Post-Quantum Cryptography, Explained (and Why Passwords Aren't the Point)
Post-quantum cryptography (PQC) is the set of algorithms designed to survive a large quantum computer. It exists because Shor’s algorithm can break today’s public-key systems — RSA and elliptic-curve — in polynomial time, an exponential advantage over classical factoring. PQC replaces those key-exchange and signature schemes. Crucially, this is about public-key crypto, not password strength — two different problems people constantly conflate.
Grover vs Shor: the distinction that matters
| Algorithm | Targets | Speedup | Real-world impact |
|---|---|---|---|
| Grover | Unstructured/brute-force search (AES, hashing, passwords) | Quadratic (√) | Halves effective bit-strength — manageable with longer keys/passwords |
| Shor | Factoring & discrete log (RSA, ECC, Diffie-Hellman) | Exponential | Breaks public-key crypto outright — must be replaced |
Passwords and symmetric keys live in Grover’s world: annoying but survivable by adding length. Public-key crypto lives in Shor’s world: it needs entirely new math. PQC is the answer to Shor, not to weak passwords.
What NIST standardised
After a multi-year competition, NIST published its first PQC standards in 2024:
- ML-KEM (FIPS 203) — a lattice-based key-encapsulation mechanism, derived from CRYSTALS-Kyber, for establishing shared secrets.
- ML-DSA (FIPS 204) — a lattice-based digital-signature scheme, derived from CRYSTALS-Dilithium.
- SLH-DSA (FIPS 205) — a hash-based stateless signature scheme (SPHINCS+) as a conservative backup.
These slot into TLS, VPNs, code signing and secure messaging — the places that currently rely on RSA/ECC.
“Harvest now, decrypt later”
The reason PQC migration is urgent before big quantum computers exist: adversaries can record encrypted traffic today and decrypt it years later once Shor becomes practical. Long-lived secrets (medical records, state communications) are most at risk, which is why browsers and messengers have begun deploying hybrid key exchange (classical + ML-KEM) already.
So, does this make my password “quantum-proof”?
No — and that’s the recurring confusion. PQC protects connections and signatures. Your password’s resilience is a separate question answered by entropy and the Grover square-root penalty, which our password checker models directly. A site can deploy perfect ML-KEM and still let you choose password123.
For the password side of the story, see Grover’s Algorithm vs Your Password and whether password managers are quantum-safe.