That's quite different from what Shor's algorithm can do, which is to outright break the widely used public-key cryptography today.
In other words, Shor’s algorithm is the catastrophic threat targeting the elliptic curve signatures that authorize spending crypto assets. Meanwhile, Grover’s algorithm is the manageable threat, which takes aim at symmetric encryption and hashing, the parts that hold up when bigger parameters are at play.
This piece is about what Grover does to AES and where it fits in the quantum threat to crypto.
What Grover's algorithm does
Grover's algorithm (or ‘Grover,’ for the sake of simplicity) works by searching an unstructured space with fewer queries than any classical method. If you give it a problem where the only way to find the answer is to try candidates one by one. An ordinary computer might have to check all N of them, whereas Grover’s algorithm gets there in about the square root of N. Lov Grover published it in 1996, and it's been a cornerstone of quantum computing ever since, alongside Shor's algorithm.
Square root sounds modest until the numbers grow large. Against a 128-bit key, brute force means trying up to 2^128 keys, which is a number no classical machine will ever be able to finish. In the idealized query count, Grover’s algorithm cuts that exponent in half, to about 2^64, and takes a 256-bit key from 2^256 down to about 2^128, but those are oracle-query figures. Each Grover step has to run AES as a reversible, error-corrected circuit, so the true fault-tolerant cost sits far above the bare exponent. Even so, the halving is the important pattern here.
Grover’s algorithm works on any problem where you can recognize the right answer once you see it, even when there's no shortcut to finding it. Guessing a secret key is exactly that kind of problem. Given enough known plaintext-ciphertext pairs, you can test a guessed key by checking whether it reproduces the ciphertexts, and nothing about a wrong guess points you toward the right one.
Grover is provably optimal for this kind of unstructured, black-box search, so no generic quantum method will beat its square-root scaling. That ceiling doesn't rule out attacks that exploit a cipher's internal structure, but for a well-built cipher like AES, this fixed limit is why designers can size their keys against Grover and know they're safe.
Why AES survives
Since Grover only halves that exponent, doubling the key length restores it, so the fix is as simple as choosing a longer key. NIST laid out the heuristic in 2016 and flagged it as conservative, adding that a more sophisticated quantum attack could change the math. Preserving the same nominal brute-force margin calls for larger symmetric keys, and AES-256 already ticks that box.
Grover’s algorithm pulls its nominal query security down to about 128 bits, the level that AES-128 nominally offers against classical brute force, and it stays comfortably beyond any machine on the horizon. Still, AES-128 comes out weaker on paper, at about 64 bits in the same idealized count, so long-term data is better kept behind AES-256.
The paper figure understates how safe AES-128 is in practice. Grover's speedup assumes one long, deeply sequential computation, and splitting the work across many machines helps far less than it does classically.
The circuit has to run an astronomical number of steps back to back, which pushes the wall-clock cost of even a 2^64 search far past anything workable. NIST and the concrete resource estimates for a quantum AES attack treat AES-128 as sturdier than the raw exponent suggests. No known quantum attack brings AES-256 within practical reach.
NIST even uses AES as a yardstick for post-quantum security. Its evaluation categories are pinned to reference workloads like recovering an AES key of a given size, or finding a hash collision, which shows how much headroom the cipher keeps after Grover. That headroom is why symmetric primitives sit low on the post-quantum worry list, well below the keys that sign transactions.
Grover halves AES's nominal security exponent, so AES-256 keeps about 128 bits and stays out of reach. These are idealized query counts; the actual attack costs far more.
What Grover does to hashing
The same logic covers hash functions, albeit with one wrinkle. A preimage attack looks for an input that produces a given hash, and Grover speeds it up by the same square-root factor. This drops SHA-256 preimage resistance from a nominal 2^256 to about 2^128 quantum queries, and that’s still far out of reach. That said, collisions scale differently.
The classical birthday attack on an n-bit hash takes about 2^(n/2) evaluations, and the Brassard-Hoyer-Tapp quantum algorithm brings the query count to about 2^(n/3), or 2^85 for SHA-256, with enormous memory and implementation costs. The improvement is meaningful asymptotically, but it presents no practical threat under known resource estimates.
Longer outputs increase both margins, though the required size depends on which property an application needs, from preimage to collision resistance. NIST still uses collision search against a 256-bit hash as one of its post-quantum reference workloads.
Grover versus Shor
Grover and Shor are both quantum algorithms that hit cryptography with very different strengths. Shor’s algorithm gives a superpolynomial speedup, exponential against the discrete logs behind elliptic curve keys, which collapses RSA and elliptic curve cryptography from secure to broken.
Grover gives a quadratic speedup, which trims a safety buffer that was oversized to begin with. Doubling a symmetric key to cancel Grover’s algorithm is cheap. Rebuilding the world's public-key infrastructure to survive Shor is the decade-long project.
This is why the post-quantum scramble centers on signatures and key exchange. The symmetric layer mostly rides through on a bigger key. The public-key layer has to be rebuilt, and we cover that side in Post-Quantum Cryptography Explained.
Grover gives a quadratic speedup that a bigger key absorbs; Shor gives a superpolynomial one that collapses public-key cryptography.
Implications for crypto holders
In crypto circles, Grover is the reassuring half of the quantum story. The parts of a blockchain that lean on hashing hold up well. Bitcoin uses double SHA-256 for proof of work. Older address and script constructions use the 160-bit HASH160 function, and a Taproot output instead carries a 32-byte tweaked public key, with tagged SHA-256 used elsewhere in the construction.
Generic preimage search against these hash functions gets only Grover's quadratic speedup, and Taproot's exposed output key faces the separate Shor threat. A quantum miner could gain a quadratic edge on the proof-of-work search, but turning this into faster blocks needs an enormous fault-tolerant circuit running double SHA-256 over and over.
If the whole network started mining faster, Bitcoin’s difficulty adjustment would raise the difficulty to compensate, yet it wouldn't erase one miner's relative edge or every consensus risk, so this remains a distant hardware problem. Symmetric encryption around wallet files sits in the same comfortable position, as strong as its password and key derivation settings allow.
The serious quantum exposure sits on the other side, with the elliptic curve signatures that authorize spending, and that's driven by Shor's algorithm, where Grover plays no part. Because migrating a chain's signatures takes years, some holders want protection sooner.
On programmable chains, a smart contract can require a post-quantum authorization before funds move, which guards that contract's assets as long as the ordinary key can't remove the added check. It doesn't make the base chain quantum-safe.
qLABS applies this model in qVAULT, a non-custodial vault qLABS describes as using Falcon-based authorization, and it currently lists qONE and HYPE as supported assets. qLABS develops and promotes qVAULT and qONE and publishes the L1 Quantum Vulnerability Index, which gives it a commercial and reputational interest in the claims here, so weigh them with that in mind and treat none of it as financial advice.
FAQ
What is Grover's algorithm?
It's a quantum search algorithm that finds a target in an unsorted space in about the square root of the time a classical search needs. In cryptography, that speeds up brute-force key guessing and hash preimage search, as it takes the square root of the idealized query count and halves the nominal security exponent. It's the main known generic quantum threat to symmetric cryptography, but a manageable one.
Does Grover's algorithm break AES?
No. In the idealized query count, it halves AES's nominal security exponent, so AES-256 drops to about 128 quantum-query bits and AES-128 to about 64. AES-256 stays far beyond any foreseeable machine, and AES-128 holds up better than 64 bits suggests, because Grover's steps have to run one after another, and spreading the job across many machines barely helps. Doubling the key is the standard fix.
Does Grover threaten Bitcoin mining?
In principle yes, but not with anticipated hardware. Grover could hand a quantum miner a quadratic speedup on the double SHA-256 search, but a useful edge would need an enormous fault-tolerant machine running that hash through a deep reversible circuit. Difficulty adjustment would answer faster block production, yet it wouldn't remove a quantum miner's relative edge or every consensus risk. Bitcoin's main quantum exposure is its signatures, covered in Is Bitcoin Quantum Safe?.
Is AES-256 quantum safe?
As far as anyone knows, yes. The main known generic quantum threat to full AES-256 is Grover-style key search, and it leaves AES-256 with about 128 quantum-query bits of security, well beyond reach. No quantum algorithm breaks AES the way Shor's breaks RSA and elliptic curve keys.
Who invented Grover's algorithm?
Lov Grover, a computer scientist at Bell Labs, published it in 1996. It came two years after Shor's algorithm and stands as one of the foundational quantum algorithms relevant to cryptography.
qLABS Editorial. Sources are linked inline. See the L1 Quantum Vulnerability Index for our full methodology and conflict-of-interest disclosure.
