the strength is in how many were possible at each position, not in whether the words are exotic. And never reuse the two examples printed here, since a published password is a known password.

Software that generates and stores them

A person cannot invent or remember dozens of 16-character random strings, and should not try. A password manager generates them, stores them encrypted under one master secret, and fills them in per site, which also ends reuse across sites. Every manager below includes both a random-character generator and a passphrase generator.

For a generated password without installing anything, the command line works on any Mac or Linux machine, and the Bitwarden CLI generates either form:

# 16 random bytes, encoded as ~22 printable characters
openssl rand -base64 16

# a 20-character password from letters, digits, and symbols
LC_ALL=C tr -dc 'A-Za-z0-9!@#$%^&*' < /dev/urandom | head -c 20; echo

# a 20-character mixed password via the Bitwarden CLI
bw generate --length 20 --uppercase --lowercase --number --special

# a 6-word diceware passphrase via the Bitwarden CLI
bw generate --passphrase --words 6 --separator -

The offline method needs no computer at all. Roll five dice, read the five digits as a lookup into the EFF long word list, and repeat six times. The randomness comes from the dice, so no software sees the result [22].

Passkeys remove the weakest link

Everything above assumes a human chose the password, and humans fail at this in documented ways. We reuse, we pick guessable patterns, and we forget the strong ones. A passkey deletes the shared secret instead of defending it. The device creates a public and private key pair, keeps the private half behind a fingerprint or face, and sends only the public half to the site. Nothing memorable exists to phish and nothing reusable exists to leak, because the server never held a secret in the first place.

Adoption has moved faster than most people assume. The FIDO Alliance counted 5 billion passkeys in active use in 2026, with 90 percent consumer awareness and 75 percent of people having enabled at least one [18, 19]. Organizations that deployed them report a 47 percent gain in security posture, 45 percent faster logins, and 35 percent fewer password-reset tickets [18, 20]. Awareness has outrun full replacement, and 57 percent of organizations that deployed passkeys still keep a phishable password as the everyday fallback [18]. Where a phone, bank, or email account offers a passkey, turning it on takes you out of the cracking economics entirely, because there is no password left to steal.

Sizing a password against a quantum attacker

The eight-character floor in most policies is a classical number, and a weak one. Grover's algorithm does to a password what it does to AES: it halves the effective entropy. A secret worth 128 bits against a classical attacker is worth only 64 bits against a quantum one, and 64 bits is crackable. To keep a chosen post-quantum security level, double the classical entropy behind the password.

The target on the left is the strength that survives a quantum search. The columns give the length needed to reach it, from a random generator or from an EFF-list passphrase.

A 12-character random string carries 79 bits classically, which Grover cuts to 39. A 16-character string gives 105 bits, or 53 after Grover. Neither survives a quantum attacker with time to spare. A 20-word diceware passphrase carries 258 bits, holding 129 after Grover, which is why the recommendations below reach lengths that look excessive against a classical GPU and are the point against a quantum one.

Length is the only lever that scales here, because doubling entropy means doubling characters, while widening the symbol set barely moves the number. Nobody types a 40-character random string by hand, so at these lengths the password lives in a manager and is generated, never invented.

Countermeasures, from a phone owner to an enterprise

Strength is one layer. The controls that stop the attacker from ever reaching a guessing position matter as much as the length of the secret. The tiers below build from the least effort to the most.

Anyone with a phone or a laptop. Turn on a password manager and let it generate a unique 20-character random password or a 10-word passphrase for every account, which reaches 65 post-Grover bits and ends reuse in one step. Turn on a passkey wherever one is offered, because it removes the password from the attack entirely. Add a second factor on every account that allows it, and prefer an authenticator app or a hardware security key over SMS, which is interceptable. Protect the manager's own master secret with a genuine passphrase of ten words or more, since that one secret guards all the others.

Power users and the security-minded. Raise generated passwords to 24 or more random characters, or 12 or more words, so the post-Grover strength clears 78 bits. Use a hardware security key (a FIDO2 device such as a YubiKey) as the second factor on high-value accounts, which resists phishing in a way codes cannot. Keep the vault in a manager that supports local or self-hosted storage such as KeePassXC or self-hosted Bitwarden. Reserve the longest secrets, 20 words or more, for the accounts that unlock the others: the password manager master, the primary email, and any account that can reset the rest.

Enterprise and IT teams. Set a policy floor of 15 characters as NIST now recommends, remove forced periodic rotation and composition rules, which push people toward predictable patterns, and screen new passwords against known-breach lists [21]. Require phishing-resistant multi-factor authentication (FIDO2 or passkeys) for every employee, not a phishable code, since 57 percent of organizations that deployed passkeys still leave a weak fallback in place [18]. Store credentials with Argon2id at the OWASP parameters, never a fast hash [16]. Then treat the password layer as the near term and the key layer as the mandate: inventory every use of RSA and ECC, rank systems by how long their data must stay secret, and begin migrating the longest-lived ones to the FIPS 203 and 204 standards now, ahead of the 2030 and 2033 CNSA 2.0 deadlines [12, 13]. Harvest-now-decrypt-later means an attacker is already recording the traffic those keys protect.

What to do this month

None of this depends on a quantum computer breaking tomorrow. It depends on one fact that already holds. Data worth protecting for more than a few years is being copied by patient adversaries, and repairing the asymmetric half of the stack takes years to finish. The clock that matters started some time ago.

References

1. Schneier, Bruce. Applied Cryptography: Protocols, Algorithms, and Source Code in C, 2nd ed. Wiley, 1996. The thermodynamic energy-limit argument against brute-forcing large symmetric keys.
2. Grover, Lov K. "A Fast Quantum Mechanical Algorithm for Database Search." Proceedings of the 28th Annual ACM Symposium on Theory of Computing (STOC '96), 1996, pp. 212–219.
3. D., Sarah, and Peter C. "On the Practical Cost of Grover for AES Key Recovery." UK National Cyber Security Centre, presented at the 5th NIST PQC Standardization Conference, 2024.
4. Fortinet. "Shor's and Grover's Algorithms: Quantum Threats to Encryption." Fortinet Cyberglossary, accessed 2026. Effective security-level impact on AES-128 and AES-256.
5. Valsorda, Filippo. "Quantum Computers Are Not a Threat to 128-bit Symmetric Keys." words.filippo.io, 2014.
6. Shor, Peter W. "Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer." SIAM Journal on Computing 26, no. 5 (1997): 1484–1509.
7. Mosca, Michele, and Marco Piani. "Quantum Threat Timeline Report 2025." Global Risk Institute / evolutionQ, published March 2026. Survey of 26 international quantum computing experts.
8. QuantumZeitgeist. "Cryptographically Relevant Quantum Computer: Complete 2026 Guide." quantumzeitgeist.com, May 2026. Physical-qubit cost estimates for breaking RSA-2048.
9. National Institute of Standards and Technology. "Announcing Approval of Three Federal Information Processing Standards (FIPS) for Post-Quantum Cryptography." NIST, August 13, 2024. FIPS 203, 204, 205; HQC selection announced March 11, 2025.
10. QRAMM. "NIST Post-Quantum Cryptography Standards: Complete Guide to FIPS 203, 204, 205." qramm.org, 2026. Federal civilian migration deadlines from the 2026 executive order.
11. Bos, Joppe, Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, John M. Schanck, Peter Schwabe, Gregor Seiler, and Damien Stehlé. "CRYSTALS – Kyber: A CCA-Secure Module-Lattice-Based KEM." 2018 IEEE European Symposium on Security and Privacy (EuroS&P), 2018, pp. 353–367.
12. National Security Agency. "Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)." NSA, 2022, with subsequent transition-timetable updates.
13. Entrust. "NSA Announces New Post-Quantum Resistant Algorithm Suite 2.0 and Transition Timetable." Entrust Blog, October 2022. CNSA 2.0 sector-by-sector deadlines.
14. Hive Systems. "The 2026 Password Table Is Here: How Fast Can a Hacker Crack Your Password?" hivesystems.com, July 14, 2026.
15. Hive Systems. "Hive Systems Releases 2026 Password Table: Third Straight Year of Faster Cracking, as AI Lowers the Barrier for Attackers." PR Newswire, July 14, 2026.
16. OWASP Foundation. "Password Storage Cheat Sheet." OWASP Cheat Sheet Series, 2026 revision. Argon2id, scrypt, bcrypt, and PBKDF2 parameter recommendations.
17. WorkOS. "Picking a Password Hash: A Developer's Guide to Argon2, bcrypt, and scrypt." WorkOS Blog, April 2026.
18. FIDO Alliance. "The State of Passkeys 2026: Global Consumer and Workforce Report." FIDO Alliance, May 7, 2026. Survey of 11,000 consumers and 1,400 enterprise decision-makers across ten countries.
19. FIDO Alliance. "Five Billion Passkeys: A Milestone, Not a Finish Line." FIDO Alliance, May 7, 2026.
20. Descope. "2026 FIDO Report: Passkeys at Global Scale." Descope Blog, 2026. Organizational outcomes from passkey deployment.
21. National Institute of Standards and Technology. "Digital Identity Guidelines: Authentication and Authenticator Management." NIST SP 800-63B-4, 2025. Minimum and recommended password length, no composition rules, no forced periodic rotation.
22. Electronic Frontier Foundation. "EFF Dice-Generated Passphrases" and "Deep Dive: EFF's New Wordlists for Random Passphrases." eff.org, 2016. The 7,776-word long list at 12.9 bits per word.

Sources: NIST Computer Security Resource Center, UK National Cyber Security Centre, Global Risk Institute, Hive Systems, OWASP Foundation, FIDO Alliance, Signal Foundation, Apple Security Research, Google Chrome Security Team, arXiv, SIAM Journal on Computing.

Last updated: July 20, 2026