Quantum Cryptography & Post-Quantum Encryption
Quantum cryptography and quantum computing, hands-on: send a key with photons (BB84) and catch an eavesdropper, watch Shor's algorithm factor a number and Grover's search find an answer, see which encryption is quantum-safe, and run real post-quantum ML-KEM (Kyber) and ML-DSA in your browser.
Send a secret key with single photons
Alice sends photons polarised in a random direction: + basis (↔ = 0, ↕ = 1) or × basis (⤢ = 0, ⤡ = 1). Bob measures each one in a random basis. Afterwards they compare bases (not bits) in public and keep only the photons where they matched. If Eve measures photons on the way, she disturbs about a quarter of the kept ones, and Alice and Bob see the errors.
The first photons, one by one
Green rows are kept (same basis). Orange = an error Alice and Bob will find when they compare a sample. A grey eye = Eve measured that photon.
Error rate vs how much Eve listens
Above about 11% errors no secret key can be distilled, so Alice and Bob throw the key away and try again. Below it, “privacy amplification” shrinks the key so Eve knows nothing about what is left (key rate 1 − 2·h(error)).
How a quantum computer factors a number
To factor N, pick a number a and find the period r of aˣ mod N (how often it repeats). The quantum computer finds r by putting every x in superposition at once and using the quantum Fourier transform; then plain maths turns r into the factors. This is simulated exactly here for N up to 255. To see the actual gates, open the Shor circuit in the Quantum Computer Simulator.
1. The repeating pattern aˣ mod N
2. What the quantum computer measures
3. From the period to the factors
Find one item in an unsorted list, √N times faster
All items start equally likely. Each Grover step flips the sign of the answer (the oracle), then reflects every amplitude about the average. The answer grows, the rest shrink. Stop at the right moment and measuring gives the answer almost surely; go too far and it shrinks again. The same algorithm as a real gate circuit: Grover search on 3 qubits.
What Grover means for passwords and keys
Which encryption survives a quantum computer?
Security in bits = about how many 2ⁿ steps the best known attack needs. Sizes are the public key and the ciphertext or signature, in bytes. Post-quantum keys are bigger: that is the main cost of switching.
Harvest now, decrypt later: is your data at risk? (Mosca's rule)
Attackers can record encrypted traffic today and decrypt it once a big enough quantum computer exists (“Q-Day”). If the years your data must stay secret plus the years it takes to switch to post-quantum encryption is more than the years until Q-Day, you are already late.
How big a quantum computer breaks RSA?
These are published estimates; they keep dropping as the algorithms improve. Today's largest machines have about a thousand noisy physical qubits, and nobody has factored anything bigger than tiny numbers with Shor's algorithm.
Check a website
Opens the Quantum-Safe Website Checker: does the site use post-quantum encryption today?
Real post-quantum key exchange: ML-KEM (Kyber)
The new NIST standard FIPS 203, running in your browser (the open-source noble-post-quantum library, loaded only when you press a button). Bob publishes a public key; Alice “encapsulates” a random secret to it; only Bob can “decapsulate” it. The same thing Chrome and Firefox do on every HTTPS visit to sites that support it.
Post-quantum signatures: ML-DSA (Dilithium) and SLH-DSA (SPHINCS+)
Is your own browser quantum-safe?
Asks Cloudflare which key exchange your browser just used to reach it (one small request to cloudflare.com).
Quantum computing and cryptography, explained
A quantum computer uses qubits, which can be in a mix (superposition) of 0 and 1 and can be entangled with each other. For most jobs that is no faster than a normal computer, but for a few problems it is enormously faster, and two of those problems hold up most of today's internet security. This page lets you try the ideas yourself: quantum key distribution, Shor's and Grover's algorithms, and the new post-quantum cryptography (also called quantum-safe, quantum-proof or quantum-resistant encryption) that replaces what quantum computers will break.
What a quantum computer breaks, and what it doesn't
- Shor's algorithm (1994) factors big numbers and solves discrete logarithms quickly. That breaks RSA, Diffie–Hellman and elliptic-curve cryptography (ECDSA, X25519, and the secp256k1 keys of Bitcoin and Hive): almost all public-key encryption and digital signatures in use today.
- Grover's algorithm (1996) searches √N times faster. It halves the strength of symmetric keys and hashes, so AES-256 stays safe (128 bits left) and AES-128 drops to a still-hard 64-bit level.
Quantum cryptography vs post-quantum cryptography
Quantum cryptography (quantum key distribution, QKD, like BB84) uses physics: single photons over a fibre or to a satellite, where any eavesdropper leaves errors. It needs special hardware and a direct link. Post-quantum cryptography is normal software built on maths problems that quantum computers are not known to solve, mostly lattices. It runs on any phone or server, which is why the internet is moving to it.
The new standards
In August 2024 NIST published the first post-quantum standards: FIPS 203 ML-KEM (from CRYSTALS-Kyber) for key exchange, FIPS 204 ML-DSA (from CRYSTALS-Dilithium) and FIPS 205 SLH-DSA (from SPHINCS+) for signatures. FN-DSA (Falcon) and the code-based HQC (chosen in March 2025 as a backup) follow. Browsers already combine ML-KEM-768 with X25519 (“X25519MLKEM768”) so a connection stays safe even if one of the two is ever broken. NIST plans to deprecate RSA and elliptic curves around 2030 and disallow them by 2035.
Questions people ask
- When will quantum computers break encryption (Q-Day)?
- Nobody knows. Estimates range from about 2030 to the 2040s. Published estimates for breaking RSA-2048 dropped from about 20 million noisy qubits (2019) to under one million (2025); today's machines have about a thousand. Data recorded now can be decrypted later, which is why the switch is happening already.
- Is Bitcoin quantum-safe?
- Not yet. Its signatures use elliptic curves (secp256k1), which Shor's algorithm breaks. Coins whose public key is visible on the blockchain (reused or old addresses) would be at risk first. Hive keys use the same curve. Mining (SHA-256) is only slightly affected by Grover.
- Is AES quantum-proof?
- AES-256 is considered safe: Grover's search would still need about 2¹²⁸ steps. That is why the password tab of the Cryptography Lab uses AES-256.
- How do I know if a website is quantum-safe?
- Use the Quantum-Safe Website Checker: it tests whether the site's HTTPS accepts the post-quantum key exchange X25519MLKEM768.
- Does quantum key distribution make encryption unbreakable?
- In theory the key exchange is protected by physics, but real systems have been attacked through imperfect hardware, need a trusted link to authenticate who you are talking to, and cover limited distances. Security agencies such as the NSA and the UK NCSC recommend post-quantum cryptography instead for most uses.
Related: Quantum Computer Simulator (build circuits, Grover, Shor) · Cryptography Lab · Quantum-Safe Website Checker · MES Quantum Lab · Quantum Entanglement · Prime Numbers · Enigma Machine