A large enough quantum computer would easily solve the math behind today's digital padlocks (RSA and elliptic curves). Nobody has built one yet.
The idea: Ordinary computers attack factoring and discrete logs by clever searching, and the work grows extremely fast with key size. A quantum computer can instead recast these problems as finding the repeating period of a sequence, and quantum interference finds periods efficiently. RSA, Diffie-Hellman and elliptic curves all hide their secret in exactly such a period. Lattices, codes and hashes have no hidden period known to quantum algorithms, which is why they are the replacements.
Why it matters: Traffic recorded today could be decrypted later, which is why the switch to quantum-safe cryptography has already started.
On the map: Shor's algorithm solves factoring and every discrete log
Shor's algorithm (1994)[1, 2], run on a large error-corrected quantum computer, factors integers and computes discrete logarithms efficiently. That breaks RSA, Diffie-Hellman, elliptic-curve cryptography and pairings.
Today's machines are far too small and noisy, but resource estimates keep falling: in 2025 Gidney estimated RSA-2048 could be factored with under a million noisy qubits in under a week[3].
"Harvest now, decrypt later" is the immediate risk: traffic recorded today could be decrypted once such machines exist. That is why key exchange is moving to hybrid post-quantum schemes first. Grover's algorithm only gives a square-root speedup[4] against symmetric ciphers and hashes, which longer keys absorb.
If any of these breaks, this breaks too.
If this breaks, these break with it.