Harvest now, decrypt later: Why your encrypted messages may need quantum protection before quantum computers arrive

Published 15 November 2026. Future-facing analysis; product availability, laws and implementation may change.

Imagine somebody stealing encrypted medical records or private messages today, even though they cannot read them. They store the ciphertext for years and wait for a machine capable of breaking the mathematical protection. Security researchers call this harvest now, decrypt later. It is a reason that governments and technology companies are transitioning to post-quantum cryptography before anyone can demonstrate a quantum computer powerful enough to break the widely used public-key systems at the necessary scale.

The difference between a quantum computer and magic decryption

Many internet connections use a combination of cryptographic methods. Public-key cryptography often establishes shared secrets or authenticates participants, while fast symmetric cryptography protects bulk data. The best-known quantum threat is that sufficiently powerful, error-corrected quantum computers could use algorithms such as Shor’s to break widely deployed RSA and elliptic-curve public-key systems.

That does not mean every encryption method falls equally or that today’s experimental quantum machines can read the world’s private messages. No widely demonstrated cryptographically relevant quantum computer currently threatens properly implemented public-key cryptography at the scale required. Quantum-resistant methods also need careful testing against ordinary attacks and implementation failures.

Why data captured now could matter years later

A short-lived secret such as a temporary password may expire long before quantum attacks become practical. A confidential medical history, business archive, diplomatic communication or intimate conversation may still be sensitive decades later. If an attacker records a session whose long-term security depends on a quantum-vulnerable key exchange, future advances may expose information from that captured session.

The exact danger depends on the protocol and key-exchange design. Modern systems that use hybrid post-quantum key establishment are addressing the problem proactively. Simply saying that encryption is ‘end-to-end’ does not answer whether the cryptographic methods used will resist a future quantum adversary.

What changed in 2026?

The US National Institute of Standards and Technology published its first principal post-quantum cryptography standards in 2024. In October 2026, NIST issued additional guidance on migrating away from vulnerable cryptographic algorithms. The transition affects not only individual applications but entire inventories of servers, firmware, certificates, software libraries and supplier relationships.

NIST describes 2035 as a principal federal migration target under one US policy framework, with earlier milestones for some high-value systems. Dates can vary by sector and country. The important insight is that cryptographic migrations can take many years, which makes waiting for a successful large-scale quantum attack an exceptionally poor strategy.

What a non-specialist can do

Most people cannot audit the mathematical foundations of their messaging apps. They can keep devices updated, choose reputable services that publish security documentation, protect accounts against phishing and use strong authentication. Those steps address more immediate threats than quantum computing in many cases. People with especially long-lived confidential data should ask their providers what post-quantum transition plans exist.

For organisations, the more consequential action is an inventory: where is public-key cryptography used, which secrets need to remain confidential for years, which vendors control the upgrade path, and what systems cannot be replaced quickly? The story is not that a machine from the future can already read everything. It is that data stolen in the present may outlive the protection we trust today.

Sources and further reading

NIST: October 2026 guidelines for post-quantum transition

NIST: What is post-quantum cryptography?

Featured photograph or archival image: source and attribution. A genuine photograph of an IBM quantum-computer demonstration at ITUWTSA 2024; it is not a machine that can break today’s encrypted messages. Presented in a 1200 × 675 landscape frame without cutting off the original.

Support DEPTH

Help keep careful, sourced explanations available to everyone by supporting the work.