The answer, up front
Quantum Key Distribution (QKD) has five main disadvantages: it works only over short distances, needs expensive dedicated hardware, has exploitable flaws in real-world devices, cannot authenticate the other party on its own, and does not scale well beyond point-to-point links. These limits are why agencies such as the U.S. NSA recommend post-quantum cryptography (PQC) rather than QKD for defending against the quantum threat 1, 2.
Last verified: Oct. 2, 2026.
Distance limits and no amplification
QKD sends information on individual photons, and photons degrade over optical fiber. Practical links top out at roughly 100 to 200 kilometers without special relay nodes. The deeper problem is that you cannot simply boost the signal: the no-cloning theorem means measuring or copying a quantum state destroys it, so the standard optical amplifiers that carry classical traffic across continents do not work for QKD 1.
High cost and real-world device flaws
QKD requires dedicated equipment such as single-photon detectors, quantum light sources, and in many designs its own fiber channel. That is expensive to deploy and maintain. And while the underlying physics is sound, real hardware is imperfect. Researchers have broken QKD implementations in the lab by exploiting device weaknesses, using techniques such as detector blinding and Trojan-horse attacks. The security proof assumes ideal devices; the devices are not ideal 1, 2.
Authentication, denial of service, and scaling
QKD distributes a key, but it cannot tell you who is on the other end. It still needs a separate, classically authenticated channel to prevent a man-in-the-middle attack, so it does not remove the dependence on conventional cryptography 2. Because interfering with a quantum channel disrupts transmission entirely, QKD links are also easy to deny service to: an attacker who blocks or floods the line stops the exchange. Finally, scaling past a single point-to-point link requires trusted intermediate relay nodes, which reintroduce the very trust and insider-risk problems QKD was meant to avoid 2.
Why PQC is the recommended path
Post-quantum cryptography avoids all of these constraints. It runs as software on the hardware and networks you already own, scales across the internet, authenticates, and is standardized (ML-KEM, ML-DSA, SLH-DSA). That is why national guidance, including from the NSA, points organizations toward PQC rather than QKD as the main defense against quantum attacks on cryptography 2. QKD may suit a few niche, high-value point-to-point links, but it is not a general replacement for public-key cryptography.