Harvest now, decrypt later
Also known as: HNDL, store now, decrypt later, SNDL, harvest now decrypt later, retrospective decryption
Harvest now, decrypt later (HNDL) is the threat that attackers are collecting encrypted data today, planning to decrypt it once quantum computers can break current public-key encryption.
While large enough quantum computers don't exist yet, this threat makes the quantum risk present-day for any data that needs to stay secret for years. That's why governments and tech companies have already begun deploying post-quantum encryption.
Harvest now, decrypt later, explained at three levels
At home
Imagine someone photographing a locked safe today, planning to open it when they get a master key years from now. Harvest now, decrypt later is the digital version: attackers save encrypted data now, hoping future quantum computers will unlock it.
At work
If your organization stores data that must stay secret for many years, such as medical records, legal documents, or trade secrets, harvest now, decrypt later is a reason to start planning for quantum-resistant encryption today.
At home
The threat mainly affects data protected by public-key encryption, which is used to set up secure connections like HTTPS. Many apps and browsers already add post-quantum protection to these connections, so your newer data may be safer than older data.
At work
A useful framework is Mosca's inequality: if the time data must stay secret plus the time needed to migrate exceeds the time until a quantum computer can break encryption, you're already at risk. Prioritize systems that protect long-lived sensitive data and those with long migration timelines, such as embedded devices.
At home
Hybrid key exchange combines a classical algorithm, such as X25519, with a post-quantum one, such as ML-KEM, so the connection stays secure unless both are broken. In my view, hybrid deployment is a smart hedge, since post-quantum algorithms are newer and less battle-tested than classical ones.
At work
Defending against HNDL requires upgrading key exchange first, since that protects data in transit now, while signatures can follow on a slightly longer timeline because they can't be broken retroactively. Migration challenges include larger key and ciphertext sizes, legacy hardware, vendor dependencies, and certificate infrastructure. A cryptographic inventory and crypto-agility are prerequisites for meeting the 2030 to 2035 deadlines set by many governments.
Real-world examples
At home
Fatima learned that her doctor's office sent records over encrypted connections. She realized that if attackers saved that traffic, future quantum computers could expose it, which made her glad her browser and messaging apps were adding post-quantum protection.
At work
Jerome is the chief information security officer at a Canadian health network that keeps patient records for decades. Citing harvest now, decrypt later, he made post-quantum key exchange a priority for data transfers between hospitals, ahead of other upgrades.
Common confusions
- Quantum threats only matter once quantum computers exist. — Data stolen today could be decrypted later, so long-lived secrets are already at risk.
- All encryption is equally threatened. — Public-key encryption is most at risk. Symmetric encryption like AES-256 remains strong against known quantum attacks.
- Post-quantum migration means replacing everything at once. — Organizations typically prioritize key exchange and long-lived data first, often using hybrid approaches.
For analysts
The question isn't when quantum computers will arrive, but how long your data needs to stay secret. I'd classify data by required secrecy lifetime and use that to prioritize post-quantum migration, starting with anything that must stay confidential past 2035.
History & origin
Security agencies have long warned that adversaries store intercepted traffic for future analysis. As quantum computing progressed, the concern sharpened. The US NSA's CNSA 2.0 guidance in 2022 set timelines for moving national security systems to quantum-resistant algorithms, and NIST published its first post-quantum standards, FIPS 203, 204, and 205, in August 2024. A NIST draft roadmap later that year proposed deprecating vulnerable public-key algorithms by 2030 and disallowing them by 2035. The Canadian Centre for Cyber Security published a roadmap in 2025 for federal systems to migrate, aiming for completion by 2035. Tech companies moved quickly: Signal added post-quantum key exchange in 2023, Apple's iMessage followed in 2024, and Chrome enabled hybrid post-quantum key exchange by default in 2024. In my opinion, HNDL is the strongest argument for starting quantum migration now rather than waiting for the hardware.