What is Grover's algorithm?
Grover's algorithm is a quantum algorithm, published by Lov Grover in 1996, that in idealised terms searches an unsorted set of possibilities in roughly the square root of the number of steps an ordinary computer would need. Where a classical search might take a million guesses, Grover's takes about a thousand. In security, its main effect is to weaken symmetric encryption such as AES modestly, which is why experts recommend longer keys rather than new algorithms.
A square-root speed-up, not magic
A square-root speed-up sounds dramatic, but it's far smaller than what Shor's algorithm does to RSA. Shor's turns an effectively impossible problem into a feasible one. Grover's only reduces the effort, and the reduction shrinks in practice: each quantum step is much slower and more expensive than an ordinary one, error correction adds large overheads, and the algorithm is hard to split across many machines running in parallel.
What it means for encryption
| Cryptography | Effect of Grover's algorithm | What to do |
|---|---|---|
| AES-256 | Keeps a very comfortable margin | Nothing; the common choice for long-lived data |
| AES-128 | Weakened on paper; a real attack must also pay for circuit depth, error correction and running time | Follow the guidance that applies to you; CNSA 2.0 requires 256-bit keys for US national security systems |
| Hash functions such as SHA-256 | Depends on the property: resisting reversal and resisting collisions are affected differently | Check each use, such as signatures, passwords or integrity checks, against current guidance |
| RSA and elliptic curve | Not the relevant threat | These fall to Shor's algorithm instead |
Guidance on 128-bit keys differs, partly because it covers different systems. The NSA's CNSA 2.0, which applies to US national security systems, requires 256-bit AES. NIST's draft transition plan, IR 8547, says NIST doesn't expect to need to move away from its approved symmetric algorithms that offer at least 128 bits of classical security as part of the post-quantum migration. Follow whichever applies to your organisation.
Beyond cryptography
Grover's algorithm is often cited for search, optimisation and finance. In practice, once the costs of error correction and loading data are counted, the gain for many real problems shrinks or disappears. The what quantum is good at lesson puts it alongside the stronger cases.
For a bank, Grover's algorithm is mostly a reason to check key and hash sizes. The urgent migration work is about public-key cryptography.
Common confusions
- "Grover halves the security of everything." On paper it roughly halves the effective key length for brute-force search. Real-world attack costs are much higher than that rule of thumb suggests.
- "AES needs replacing." No. Use 256-bit keys where long-term protection matters.
- "Grover makes quantum computers fast at search." Only in a narrow sense, and often not once overheads are counted.
Sources and further reading
Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- Peer-reviewed paperA fast quantum mechanical algorithm for database searchLov Grover, STOC, 1996
- Government guidanceNSA releases future quantum-resistant algorithm requirements for national security systems (CNSA 2.0)US National Security Agency, 2022
- Government guidanceNIST IR 8547 (Initial Public Draft): Transition to Post-Quantum Cryptography StandardsNIST, 2024