Quantum computing will break current encryption within a decade

What's this about?

People disagree about whether quantum computers will break today’s common codes within the next ten years.

The key question asks if such a machine will exist by 2036.

What supporters say

• A known math trick called Shor’s method could crack RSA and elliptic-curve codes with a strong quantum computer.
• Groups may need many years to replace code in apps, devices, websites, and old files.
• Error fixing may help quantum machines grow larger and work more reliably.

What critics say

• Today’s quantum machines remain far too small and unreliable for this task.
• A quantum computer would not break every kind of code we use today.
• Experts disagree about whether anyone can build the needed machine by 2036.

How to read this

The number of points does not show which side wins; check how strong the proof behind each point is.

The bottom line

Quantum code-breaking poses a real risk, so groups should start preparing now.

Still, experts cannot yet say with trust that quantum computers will break today’s main codes within ten years.

The claim that quantum computers will break today’s encryption within a decade is plausible as a serious security risk, but not established as a reliable forecast. The key question is whether a machine capable of breaking widely used RSA and elliptic-curve systems will exist by 2036.

The case for

The strongest argument is that the basic attack is already known. Shor’s algorithm provides an efficient way for a sufficiently powerful quantum computer to factor the large numbers used by RSA and solve the mathematical problems behind elliptic-curve cryptography. The difficulty is not finding the attack, but building a machine large and reliable enough to run it. Published estimates differ sharply depending on assumptions about hardware, error rates, connections between components and error correction, but they show that the attack has been technically mapped out. 1 (see Figure 2)

A decade is also a meaningful risk horizon because replacing cryptographic systems takes years. Governments and companies may need to update software, hardware, certificates, communication protocols and systems holding long-lived data. The UK National Cyber Security Centre recommends beginning this migration now, while NIST’s standards for post-quantum systems, including ML-KEM and ML-DSA, reflect the same precaution.

There is also a “harvest now, decrypt later” risk. Attackers can collect encrypted information today and wait until quantum machines become capable of reading it. That makes early preparation sensible for secrets that must remain confidential for many years, even if the breakthrough arrives after 2036.

Research into quantum error correction offers a possible route to the required machines. Experiments have reported lower error rates as error-correcting codes grow, and industry roadmaps promise larger, more reliable systems. But this is the weakest support for the specific 2036 deadline. Current demonstrations remain far below the scale needed for cryptanalysis, and company targets are plans, not independent proof.

The case against

Today’s quantum computers are still separated from a cryptographically useful machine by a large and unresolved engineering gap. One peer-reviewed estimate puts the requirement for attacking RSA-2048 at roughly 20 million noisy physical qubits under its assumptions. Existing experiments involve much smaller processors, limited error-correction tests or tasks unrelated to breaking encryption. The National Academies describes such computing as technically plausible, but highlights major unanswered questions involving scale, error correction and engineering. 4

Forecasts also do not establish a dependable ten-year timetable. Experts and institutions disagree about when a cryptographically relevant machine will exist. Corporate roadmaps show possible paths, but they remain projections and may reflect commercial incentives. The available evidence does not provide a well-supported probability that all the necessary advances in manufacturing, reliability, scaling and system integration will arrive by 2036. 5

The phrase “current encryption” can also make the threat sound broader than it is. Shor’s algorithm directly threatens RSA and elliptic-curve systems, which are widely used for public-key security. Quantum computers would give a more limited speed advantage against symmetric encryption through Grover’s algorithm, and that risk can generally be reduced by using larger keys. 6

The bottom line

The evidence strongly supports the mechanism and the need to prepare, but it only weakly supports the prediction that RSA and elliptic-curve systems will be breakable by 2036. A sufficiently capable, fault-tolerant quantum computer would seriously threaten those systems, and migration to post-quantum alternatives should begin before such a machine exists. 1

But that operational advice is not proof of the deadline. The strongest evidence concerns what quantum computers could do and how long defensive migration may take. The weakest and most uncertain evidence concerns whether the required hardware will be built within ten years. The claim is therefore best treated as a serious planning scenario, not an established prediction. Preparing now is justified by long transition times and the risk to long-lived secrets, while confidence in the exact 2036 date remains materially lower. (see Figure 4)