Harvest Now, Decrypt Later: The Quantum Threat Explained
The idea
Encryption that is safe today could be broken later. If someone records the encrypted traffic now, they can wait. That is why governments and companies are moving to post-quantum cryptography early.
Who is exposed
Data with a long shelf life: government secrets, health records, trade secrets, and private messages.
What about blockchains?
Blockchain data is already public, so there is nothing secret to harvest. The different risk is that a future quantum computer could recover a private key from a public key and forge a signature. Read will quantum break Bitcoin and Solana.
See also quantum key distribution.
A worked example: does your data have a deadline?
A simple rule of thumb used by security teams is Mosca's inequality. Let X be how many years your data must stay secret, Y the years your organization needs to migrate to new cryptography, and Z the years until a code-breaking quantum computer exists. If X plus Y is bigger than Z, you already have a problem. Try sample numbers, which are illustrations, not forecasts: medical records kept 25 years (X = 25) and a 7 year migration (Y = 7) give 32. If someone argued Z might be 15 years, you would be exposed for roughly 17 years of the data's life. A shopping receipt with X = 1 and Y = 2 would be fine under almost any Z. The lesson is that long-lived secrets come first, and the exact date matters less than people think.
What is actually at risk
| Item | Exposed to harvest now, decrypt later? | Why |
|---|---|---|
| Recorded encrypted traffic using RSA or elliptic curve key exchange | Yes | Key exchange can be broken later by Shor's algorithm. |
| Data encrypted with AES-256 and a securely stored key | Low | Grover's algorithm only gives a quadratic speed-up, so doubling key length is the standard answer. |
| Public blockchain transactions | Nothing secret to harvest | Everything is already public. The risk is signature forgery later. |
| A wallet's seed phrase kept offline | Not harvestable | It is never sent over a network. |
What the defense looks like
The main defense is hybrid key exchange, which combines a classical method with a post-quantum one such as ML-KEM, so recorded traffic stays protected even if one half falls. NIST finalized ML-KEM as FIPS 203 in August 2024 and urged early adoption for exactly this reason. Read Hybrid Key Exchange in TLS Explained, ML-KEM Explained and Try Post-Quantum TLS Today. For companies, A Plain English Post-Quantum Migration Checklist for Companies covers inventory first.
Common mistakes
- Believing the threat is only a future one. The recording happens today, the decryption is the part that waits.
- Believing it applies to everything. Short-lived data has little to lose.
- Confusing it with wallet risk. Wallet risk is a separate, signature-based issue covered in Exposed Public Keys and Address Reuse.
How to check this yourself
For your own accounts, use apps that already ship post-quantum key exchange in their transport layer, and keep software updated. See What Individuals Can Do About Quantum Risk Today. Experts estimate dates differently, so look at survey numbers in What Do Experts Say About Q-Day? The Global Risk Institute Survey Numbers rather than a single headline. This is education only and not financial advice, and it makes no price claim about any token.
Sources and further reading
- NIST: first 3 finalized post-quantum encryption standards (13 August 2024)
- Wikipedia: Shor's algorithm (1994 paper, 2001 factoring of 15, resource estimates)
- Wikipedia: Grover's algorithm (quadratic speed-up, about pi/4 times the square root of N steps)
- Wikipedia: Michele Mosca (risk assessment framework often called Mosca's theorem)
Facts checked 2026-10-09 against the linked pages. Education only, not financial advice. Nothing here predicts the price of any asset, and the QNT memecoin is an independent community token with no link to Quantinuum Ltd or any lab, chain or exchange named on this page.
Frequently asked questions
Is harvest now decrypt later happening?
Security agencies treat it as a plausible risk and plan for it, which is one reason migration to post-quantum cryptography is encouraged now.
Does it affect my crypto wallet?
Not today. Wallet risk is about future signature forgery, not about stored encrypted messages.
Is AES safe against quantum computers?
Current analysis says Grover's algorithm only gives a quadratic speed-up against symmetric ciphers, so AES-256 is widely considered a comfortable margin. The bigger worry is public-key exchange.
What is Mosca's inequality?
A planning rule: if the years your data must stay secret plus the years you need to migrate exceed the years until a capable quantum computer, you are already late.
Does harvest now, decrypt later apply to my messaging apps?
Possibly, if they use classical key exchange. Several major apps and browsers have been adding post-quantum key exchange, so keep them updated.
Can I protect old recorded data?
No. Once traffic is captured, you cannot change how it was encrypted. Protection must be applied before the data is sent.
Keep reading
- Post-Quantum Cryptography and Crypto: What It Means
Why large quantum computers could threaten blockchain signatures, and what post-quantum cryptography is doing about it. - Quantum Key Distribution (QKD) Explained vs Post-Quantum Cryptography
QKD uses quantum physics to share encryption keys. Learn how it works, its limits, and how it differs from post-quantum cryptography. - Will Quantum Computers Break Bitcoin and Solana?
A calm, factual look at the quantum threat to Bitcoin, Solana and other blockchains, what is safe now, and what could change.
All Quantum computing guides | Back to top | Search the site
Main pages: Quantum computing explained | Quantum and crypto | Companies | Quantum news | Glossary