Q-Day (also Q Day and sometimes as Y2Q, or simply the quantum threat) refers to the theoretical date when quantum computers have reached the point where they can break the asymmetric encryption that secures the vast majority of the digital world today. Although the exact date remains uncertain, governments, standards bodies, and major technology companies increasingly argue that the more immediate challenge is not predicting Q-Day but completing post-quantum cryptography (PQC) migration before vulnerable cryptography reaches end-of-life. This concept, similar to the Y2K concept in that it was both a pre-planned future date and the actual date of the Y2K event, differs in that the Q-Day cannot be circled on a calendar currently because no one knows when it will occur. Virtually during every discussion of this topic, people will mention it as an extension of the post-quantum cryptography (PQC). The whole awaraness traces back to a single paper published in 1994 by the mathematician Peter Shor who showed, on paper, that a quantum computer could factor enormous numbers and grind through discrete logarithm problems in polynomial time, which happen to be exactly the sums that today's public-key systems are betting nobody can do. The specialists who follow this topic give the estimates for Q-Day to happen in the late 2020s or 2030s.
Background Modern secure communications rely on public-key infrastructure (PKI), in which mathematically related key pairs, one public, one private, are used to encrypt and authenticate data. The security of the most widely deployed systems rests on the computational hardness of two problems One is integer factorization, the thing RSA sits on, used all over the web, in email, in digital certificates. The other is the discrete logarithm, which is what elliptic-curve cryptography (ECC) rests on, the workhorse behind TLS/SSL, phones, and most everyday web security. Until recently the experts assumed that classical computers, even the biggest supercomputers, cannot crack these at any size that matters, not in a human lifetime, not in many of them. Shor's algorithm, on a large enough fault-tolerant quantum computer, would do both in polynomial time and leave those systems wide open. Symmetric encryption like AES-256 is a more resilient. Grover's algorithm does speed up a brute-force search, but only quadratically, it roughly halves the effective security, so AES-128 would behave like 64-bit, which sounds bad until you realise the fix is just to use longer keys rather than throw out the whole mathematical idea. "Y2Q" (years to quantum) can be found more in academic and standards fields, especially around Mosca's theorem, a back-of-the-envelope test that asks a blunt question: if you add up how long your migration will take and how long your data must stay secret, and that total runs past the time until a working code-breaker exists, then you are already late and should be moving now. The phrase "quantum apocalypse" shows up in the popular press too, though serious literature tends to leave it alone.
Timeline assessments There is no consensus on when it happen.The Global Risk Institute's Quantum Threat Timeline Report 2024 found that most specialists expect a cryptographically relevant quantum computer to emerge sometime in the 2030s or later. By its seventh edition, in March 2026, the same report called such a machine "quite possible" within ten years. Regardless of when a cryptographically relevant quantum computer arrives, organizations face concrete migration timelines. NIST finalized its first PQC standards in 2024, governments including the United States, United Kingdom, Australia, and the European Union have published migration roadmaps, and several major technology companies have announced internal migration targets around 2029. Because enterprise cryptographic transitions often take years, many organizations have shifted their planning from estimating Q-Day to estimating migration duration. In early 2026, three research papers published within twelve months significantly revised downward the estimated quantum resources required to break standard cryptographic systems. Together, they represented what commentators described as the most substantial shift in quantum threat assessment since Shor's 1994 paper. The major was a Google Quantum AI whitepaper, written together with people from the Ethereum Foundation and Stanford University, arguing that the elliptic-curve cryptography guarding the big blockchains could, in principle, be broken with fewer than 500,000 physical qubits. A separate preprint (arXiv:2603.28627) sketched leaner methods for fault-tolerant quantum computing, suggesting that there might be a need for less physical qubits to build one good logical one than everyone had assumed previously. Around the same time Google put a 2029 deadline on finishing its own post-quantum migration.
What is actually at risk Blockchains get singled out, and proof-of-work ones like Bitcoin and Ethereum especially. A wallet address comes from a public key, and where that key has been reused or simply left exposed on the ledger, someone with a real code-breaker could in theory work back to the private key and start forging transactions. That March 2026 Google paper put actual numbers on this particular attack, which is part of why it got the attention it did. Another problem is harvest now, decrypt later (HNDL): an adversary, a national intelligence service, say, scoops up encrypted traffic right now and just files it away, perfectly content to wait years until a quantum machine can open it. So anything you send today that needs to stay secret for five or ten years and more is, in a real sense, already exposed. Washington takes the point seriously enough that National Security Memorandum 10 orders every federal agency to finish its post-quantum move by 2035.
Heading it off: post-quantum cryptography
From 2016, the National Institute of Standards and Technology (NIST) conducted a multi-year public evaluation of candidate post-quantum algorithms, receiving 82 submissions. In August 2024 the first three standards were finalized: FIPS 203 (ML-KEM, out of CRYSTALS-Kyber), meant as the everyday general-purpose encryption; FIPS 204 (ML-DSA, from CRYSTALS-Dilithium) for signatures; and FIPS 205 (SLH-DSA, from SPHINCS+), kept as a backup signature scheme that leans on entirely different maths, just in case. A fourth, FIPS 206, built on FALCON (FN-DSA), was still being written as 2024 closed. In March 2025 NIST added a fifth algorithm, HQC, as a code-based backup. It also set a timeline: RSA and ECC are to be deprecated after 2030 and disallowed by 2035. Earlier, one candidate, SIKE, had been broken classically during the contest. In February 2024 the Linux Foundation stood up the Post-Quantum Cryptography Alliance (PQCA), an open-source effort to support the new standards, with AWS, Cisco, Google, IBM, NVIDIA, SandboxAQ, the University of Waterloo and QuSecure among the founders. A year earlier, in March 2023, QuSecure said it had run the first live, end-to-end quantum-resilient link sent over a satellite, pushing data through a Starlink bird on its QuProtect platform. The same firm joined NIST's National Cybersecurity Center of Excellence (NCCoE) consortium in March 2026 to help with the unglamorous but necessary part, hunting down where cryptography actually lives inside big organisations and testing the new tools against it. A Cryptographic Bill of Materials (CBOM) provides an inventory of cryptographic assets and helps organizations prioritize migration. Increasingly, security practitioners recommend that discovery and migration proceed in parallel rather than waiting for exhaustive inventories before beginning pilot deployments. Many cybersecurity researchers argue that the current migration to PQC is unlikely to be the last large-scale cryptographic transition. As algorithms, standards, and threats continue to evolve, organizations are increasingly investing in cryptographic management capabilities designed to support future migrations with less operational effort. For many organizations, the practical question is no longer exactly when Q-Day will occur, but whether their cryptographic infrastructure can adapt quickly enough as standards, regulations, and threats continue to evolve. In the meantime a lot of deployments are hedging, running classical and post-quantum algorithms side by side, so-called hybrid cryptography. Google Chrome and Cloudflare had hybrid post-quantum protection in their TLS by 2024, and Google has stuck with the hybrid approach on the theory that the freshly minted algorithms might still hide a flaw nobody has spotted yet. The same shift reached consumer apps: Signal added a post-quantum handshake in 2023, and Apple's iMessage followed with PQ3 in 2024. A different route altogether is quantum key distribution (QKD), which uses the physics itself to share a key in a way that is, in principle, impossible to interception.
Governments In the United States the Quantum Computing Cybersecurity Preparedness Act of 2022 tells federal agencies to move to PQC, National Security Memorandum 10 puts 2035 on the finish line, and the NSA's Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) lays out which algorithm families are blessed and by when for defence and national-security systems. The Australian Signals Directorate required organizations to begin planning immediately, and intends to cease approving the main current public-key algorithms (including RSA and elliptic-curve schemes) by the end of 2030. Britain's NCSC set migration milestones of 2028, 2031 and 2035. The European Commission and member states agreed a shared roadmap in 2025, targeting critical infrastructure by 2030.
See also Post-quantum cryptography Shor's algorithm Harvest now, decrypt later Grover's algorithm Quantum computing Public-key cryptography NIST Post-Quantum Cryptography Standardization
References