Much of the modern internet depends on a quiet bargain: when you visit a website, send a message, install a software update, or pay for something online, mathematical puzzles help establish that the connection is private and that the other party is genuine. The familiar names behind that bargain include RSA and elliptic-curve cryptography. They are not suddenly broken today. But their long-term security rests on problems that sufficiently capable quantum computers could solve far more efficiently than ordinary machines can.
That is why a large, mostly invisible technology migration is underway. It is called post-quantum cryptography, or PQC: new encryption and digital-signature methods designed to run on conventional hardware while resisting known quantum attacks. The change matters not because a quantum computer is about to read everyone’s messages tomorrow, but because security upgrades across the world take years—and some secrets need to remain secret for decades.
Public-key cryptography does several distinct jobs. It helps two devices agree on a temporary secret for an encrypted conversation; it helps verify the identity of websites and services; and it supports digital signatures, which establish that a software update, document, or transaction was authorized and has not been altered. Quantum computing threatens many widely used public-key systems because of an algorithm, proposed by mathematician Peter Shor, that would make factoring and certain related calculations much easier for a powerful enough quantum machine.
The key qualifier is important: today’s quantum computers are not known to be capable of breaking the public-key encryption used at internet scale. The relevant machine is often described as a cryptographically relevant quantum computer. Its arrival date is uncertain, and estimates are not promises. Hardware progress may accelerate, stall, or reveal engineering barriers that take longer than expected.
Still, uncertainty does not eliminate the problem. An adversary can capture encrypted traffic now and preserve it for later. If the material remains valuable when quantum capabilities improve, the attacker may eventually be able to decrypt it. This scenario is commonly called “harvest now, decrypt later.” It is especially relevant to information with a long useful life: diplomatic communications, health records, industrial designs, sensitive research, legal files, and long-lived personal archives.
Not every encrypted item has the same exposure. Data protected by a short-lived session key may become unimportant quickly. Other data can remain sensitive for a generation. The PQC transition is therefore less like reacting to one imminent cyberattack than replacing aging infrastructure before its design assumptions become unacceptable.
The name can be misleading. Post-quantum cryptography generally does not require a quantum computer, a special quantum network, or exotic hardware at each endpoint. It is software-friendly cryptography based on mathematical problems that are not currently known to be efficiently defeated by quantum algorithms. The goal is to make familiar systems—browsers, virtual private networks, cloud services, payment infrastructure, device firmware, and software-signing systems—safer against both conventional and anticipated quantum adversaries.
This differs from quantum key distribution, which uses properties of quantum physics to help distribute keys over specialized links. Quantum key distribution may have particular applications, but it is not the general replacement path for the internet. PQC is the broad migration strategy because it can be incorporated into existing digital systems and networks.
In August 2024, the U.S. National Institute of Standards and Technology finalized its first principal PQC standards after a multiyear public evaluation process. ML-KEM is the principal standard for key establishment: it helps two parties create a shared secret over an untrusted network. ML-DSA is the principal standard for digital signatures. SLH-DSA is another signature standard based on a different mathematical approach, offering a valuable alternative if problems emerge with the primary family.
Those names are technical, but the division of labor is intuitive. Key establishment protects the privacy of a connection. Digital signatures protect authenticity and integrity. A secure future needs both. Encrypting a connection is not enough if an attacker can later forge the signature on a malicious software update or impersonate a service.
Cryptography is embedded in more places than most organizations realize. It appears in web protocols, mobile applications, identity systems, databases, backups, code-signing tools, routers, industrial equipment, smart cards, vendor products, and the software libraries on which all of those systems depend. Some cryptography is obvious in a security configuration; some is buried inside firmware or an outsourced service.
That is why the first step recommended by cybersecurity agencies is usually not “turn on PQC.” It is to build a cryptographic inventory: a map of where public-key algorithms are used, what data and processes they protect, who owns each dependency, and how difficult it will be to replace or update. An organization cannot sensibly prioritize its migration if it does not know which old locks it has installed.
Compatibility is another challenge. New algorithms can use larger keys, signatures, or messages than older ones. That may affect older devices, bandwidth-constrained networks, certificate systems, or applications that made overly tight assumptions about field sizes. Security teams must test entire chains of communication, not merely swap a cryptographic library in isolation.
The preferred transition pattern in many network settings is hybrid cryptography. A hybrid key exchange combines a traditional method with a post-quantum method, so a connection remains protected if either component holds up. This gives deployers a path to gain quantum resistance while retaining a familiar layer of classical protection during the migration. It also reduces the risk of betting everything on a single new approach too early.
The transition is no longer just a standards exercise. Internet companies have begun deploying post-quantum key agreement in real traffic, often using hybrid designs. This matters because the open web provides an unusually demanding proving ground: it includes countless browsers, operating systems, networks, servers, middleboxes, and devices that must interoperate without users noticing the cryptographic machinery beneath the page.
Deployment does not mean the migration is complete. Browser-to-network protection is only one segment of a possible path. A connection can pass through content-delivery networks, cloud environments, internal services, enterprise networks, and older devices, each with its own cryptographic choices. Digital signatures—including certificates, signed code, and device updates—present another major task beyond protecting a single transport connection.
For ordinary users, the most noticeable outcome may be that nothing appears to change. That is a sign of success. Strong security infrastructure works best when it becomes a dependable default rather than a feature people must understand or enable. People can still help indirectly by using supported operating systems and browsers, accepting legitimate security updates, and retiring devices that no longer receive them.
The broader lesson extends beyond quantum computing. Cryptographic systems should be designed for change. No security algorithm lasts forever, and organizations that can identify, update, and verify their cryptography quickly are better prepared for newly discovered weaknesses as well as quantum advances. That capacity is called crypto-agility, and it may be the lasting achievement of the post-quantum transition.
Quantum computers have not made today’s internet encryption obsolete. But the possibility that they could eventually break major public-key systems has changed the planning horizon for cybersecurity. Standards now exist, production deployments have begun, and the work has shifted from choosing algorithms to finding every place old cryptography lives.
The migration will be uneven and lengthy because the internet is uneven and lengthy: it includes new cloud platforms, decades-old hardware, global supply chains, and systems whose owners may not even know what cryptography is inside them. Replacing the locks before the threat arrives is precisely the point. In security, the least dramatic upgrades are often the ones that matter most.
Photo by panumas nikhomkhai on Pexels.
A growing number of AI features no longer begin by sending your request to a distant data center. They begin inside the device in your hand: a phone, laptop, earbud case, camera,…
Passkeys remove one of the internet’s oldest security traps: the reusable secret. Instead of typing a password that a convincing fake site can capture and reuse, a person unlocks…
For a long time, computer security was organized around a simple picture: the organization owned a network, a firewall guarded its edge, and the systems inside that edge were…