Why post-quantum, and why now
A large enough quantum computer would break the public-key cryptography that protects almost everything online. The migration has to start before that machine exists — here is why.
The short version
Today's public-key cryptography (RSA and elliptic curve) is what keeps web traffic, VPNs, signed software, and stored secrets private and trustworthy. A sufficiently powerful quantum computer running Shor's algorithm would break all of it. That machine does not exist yet, but the migration to quantum-safe cryptography takes years and some data is already being recorded for later decryption — so the work starts now, not on the day the machine arrives.
Nearly every secure connection you make relies on two kinds of cryptography working together. A symmetric cipher such as AES does the bulk encryption of the data, and a public-key algorithm such as RSA or elliptic-curve Diffie-Hellman does the key exchange and the digital signatures that establish trust. The public-key half is the part quantum computers threaten.
What actually breaks
In 1994 Peter Shor showed that a quantum computer could factor large numbers and compute discrete logarithms efficiently. Those two hard problems are exactly what RSA and elliptic-curve cryptography rely on for their security. A cryptographically relevant quantum computer running Shor's algorithm would therefore recover private keys from public keys — forging signatures and decrypting key exchanges that are considered unbreakable today.
Symmetric cryptography fares far better. Grover's algorithm speeds up brute-force search, which effectively halves the security of a symmetric key — but that is answered simply by using a longer key, so AES-256 remains strong. The urgent, structural problem is the public-key layer, and that is what post-quantum cryptography (PQC) replaces.
Why you cannot wait for the machine to arrive
There are two reasons the deadline is now rather than on some future Q-Day. The first is simple engineering time: finding every place your organization uses vulnerable cryptography, testing replacements, and rolling them out across production without breakage is a multi-year program, not a patch.
The second reason is harvest-now, decrypt-later. An adversary can record your encrypted traffic today and simply store it until a quantum computer is available to decrypt it retroactively. Any secret that must stay confidential for longer than the time-to-quantum is therefore already exposed — the interception is happening now, and only the decryption waits on hardware.
"No quantum computer exists, so there is no risk"
This conflates two different clocks. The decryption is in the future, but the harvesting and the migration effort are in the present. By the time a capable machine is public knowledge, years of long-lived data will already have been captured and your migration will not yet have started.
The reassuring part
This is a known problem with a standardized answer. In 2024 NIST published the first finished post-quantum standards — FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. The algorithms exist, they are being deployed in mainstream software, and the task now is a disciplined migration rather than original research.
That migration is what the rest of this knowledge base is about: understanding the threat precisely, finding the cryptography you actually run, and replacing it in the right order. Start with how to use this base, or jump straight to the road to quantum-readiness.