How Quantum Computers Break Encryption | Shor's Algorithm Explained

Encryption for much of the internet depends on a stubborn math problem: multiplying two large primes is easy, but reversing the process—factoring the big number back into its primes—appears to take an impractically long time on ordinary computers. That asymmetry is the backbone of widely used public-key systems. If a sufficiently large quantum computer becomes available, that advantage could collapse quickly, because Shor’s algorithm turns factoring into a task quantum hardware can accelerate dramatically.

The core mechanism starts with how factoring can be reframed. Pick a random number g less than N, where N is the composite number used to lock data. If g shares a factor with N, Euclid’s algorithm can efficiently find that common factor and the encryption falls apart. The problem is that for the huge numbers used in real encryption, a random g almost never shares a factor directly. Shor’s algorithm therefore uses a number-theory trick: for many g that are coprime to N, some power g^p will equal a multiple of N plus 1. Once that p is known, the expression g^(p/2) ± 1 can be manipulated into two quantities whose factors are tied to the factors of N. Even when those two quantities aren’t themselves the primes, taking their greatest common divisors with N (again via Euclid’s algorithm) can reveal the hidden factors.

On a normal computer, finding the crucial exponent p is the bottleneck. Determining p requires effectively searching through many possible powers until the “multiple of N plus 1” condition appears, and for thousand-digit numbers this becomes more expensive than brute-force factoring itself. Shor’s algorithm’s quantum advantage is aimed squarely at this step: instead of checking powers one by one, quantum computation uses superposition and interference to extract the period p efficiently.

The quantum part begins by preparing a superposition over possible exponents x and computing g^x modulo N, tracking the remainder relative to multiples of N. Measuring too early would just yield a random remainder and waste the structure. The algorithm instead exploits a repeating property: if g^x is r more than a multiple of N, then g^(x+p) is also r more than a multiple of N. That periodicity means the remainders line up in a way that leaves behind a superposition of exponents spaced by p. The next move is to apply the quantum Fourier transform, which converts that periodic structure into a frequency—effectively producing information about 1/p. Measuring then yields an estimate of 1/p, which is inverted to recover p.

With p in hand (and with high probability that p is even and the derived candidates aren’t trivial multiples of N), the algorithm computes g^(p/2) ± 1, uses Euclid’s algorithm to extract nontrivial common factors of N, and finally enables decryption. The result is a pathway from “hard factoring” to “fast factoring” that could undermine RSA-style security at scale. Current quantum machines are far from the memory and error-correction demands needed to factor real-world key sizes, but the threat model changes once large, fault-tolerant quantum computers arrive. In the meantime, the transcript points to practical mitigations like using strong, modern key sizes and password managers that rely on large-number encryption (e.g., 2048-bit) to stay ahead of brute-force factoring progress.