Quantum computers are advancing fast, and they threaten much of today's cryptography. The concern isn't theoretical: adversaries are already running "harvest now, decrypt later" attacks — storing encrypted data today to break it once quantum machines mature.
Two quantum algorithms matter. Shor's algorithm breaks RSA and elliptic-curve cryptography — the key exchange that secures most of the internet. Grover's algorithm speeds up brute-force attacks on symmetric ciphers like AES, effectively halving their security level.
AES-256 uses a 256-bit key. Grover's algorithm reduces its effective strength to roughly 128 bits — still computationally infeasible to break, even for a large-scale quantum computer. That's why AES-256 is considered quantum-resistant: it doesn't need to be replaced, unlike RSA and ECC.
When urlpaste encrypts your content with AES-256-GCM, it's protected against both today's attacks and tomorrow's quantum computers. The key never touches our servers, so there's nothing to harvest. Your pastes stay private not just now, but decades from now.
Two algorithms define the quantum threat to cryptography. Shor's algorithm (1994) lets a sufficiently large quantum computer factor integers and compute discrete logarithms, obliterating RSA, Diffie-Hellman, and elliptic-curve crypto. Grover's algorithm (1996) speeds up brute-force key search, effectively halving symmetric key strength — AES-128 drops to ~64-bit security. The good news: AES-256 only drops to ~128-bit post-quantum security, which remains comfortably above any realistic attack threshold. Symmetric crypto survives the quantum era almost intact; it's public-key crypto that needs replacing.
In August 2024, NIST finalized the first three post-quantum standards. FIPS 203 (ML-KEM), derived from CRYSTALS-Kyber, is the new key-encapsulation mechanism replacing RSA/ECDH key exchange. FIPS 204 (ML-DSA), from CRYSTALS-Dilithium, and FIPS 205 (SLH-DSA), from SPHINCS+, replace digital signatures. These run on classical computers — you don't need a quantum machine to use them — and resist attacks from both classical and quantum adversaries. Chrome, Cloudflare, and Signal have already deployed ML-KEM-based hybrid key agreement in production, representing a meaningful share of global TLS traffic.
Cryptographically relevant quantum computers don't exist yet — current hardware has on the order of a thousand noisy qubits, while breaking RSA-2048 is estimated to require millions of error-corrected qubits. So why act now? Because adversaries record encrypted traffic today and store it for future decryption. Any secret with a shelf life beyond 10–15 years — medical records, state secrets, long-lived credentials — is at risk now if captured over a vulnerable channel. The NSA's CNSA 2.0 guidance already mandates quantum-resistant algorithms for national security systems by 2030–2033, and NIST has published a timeline to deprecate RSA/ECC by 2030 and disallow them by 2035.
A pastebin's exposure surface is storage, not key exchange — which is why AES-256-GCM client-side encryption is already quantum-resilient: Grover's algorithm can't realistically brute-force 256-bit keys. The remaining quantum exposure is the TLS connection itself, which browsers and servers are upgrading to hybrid ML-KEM (X25519 + Kyber) automatically. By combining AES-256 at rest with post-quantum hybrid TLS in transit, a zero-knowledge pastebin keeps your ciphertext safe both from today's attackers and tomorrow's quantum adversaries — no action required from you.
Will quantum computers break AES-256?
No. Grover's algorithm halves effective symmetric key strength, so AES-256 retains about 128 bits of post-quantum security — the same margin AES-128 has today, which nobody can break. This is why intelligence agencies are shifting from AES-128 to AES-256 rather than abandoning AES.
What are FIPS 203, 204, and 205?
NIST's first finalized post-quantum standards, published August 13, 2024: ML-KEM (FIPS 203, from CRYSTALS-Kyber) for key encapsulation, and ML-DSA (FIPS 204, from Dilithium) plus SLH-DSA (FIPS 205, from SPHINCS+) for digital signatures. They replace the RSA and elliptic-curve algorithms vulnerable to Shor's algorithm.
Do I need to do anything to be quantum-safe when sharing text?
Mostly no. Choose services that encrypt with AES-256 client-side (already quantum-resilient) and run over modern TLS, which browsers increasingly negotiate with hybrid post-quantum key exchange. The heavy lifting happens at the infrastructure layer — your job is simply not to send secrets in plaintext.