A quantum computer powerful enough to break everyday encryption does not exist yet. But the maths behind it is no longer theoretical, and the encryption protecting your emails, your banking and your VPN connection was not built to survive it. Security researchers call the arrival of that machine “Q-Day”, and while nobody can give you an exact date, the direction of travel is clear enough that ignoring it is no longer sensible.
This matters for anyone who relies on a VPN, Tor, or an encrypted messaging app to keep their browsing private, because the cryptography underneath all three depends on maths problems that a working quantum computer could solve in hours rather than centuries. This article explains what quantum computing actually threatens, which online anonymity tools are most exposed, what post-quantum cryptography is doing about it, and what UK and Ireland regulators expect organisations to do in the meantime.
Table of Contents
What Quantum Computing Threatens and Why “Q-Day” Matters
Before getting into VPNs and Tor, it helps to understand what quantum computing changes about encryption in the first place, because the threat is not vague or distant once you see the mechanics behind it.
Classical computers store information as bits, either a 0 or a 1. Quantum computers use qubits, which can represent both states at once through a property called superposition, and can be linked through entanglement so that changing one qubit instantly affects another. This lets a sufficiently powerful quantum machine test many possibilities in parallel, which is exactly what breaks the maths problems that protect your data today.
Most internet encryption relies on problems that are hard for ordinary computers, such as factoring very large numbers. A quantum algorithm called Shor’s algorithm can solve that problem far faster than any classical computer, which is why RSA and similar systems are vulnerable. Estimates for when a quantum computer will be capable of this vary widely.
Google’s internal security team has pointed to 2029 as a working target, while the US National Institute of Standards and Technology (NIST) is planning around a 2030 deprecation deadline for vulnerable algorithms, and independent research groups place the wider range anywhere from 2029 to the mid-2030s. Nobody has a firm date. What experts agree on is that the risk window has moved closer in the past two years, not further away, as qubit efficiency has improved faster than expected.
The Immediate Reality of Harvest Now, Decrypt Later
You do not need to wait for a working quantum computer for the threat to be real today. Intelligence agencies and other well-resourced attackers are already using a strategy known as “harvest now, decrypt later” (HNDL): they intercept and store encrypted traffic now, with the plan of decrypting it once quantum hardware catches up.
This means anything you send today that relies on RSA or Diffie-Hellman key exchange, and that needs to stay confidential for years rather than minutes, is already exposed. Medical records, legal correspondence, and financial history are the obvious examples, but so is anything you send through a VPN or messaging app that an adversary considers worth storing. Data with a short shelf life matters far less here than data that needs to stay private for a decade or more.
How Quantum Computers Break the Encryption You Rely On
Not every type of encryption is equally at risk, and the distinction matters a great deal for anyone trying to work out what actually needs to change. Broadly, quantum computing threatens two families of cryptography in very different ways.
Public key cryptography, which includes RSA, Diffie-Hellman, and elliptic curve systems like ECDSA, depends on mathematical problems that Shor’s algorithm can solve efficiently on a large enough quantum computer. This is the encryption that handles key exchange when your browser connects to a website, when a VPN sets up its tunnel, or when Tor builds a circuit through relay nodes. Once a cryptographically relevant quantum computer exists, these handshakes can be broken outright, not just weakened.
Symmetric encryption, such as AES, and hash functions are affected differently. A separate quantum method called Grover’s algorithm speeds up brute-force attacks against these systems, but only by roughly halving the effective key length rather than breaking them completely. AES-128 would be reduced to something closer to 64-bit security, which is a real weakening, but AES-256 would still offer around 128-bit quantum security, which stays comfortably out of reach for the foreseeable future. This is why the practical advice from cryptographers is to move to AES-256 where you have a choice, while the far more urgent work is replacing the public key systems that Shor’s algorithm defeats outright.
Can VPNs and Tor Survive Quantum Computing?
This is the question most people actually care about, and the honest answer is that both can survive, but only if their handshakes are upgraded before a working quantum computer arrives. Neither VPNs nor Tor rely on quantum-safe key exchange by default today, which means the tools most people already use for online anonymity are, for now, running on borrowed time rather than a permanent guarantee.
A VPN connection typically negotiates its session using Diffie-Hellman or elliptic curve key exchange before switching to AES for the bulk of the traffic. The AES layer itself is not the weak point, particularly with AES-256, as covered above in how VPNs create anonymity. The handshake that sets up that AES key is the weak point, because it is exactly the kind of public key exchange that Shor’s algorithm can break, and it is exactly the part an HNDL attacker would need to crack in order to unlock everything recorded afterwards.
Tor faces a similar problem at the circuit level. Each hop in a Tor circuit is established through a handshake called ntor, which again relies on elliptic curve cryptography. An adversary who has recorded a Tor circuit’s handshake today, and who later gains access to a capable quantum computer, could in principle unwrap that circuit’s layers retrospectively and work out which traffic belonged to which user.
Circuit and Handshake Vulnerabilities
The good news is that this is a solvable engineering problem, not an unsolved one. Hybrid key exchange, which combines a classical algorithm like X25519 with a post-quantum method such as ML-KEM, is already being tested for both VPN protocols and Tor’s circuit handshake. The trade-off is size: post-quantum key exchange messages are considerably larger than their classical equivalents, which adds latency and bandwidth overhead, particularly awkward for Tor’s already-constrained relay network. Migration is underway, but full deployment across the anonymity network ecosystem will take years.
The Metadata Problem That Encryption Alone Cannot Fix
There is a second, less discussed threat that has nothing to do with breaking ciphers directly. Even if every VPN and every Tor circuit switched to post-quantum encryption tomorrow, an attacker with quantum-accelerated computing power could still analyse the timing, size and pattern of encrypted packets moving between entry and exit points. This is called traffic correlation analysis, and it is a metadata problem rather than a cryptography problem.
Quantum computing does not need to decrypt your traffic to de-anonymise you if it can match the shape of your encrypted session at one end of a VPN or Tor circuit to the shape of a decrypted session at the other end. This gap is largely absent from mainstream coverage of quantum threats to anonymity, yet it may end up mattering more than the encryption question itself for anyone relying on Tor for genuine online anonymity rather than simple privacy.
Post-Quantum Cryptography: The New Anonymity Toolkit
The response to all of this is post-quantum cryptography (PQC), a set of encryption methods designed to resist both classical and quantum attacks and to keep online anonymity tools viable once a capable quantum computer exists. This is not a future technology still in the lab. NIST published its first finalised PQC standards in August 2024, covering key exchange (FIPS 203, known as ML-KEM), digital signatures (FIPS 204, ML-DSA, and FIPS 205, SLH-DSA), with a fourth algorithm called HQC added afterwards as a backup approach in case weaknesses are later found in the lattice-based methods.
Lattice-Based Standards in Practice
Most of the new standards are built on lattice mathematics, a different hard problem to the factoring and elliptic curve maths that Shor’s algorithm targets. ML-KEM handles the key exchange role that RSA and Diffie-Hellman currently perform, while ML-DSA replaces digital signature schemes like ECDSA. You do not need to understand the underlying maths to benefit from it. What matters practically is that these algorithms are now standardised, tested, and available for VPN providers, browsers and messaging apps to adopt, and several already have. Our guide to the best encryption tools for data protection covers which everyday services have already made the switch.
Zero-Knowledge Proofs: Which Ones Actually Survive Quantum Computing
Zero-knowledge proofs let one party prove something is true, such as an identity credential or a rate-limiting token, without revealing the underlying data, and they underpin a growing number of online anonymity tools and decentralised identity systems. Whether they survive quantum computing depends entirely on how they are built. Traditional zk-SNARKs typically rely on elliptic curve pairings, the same mathematical family that Shor’s algorithm defeats, which makes them vulnerable in the same way RSA is.
Zk-STARKs, by contrast, rely on hash functions rather than elliptic curve maths, which places them in the Grover’s algorithm category rather than the Shor’s algorithm category, and hash-based systems remain comfortably secure with adequate key sizes. If you are evaluating a decentralised identity or privacy tool with quantum resilience in mind, which cryptographic family it uses matters more than any marketing claim attached to it.
Quantum-Safe Messaging Is Already Here
Encrypted messaging has moved faster than most anonymity infrastructure. Signal introduced a protocol called PQXDH in 2023, which combines the classical X25519 key exchange with the post-quantum ML-KEM algorithm (then known as CRYSTALS-Kyber) so that an attacker would need to break both systems to compromise a conversation.
Signal has since added further post-quantum protection to its ongoing message ratchet, not just the initial handshake, closing a gap that PQXDH alone did not cover. Apple’s iMessage has taken a similar hybrid approach with its own protocol. If online anonymity in messaging matters to you specifically, our breakdown of secure messaging apps and their privacy protections sets out which apps have adopted post-quantum protection and which have not.
This trade-off is not hypothetical. In its own guidance on choosing post-quantum algorithms, the NCSC notes that “larger parameter sets provide higher security margins, but require greater processing power and bandwidth”, which is precisely the balancing act VPN providers and messaging apps face when deciding how aggressively to adopt these standards on mobile and low-power devices.
UK and Ireland Regulation: Who Has to Prepare, and By When
Quantum readiness is not only a technical question for UK and Ireland organisations that handle personal data. It is increasingly a compliance one, and the timelines involved are worth understanding even if you are not an IT professional, particularly if the online anonymity of the people whose data you hold depends on choices your organisation makes now.
The NCSC Migration Roadmap
The UK’s National Cyber Security Centre published its official post-quantum migration guidance in March 2025, setting out a three-phase roadmap. Organisations are expected to complete a full cryptographic discovery exercise and build a migration plan by 2028, carry out the highest-priority upgrades to their most sensitive systems between 2028 and 2031, and complete migration across all remaining systems by 2035. These dates apply most directly to critical national infrastructure and essential service providers, but the NCSC has been explicit that any organisation handling long-lived sensitive data should be treating 2026 to 2028 as its discovery-and-planning window, not waiting until closer to the deadline.
Does Harvest Now, Decrypt Later Already Breach UK GDPR?
This is where things get more pressing than a distant 2035 deadline suggests. The Information Commissioner’s Office (ICO) has already flagged quantum computing as a live risk in its Tech Horizons work, and it has stated plainly that organisations aware of the quantum threat to their systems who take no steps to assess or mitigate it may struggle to demonstrate they have applied “appropriate technical and organisational measures” under Article 32 of UK GDPR.
In practice, this means that continuing to protect highly sensitive personal data using only classical public key encryption, with no migration plan in place, is a decision an organisation would need to be able to defend to a regulator, not something it can leave unexamined. Ireland’s Data Protection Commission operates under the equivalent EU GDPR framework and applies the same “state of the art” security standard, so Irish organisations face a closely parallel obligation to plan rather than wait for a breach to force the issue.
What Privacy-Conscious Individuals Can Do Now
Most of the heavy lifting here falls to VPN providers, messaging app developers and website operators, not to individual users. That said, there are a few practical steps worth taking if online anonymity matters to you specifically.
Check whether your VPN provider has published anything about post-quantum key exchange or hybrid handshakes; a growing number have started rolling out early support, and providers offering more detail than a vague “quantum-safe” marketing line are worth prioritising. Be sceptical of any VPN or messaging service claiming to be entirely “quantum-proof” today. No consumer service can honestly make that claim while root certificate authorities, server infrastructure and much of the wider internet’s public key infrastructure remain on classical cryptography; a provider using PQC for its own handshake is still relying on classical systems elsewhere in the chain.
Prioritise messaging apps that have already adopted post-quantum protocols, such as Signal, particularly for conversations you would not want exposed a decade from now. If you handle sensitive data professionally, whether client records, financial information or health data, treat “how long does this data need to stay confidential” as the deciding question, because anything with a multi-year confidentiality requirement is the priority for early migration, not everyday browsing traffic.
None of this requires panic. Mathematics already has an answer to quantum computing in the form of standardised post-quantum algorithms; the remaining problem is deployment speed, not a missing solution. Online anonymity is not disappearing; it is simply changing shape as the tools behind it catch up with the threat.
If you want to understand how encryption underpins the tools you already use day-to-day, our guide to connection encryption and how it protects your data is a good place to start before deciding what, if anything, needs to change in how you browse.
Frequently Asked Questions
Can quantum computers decrypt past internet traffic?
Traffic protected only by symmetric encryption with properly managed keys, such as AES-256 used correctly, is not retrospectively vulnerable in the same way. The real risk sits with traffic where the key exchange itself relied on classical public key methods like RSA or standard Diffie-Hellman. If that handshake was intercepted and stored, it can be broken once a capable quantum computer exists, exposing whatever it protected.
When will quantum computers be able to crack RSA-2048 encryption?
There is no confirmed date. Google’s security team has pointed to 2029 as a working estimate; NIST and other agencies are planning around a 2030 deprecation deadline for vulnerable algorithms, and some independent research groups place the range as late as the mid-2030s.
Will quantum computing make Tor and VPN anonymity obsolete?
Not necessarily, but both need to migrate their handshakes to post-quantum key exchange to stay resilient. The main practical hurdles are increased bandwidth overhead from larger key sizes, and the separate metadata problem, where quantum-accelerated traffic analysis could de-anonymise users even without breaking the encryption itself.
Are VPNs advertising “quantum-proof encryption” telling the truth?
Treat this claim with scepticism. Some providers have genuinely implemented post-quantum key exchange for their own handshake, which is a real improvement, but no VPN can honestly claim to be entirely quantum-proof while broader internet infrastructure, including certificate authorities, still depends on classical cryptography.
What is the difference between post-quantum cryptography and quantum key distribution?
Post-quantum cryptography is software-based; it runs new mathematical algorithms on the same fibre, hardware and internet infrastructure already in use, which is why it can be rolled out relatively quickly. Quantum key distribution is physics-based and requires dedicated fibre optic lines and specialised hardware, which makes it impractical for ordinary consumer web browsing at scale.
Do zero-knowledge proofs stay secure against quantum computing?
It depends on how they are built. Zk-SNARKs that rely on elliptic curve pairings are vulnerable to the same quantum attack that breaks RSA and ECDSA. Zk-STARKs, which rely on hash functions instead, do not depend on that kind of mathematical structure and remain quantum-resistant.