2026-07-31

Is AES-256 file encryption safe from quantum computers?

NIST spent the better part of a decade running an open competition, and in August 2024 it finalized the first three post-quantum cryptography standards. Headlines about "quantum computers breaking encryption" followed, and it's a reasonable question to bring to a file you just encrypted: does this protection have an expiration date? The honest answer depends entirely on which kind of encryption you mean, because "encryption" quietly covers two unrelated mathematical problems, and only one of them is actually in trouble.

"Encryption" is doing double duty, and only half of it is threatened

Two unrelated families of algorithms both get called "encryption." The first is public-key (asymmetric) cryptography — RSA, ECDH, ECDSA, EdDSA — the math that lets a browser agree on a secret with a server it has never met, or lets a signature prove who sent something, without a shared secret existing beforehand. The second is symmetric cryptography — AES, ChaCha20, SHA-2 — where both sides already hold the same key and use it directly to scramble and unscramble data. The three standards NIST finalized on August 13, 2024 — ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) — replace the first family only: new key-exchange and signature schemes built on math a quantum computer can't shortcut, standing in for RSA and elliptic-curve algorithms. None of them touch AES.

What Shor's algorithm actually breaks

The first family needed brand-new algorithms, not just bigger keys, because of Shor's algorithm: on a sufficiently capable quantum computer it factors large numbers and solves the discrete-logarithm problem efficiently — exactly the hard problems RSA and elliptic-curve cryptography are built on. That's a complete, exponential break, not a partial weakening, which is why NIST ran nearly a decade of open review into entirely different mathematical foundations (lattice problems, for ML-KEM and ML-DSA) instead of simply recommending longer RSA keys.

What Grover's algorithm does to AES — and doesn't

Symmetric ciphers like AES face a much smaller quantum threat: Grover's algorithm, which offers a quadratic speedup on brute-force key search in theory. NIST's own post-quantum cryptography FAQ addresses this directly: "it is quite likely that Grover's algorithm will provide little or no advantage in attacking AES, and AES 128 will remain secure for decades to come," adding that "the known difficulty of parallelizing Grover's algorithm suggests that both AES 192 and AES 256 will still be safe for a very long time" — and that current applications can keep using AES at any of its standard key sizes. Cryptography engineer Filippo Valsorda — who also wrote the age-encryption.org format NearSeal's opt-in format uses — put concrete numbers on that in an April 2026 analysis: breaking AES-128 with Grover's algorithm would take roughly 140 trillion quantum circuits running in parallel for a decade, a computational cost of about 2^104.5 — against roughly 2²⁶ gates for a Shor's-algorithm attack on 256-bit elliptic curves, by his comparison. That's a difference of 2^78.5, which the post states in full digits as 430,000,000,000,000,000,000,000 times more expensive to break AES-128 with a quantum computer than to break the elliptic-curve cryptography a quantum computer is actually good at. No standards body currently recommends doubling AES key sizes to compensate for quantum computers.

"Harvest now, decrypt later" is real — for a specific kind of ciphertext

None of this makes quantum computers a non-issue. CISA, the NSA, and NIST jointly warned in an August 2023 factsheet that adversaries may already be collecting encrypted traffic today specifically to decrypt it once a capable quantum computer exists — the "harvest now, decrypt later" threat that's the real reason migration urgency exists at all. Look at the mechanism, though: what makes old traffic decryptable later is that its symmetric session key was itself delivered by an asymmetric key exchange (ECDH, typically, inside TLS) that an attacker can record alongside the ciphertext and break retroactively with Shor's algorithm once it's available. The AES encryption isn't what breaks in that scenario — the key-delivery step wrapped around it is. A file whose key was never exchanged with anyone over any network in the first place isn't exposed to that specific attack path, because there's no asymmetric handshake sitting next to the ciphertext to harvest.

Where NearSeal's two formats sit in this picture

NearSeal's default format derives its AES-256-GCM key with PBKDF2-SHA256 straight from the passphrase you type, plus a random salt stored in the file — nothing else. The optional age-encryption.org format works the same way structurally, deriving a ChaCha20-Poly1305 key with scrypt from a passphrase; NearSeal only calls age's passphrase mode (its setPassphrase()/addPassphrase() API), never its separate public-key recipient mode, so neither format involves an asymmetric key at all. In both cases that key is never exchanged with anyone and never transmitted over a network the way a TLS session key is — so there's no asymmetric handshake sitting alongside the ciphertext for a future quantum computer to crack open the way the harvest-now-decrypt-later scenario describes. That's not a quantum-hardening feature NearSeal deliberately built — it's a structural side effect of being a client-side, passphrase-only tool that never does a key exchange in the first place. Separately, both AES-256-GCM and ChaCha20-Poly1305 are exactly the kind of symmetric ciphers NIST's own guidance currently treats as safe against Grover's algorithm for the foreseeable future.

The honest bottom line

Quantum computers are a real, funded, actively-standardized threat — to one specific family of cryptography most people never interact with directly: the key exchanges and signatures running invisibly underneath HTTPS, email, and code signing. Based on NIST's own published position and the math behind it, they are not currently a threat to AES or ChaCha20 at any standard key size, including the ones a passphrase-derived file encryption tool like NearSeal uses. NIST leaves the door open rather than closing it forever — it says plainly it will issue new guidance if a transition need for symmetric algorithms is ever foreseen. Today, that need hasn't been foreseen. Worth knowing before deciding whether "quantum-proof" is a real requirement for encrypting a file, or a search term worth being skeptical of.