Keys are sent as single particles of light. Quantum physics means anyone peeking disturbs them, so eavesdropping gets noticed. The security comes from physics, not math.
The idea: Each bit is sent as a single photon, prepared in one of two measuring styles (say, upright or diagonal polarization) picked at random. Measuring a photon in the wrong style scrambles it. An eavesdropper doesn't know which style each photon used, so by measuring they inevitably introduce errors. Afterwards the two parties publicly compare a sample: few errors means nobody listened and the rest becomes key. Too many means they throw it away.
Why it matters: Immune to quantum computers, but it needs special hardware and links, so it's rarely used.
On the map: BB84: rests on physics, not hardness. Needs an authenticated classical channel (pre-shared key or signatures), so it grows keys rather than creating them. Real devices leak via side channels
Two parties exchange quantum states, for example single photons with different polarizations (the BB84 protocol)[1]. Measuring a quantum state disturbs it, so an eavesdropper shows up as errors, and the parties keep only key material nobody could have copied. Security rests on physics rather than on computational hardness, so it survives quantum computers.
The caveats are significant:
The NSA and the UK's NCSC recommend post-quantum cryptography over QKD for most uses[3, 4].
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.