# Harvest now, decrypt later

> Why the quantum threat matters today even though no dangerous quantum computer exists yet.

A common objection to worrying about quantum computers is: "They don't exist yet, so why care now?" The answer is a strategy called **harvest now, decrypt later** — and it's the reason the quantum clock is already ticking.

## The idea

The attack is simple to state:

1. **Harvest now.** Record encrypted or signed data today and store it.
2. **Decrypt later.** Wait until a capable quantum computer exists, then break the stored data retroactively.

The attacker doesn't need a quantum computer *today*. They only need patience and storage, both of which are cheap. Anything you protect with quantum-vulnerable cryptography now could be exposed the moment the hardware catches up.

## Why blockchains are especially exposed

For most systems, "harvest now, decrypt later" requires actively intercepting and storing traffic. For a blockchain, the harvesting is **already done for free** — by the blockchain itself.

A public ledger is, by design:

- **Public** — anyone can read every transaction, and
- **Permanent** — nothing is ever deleted.

So every **public key** that has ever been exposed on-chain is sitting in the ledger forever. With [ECDSA](/learn/glossary#ecdsa), an exposed public key is all [Shor's algorithm](/learn/how-quantum-computers-break-crypto) needs to recover the private key. The attacker's "harvest" step was completed the day the key was first used.

## You can't un-expose a key

This is the crux. Once a public key is on a public, immutable ledger, you cannot take it back. If it's a quantum-vulnerable key, then the *future* arrival of quantum computers puts those *past* funds at risk — and there's no way to retroactively hide what's already recorded.

That asymmetry is why preparing early is the only real defence. Moving value to [quantum-resistant](/learn/quantum-resistance-explained) addresses **before** capable quantum computers exist means the keys that protect it were never vulnerable in the first place. Wait until the threat is here, and the exposed keys are already harvested.

## QRL's answer

QRL's entire design is a response to this timing problem: use post-quantum signatures — [XMSS](/learn/xmss-explained) and [ML-DSA-87](/learn/ml-dsa-87-explained) — from the start, so there's no quantum-vulnerable window to harvest. It's insurance bought before the storm, not after.

## Where to go next

- [How quantum computers break cryptography](/learn/how-quantum-computers-break-crypto) — the underlying mechanism.
- [Why quantum-resistance matters](/learn/quantum-resistance-explained) — the bigger picture.
- [The QRL → QRL 2.0 migration](/learn/the-qrl-migration) — moving value to post-quantum wallets.