Almost everything in software rests on a promise. A button promises to do what its label says. A privacy policy promises to respect your boundaries. Promises matter — civilization runs on them — but they rely on human institutions: reputation, contracts, and regulators. When incentives shift or systems are breached, promises can be broken.

Encryption is different. Instead of a promise, it offers a guarantee. When implemented properly, the math itself enforces the rule. No administrator, subpoena, or rogue insider can sweet-talk a cipher into opening. To break the lock, you have to break the mathematics underneath it.

A brief history

Secret writing is far older than computing. Julius Caesar shifted letters of the alphabet by three places to protect military dispatches. Mary, Queen of Scots lost her head when Elizabeth I’s spymaster cracked the cipher on her letters. Ninth-century Arab polymaths, led by al-Kindi, invented frequency analysis to break substitution ciphers and held the lead in cryptanalysis for hundreds of years.

The twentieth century mechanized the arms race. Breaking Germany’s Enigma and Lorenz ciphers at Bletchley Park shortened the Second World War by years — and gave birth to the first programmable computers as a byproduct. For decades afterward, serious cryptography remained locked inside military and intelligence agencies, until two breakthroughs in the 1970s brought it into the open.

First came DES, the Data Encryption Standard — the first federally standardized cipher published for commercial use. Then, in 1976, Whitfield Diffie and Martin Hellman published a paper solving a riddle that had haunted cryptography for millennia: how two strangers could agree on a secret key over a public wire with an eavesdropper listening to every word. Two years later, Rivest, Shamir, and Adleman turned that theory into RSA. Cryptography stepped out of the intelligence agencies and became the foundation of the modern internet.

The building blocks

Nearly every secure system you touch today combines three mathematical tools:

Symmetric encryption is the classic lockbox: one key both locks and unlocks the data. It is fast, compact, and battle-tested. Today’s standard is AES, which encrypts your laptop’s hard drive, protects your phone when the screen locks, and carries the bulk of traffic across the web. Its only weakness is the same one Caesar faced: how do two strangers across the world share a secret key without someone intercepting it on the way?

Asymmetric (public-key) encryption solves the handoff. Instead of one shared key, you generate a mathematically linked pair: a public key you publish to the world, and a private key that never leaves your device. Anyone can lock a message with your public key, but only your private key can open it. Conversely, you can sign a file with your private key, and anyone can use your public key to verify it came from you. Because public-key math (like RSA or modern elliptic-curve cryptography) is computationally heavy, we don’t use it to encrypt whole files. We use it for the handshake — to agree on a fresh symmetric key — and let AES do the heavy lifting. Every HTTPS connection on earth performs this two-step dance billions of times a day.

Cryptographic hashes (like SHA-256) round out the trio. A hash isn’t encryption, because it only goes one way — there is no key and no “decrypt” button. Feed a hash function anything from a single word to an entire database, and it outputs a short, fixed-length digital fingerprint. Change a single comma in the input, and the fingerprint changes completely. Hashes are how well-built systems verify your password without ever storing the password itself, and how your computer confirms a software update hasn’t been tampered with in transit.

What keeps you safe right now

Open your bank’s website. That quiet padlock in the address bar represents a three-step choreography happening in milliseconds:

  1. Your browser and the bank’s server verify the bank’s identity using asymmetric signatures and a chain of cryptographic certificates.
  2. They run an elliptic-curve Diffie-Hellman (ECDH) key exchange to negotiate a one-time session key — constructed so that even someone recording every packet on the wire cannot derive the key.
  3. They hand off to AES-GCM to encrypt every byte that follows.

Against every classical supercomputer on earth, that mathematics is rock solid. Which brings us to the catch.

The quantum problem

Fault-tolerant quantum computers don’t yet exist at the scale needed to break modern encryption, and even the physicists building them disagree on whether they are five years away or twenty.

What we do know is the math. The moment a sufficiently large quantum computer comes online, two quantum algorithms change the board:

  • Shor’s algorithm factors large integers and solves discrete logarithms in polynomial time. That shatters RSA, Diffie-Hellman, and elliptic-curve cryptography in one stroke — wiping out the entire public-key layer of the internet.
  • Grover’s algorithm quadratically speeds up brute-force searches. That weakens symmetric ciphers, effectively cutting their key strength in half: AES-128 drops to 64 bits of security (unsafe), while AES-256 drops to 128 bits (still astronomically out of reach).

In short, symmetric encryption survives with larger keys. Public-key encryption — the handshake that secures every connection on the internet — has to be replaced from the ground up.

Harvest now, decrypt later

A patient adversary — say, a foreign intelligence service — doesn’t need a working quantum computer today to compromise the traffic you send today. Storage is cheap. They only need to intercept and archive your encrypted traffic now, then wait for the hardware to catch up.

Security teams call this harvest now, decrypt later (HNDL), and it isn’t theoretical. It is a safe assumption that vast archives of encrypted internet traffic from the past decade are already sitting in cold storage, waiting for the day the public-key handshake can be cracked retroactively.

Whether that should keep you awake depends on the shelf life of your secrets. A session token that expires in an hour won’t matter in 2035. A patient’s medical history, a psychiatric file, diplomatic cables, or core intellectual property will matter just as much in fifteen years as it does today.

The migration

Fortunately, defenders didn’t wait. In 2024, after an eight-year global competition, NIST standardized the first suite of post-quantum cryptographic (PQC) algorithms:

  • ML-KEM (formerly CRYSTALS-Kyber) for key exchange, replacing RSA and elliptic-curve handshakes.
  • ML-DSA (formerly Dilithium) and SLH-DSA (formerly SPHINCS+) for digital signatures.

Instead of factoring primes, these algorithms rely on high-dimensional lattice problems and hash trees — puzzles where neither quantum nor classical computers have a known shortcut.

The quiet upgrade of the internet is already underway. Chrome, Cloudflare, Signal, iMessage, and AWS have all deployed hybrid key exchanges that pair classical elliptic curves with ML-KEM, ensuring connections stay at least as safe as today’s standards while adding quantum resistance on top. Still, swapping out the cryptographic plumbing of the entire global economy is the largest security migration in history. It will take a decade to finish.

What this means in practice

If you are responsible for systems that hold long-lived sensitive data — healthcare records, legal archives, government filings, financial histories — post-quantum readiness belongs on your architecture roadmap today. The standards are final and the libraries are shipping; the only question is whether your vendors and your stack have turned them on.

For everyday users, the transition will happen silently under the hood. The only catch is history: encryption is a guarantee, but only for the math you were using on the day you hit send.