Are Your Passwords and Passkeys Quantum-Safe? Post-Quantum Security, Explained

Every few years a technology arrives that’s described as the end of encryption. Quantum computing is the current one — and unusually, the threat is real, specific, and already being planned for by standards bodies. But the headlines (“quantum will break all encryption!”) are badly oversimplified. Some of your security genuinely is at risk; some of it — including your passwords — is close to fine. Here’s the honest version.

The short answer

A sufficiently large quantum computer could break the public-key cryptography that secures HTTPS key exchange, passkeys, and digital signatures. It would not break strong passwords, password hashing, or symmetric encryption like AES — those only weaken slightly. No such quantum computer exists yet, and may not for years. But migration to new post-quantum standards is happening now, because of a problem called “harvest now, decrypt later.”

What quantum actually breaks — and what it doesn’t

Two different quantum algorithms matter, and they do very different things.

Shor’s algorithm efficiently factors large numbers and solves the discrete-log problem. That’s catastrophic for public-key (asymmetric) cryptography — RSA, elliptic-curve (ECDSA/ECDH), and Diffie-Hellman — which is exactly the math securing the key exchange at the start of every HTTPS connection, the signatures in TLS certificates, and the keys behind passkeys. A large quantum computer breaks these outright.

Grover’s algorithm speeds up brute-force search, but only quadratically — it roughly halves the effective security of symmetric schemes. That’s a much softer blow: AES-256 behaves like AES-128 (still astronomically out of reach), and SHA-256 hashing stays safe. Doubling key sizes absorbs the hit entirely.

What you rely on	Example	Quantum impact
Public-key key exchange	HTTPS/TLS handshake, VPNs	Broken by Shor’s — the urgent problem
Digital signatures	TLS certificates, passkeys, code signing	Broken by Shor’s
Symmetric encryption	AES-256 (disk, messaging)	Weakened by Grover’s — AES-256 still safe
Hashing	SHA-256 checksums, password hashes	Weakened by Grover’s — still safe
A strong password	Your 16-char unique password	Essentially unaffected

The takeaway most coverage misses: the parts of security a normal person controls — choosing strong passwords, and the hashing that protects them — are the quantum-resistant parts. The breakable part lives inside the plumbing (TLS, certificates, passkeys) that vendors manage for you.

“Harvest now, decrypt later”: why the clock is already ticking

If no quantum computer can break anything today, why migrate now? Because of harvest now, decrypt later (HNDL): an attacker records encrypted data today — VPN sessions, database backups, intercepted messages — and simply stores it, betting that a future quantum computer will decrypt it later. (Palo Alto Networks)

That means anything which must stay confidential for a decade or more — medical records, financial data, state secrets, long-lived credentials — is effectively at risk right now, even though the quantum computer that opens it doesn’t exist yet. HNDL is why governments set migration deadlines well ahead of any working quantum machine.

Where passwords and passkeys fit

Passwords are the good news. They’re protected by hashing (and symmetric crypto), which quantum only dents. A long, unique password remains a long, unique password in a post-quantum world — so the single most useful habit is unchanged: generate a long, random, unique password for every account. Our Password Generator does this entirely in your browser; see our guide to strong passwords for why length beats complexity. And because SHA-256 stays sound, the integrity checks you run with our Hash Calculator don’t become meaningless either — here’s how hashing works.

Passkeys are more nuanced. Today’s passkeys use elliptic-curve signatures, which Shor’s algorithm breaks. But the threat model is subtle:

• HNDL is a weak fit for passkey logins, because each signature answers a challenge that expires in seconds — recording one today and cracking it in 2035 opens no live session.
• The real risk is future impersonation: a quantum computer deriving your private key from the public key a server stores, then forging brand-new logins. (hoop.dev analysis)

Crucially, none of this makes passkeys worse than passwords. Passkeys are still phishing- resistant and far stronger than any password today — so keep using them. The industry is already moving them to post-quantum signatures: in 2026 the IETF standardized ML-DSA in COSE (the format underneath WebAuthn) in RFC 9964, and 1Password began shipping post-quantum (ML-DSA) passkeys. (1Password)

The standards and the timeline

This isn’t speculative — the replacements are finished. In August 2024, NIST published its first post-quantum standards:

• FIPS 203 — ML-KEM (from CRYSTALS-Kyber): key encapsulation, the HTTPS fix.
• FIPS 204 — ML-DSA (from CRYSTALS-Dilithium): the main digital-signature replacement.
• FIPS 205 — SLH-DSA (hash-based): a conservative backup signature scheme.

(NIST PQC standards overview)

For the retirement of today’s algorithms, NIST’s draft IR 8547 proposes deprecating RSA and elliptic-curve crypto after 2030 and disallowing them entirely after 2035 (deprecated = discouraged but allowed; disallowed = no longer approved). It’s still a draft, but US federal guidance already treats those dates as the planning baseline, and analysts suggest treating ~2029 as the practical operational deadline — because migrating a large environment takes years. (NIST IR 8547 explainer)

The migration is visibly underway: OpenSSL 3.5 ships native ML-KEM/ML-DSA/SLH-DSA, and Chrome already defaults to a hybrid post-quantum key exchange for TLS 1.3 and QUIC. Most of this reaches you automatically through browser and OS updates.

What you should actually do

If you’re a regular user

1. Nothing quantum-specific — and that’s fine. There’s no “quantum-safe” switch to flip; the migration happens inside browsers, operating systems and services.
2. Keep the fundamentals. Long, unique passwords (generate them here), passkeys where offered, and two-factor authentication still stop essentially every real-world attack today — quantum changes none of that.
3. Keep software updated. Post-quantum protection arrives as ordinary updates. Running current browsers and OSes is how you receive it.

If you build or run systems

1. Inventory your cryptography. Find every place you use RSA/ECC — TLS configs, certificates, JWT/SAML signers, code signing, SSH keys. You can’t migrate what you can’t see.
2. Adopt hybrid post-quantum TLS (a classical + post-quantum key exchange) for data in transit first — it’s the HNDL front line and is already widely supported.
3. Build crypto-agility. Make the signature/KEM algorithm a config value you can swap, so the next transition isn’t another multi-year scramble.

Takeaways

• Quantum breaks public-key crypto (HTTPS key exchange, signatures, passkeys) — not strong passwords, AES-256, or SHA-256, which only weaken slightly.
• Harvest now, decrypt later makes migration urgent today, before any quantum computer is ready, for data that must stay secret for years.
• Passwords: unchanged advice — long, unique, everywhere. Passkeys: still the best option today; the post-quantum upgrade is already starting.
• The fix exists (NIST FIPS 203/204/205) and is rolling out; keeping your software updated is how you get it.