PQC — Post-Quantum Cryptography
Countdown to
January 1, 2029 — Google estimate
Sources: Google (2026) · NSA · SecurityWeek · GRI 2025
Breaking Research
China's Origin Wukong-180: A 180-Qubit Quantum Leap and What It Means for Q-Day
China's Origin Quantum has launched its fourth-generation 180-qubit superconducting quantum computer — built entirely on domestic technology. Here's what it signals for the global Q-Day race.
Research
Microsoft's Majorana 1: The Topological Qubit That Could Accelerate Q-Day
Microsoft's topological qubit architecture could dramatically reduce the physical qubit overhead needed to break RSA — and reshape the Q-Day timeline in the process.
Cryptocurrency
Ethereum's Quantum Escape Plan: Protecting 100 Million Wallets from Q-Day
Ethereum's ECDSA signatures are vulnerable to quantum attacks. With 100 million active wallets at stake, the community is racing to design a post-quantum migration path — before it becomes urgent.
Explainer
What is Q-Day and Why Should You Care?
Q-Day refers to the moment a quantum computer becomes powerful enough to break RSA encryption — the foundation of most internet security today. Here's what that means for you.
Technology
Post-Quantum Cryptography: The Race to Protect the Internet
NIST has finalized its first post-quantum encryption standards. But how quickly will the world actually adopt them — and is it fast enough?
Research
Google's Willow Chip: A Milestone on the Road to Q-Day
Google's latest quantum processor raises the stakes. We break down what the Willow breakthrough actually means for the Q-Day timeline.
Standards & Policy
NIST Selects HQC: A Backup Shield Against Quantum Attacks
In March 2025, NIST chose HQC as a fifth post-quantum algorithm — a fallback built on entirely different mathematics, in case the primary standard ever falls.
Threat Intelligence
Harvest Now, Decrypt Later: The Silent Attack Already Happening
State actors are already collecting your encrypted data today — planning to decrypt it once quantum computers arrive. This attack doesn't need Q-Day to begin.
Cryptocurrency
Could a Quantum Computer Steal Your Bitcoin in 9 Minutes?
Google's quantum research puts a number on the threat: a capable quantum computer could derive a Bitcoin private key in roughly 9 minutes. Bitcoin's block time is 10.
Policy & Standards
NSA's CNSA 2.0: The Military's Deadline for a Quantum-Safe World
The NSA has set January 2027 as the first hard deadline for quantum-safe encryption across US national security systems. Here's what the full timeline looks like.
Analysis
Why Q-Day Could Be Worse Than Y2K
Y2K cost $300 billion and was fixed in time. Q-Day threatens to break encryption across the entire internet — and unlike Y2K, the damage can be retroactive.
Industry
Cloudflare's 2029 Deadline: How the Internet Is Preparing for Q-Day
Cloudflare targets full post-quantum security by 2029. Here's what that migration actually looks like — and what it means for the rest of the internet.
Breaking Research
Three Papers in Three Months: Why Q-Day May Now Be 2029, Not 2035
Between May 2025 and March 2026, three papers slashed the qubit estimate to break RSA by a factor of 20. Q-Day just got a lot closer.
Timeline
Q-Day Timeline: The Complete History of Expert Predictions
How did the Q-Day timeline shift from "decades away" to 2029? A complete history of expert estimates from 2016 to 2026 — and what changed in each critical year.
Finance
Q-Day and Banking: How the Financial Sector Is Preparing for Quantum Risk
Banks, SWIFT, and central banks face acute exposure from Q-Day. Here's what major financial institutions are doing — and what is still at stake.
Action
How to Prepare for Q-Day: A Practical Guide for Organizations
Six concrete steps every organization should take before Q-Day: cryptographic inventory, data classification, NIST standards, hybrid encryption, and supply chain assessment.
Reference
Q-Day Glossary: 25 Essential Terms Explained
From Shor's algorithm to ML-KEM and crypto-agility: 25 key terms from quantum computing and post-quantum cryptography, clearly defined.
What is Q-Day?
Q-Day is the predicted moment when a quantum computer becomes powerful enough to break RSA encryption — the system protecting most internet traffic, banking, and communications today. When it arrives, any data encrypted with current standards can be decrypted retroactively.
When will it happen?
Estimates vary: Google's internal security team targets 2029, NIST and the NSA are planning for 2030 as a critical migration deadline, and the Global Risk Institute puts a 50% probability on 2035. The timeline depends heavily on progress in qubit quality and error correction.
Am I already at risk?
"Harvest now, decrypt later" attacks are already happening — state actors are collecting encrypted data today to decrypt once a capable quantum computer exists. Sensitive data with long shelf-life (medical records, financial history, state secrets) is most at risk.
What is post-quantum cryptography?
Post-quantum cryptography (PQC) refers to cryptographic algorithms designed to be secure against quantum attacks. In 2024, NIST published the world's first PQC standards — CRYSTALS-Kyber and CRYSTALS-Dilithium — to replace vulnerable RSA and ECC encryption.
What can I do?
If you run critical infrastructure or handle sensitive long-lived data: begin a cryptographic inventory, follow NIST's migration guidance, and start transitioning to PQC-ready systems. Most major cloud providers are already offering PQC-compatible TLS options.
Will Bitcoin and crypto survive Q-Day?
Most cryptocurrencies use elliptic curve cryptography (ECC) for wallets — which is vulnerable to quantum attacks. Bitcoin's ECDSA signatures could be broken by a sufficiently large quantum computer. The crypto community is actively discussing post-quantum migration paths.
Has the timeline changed recently?
Yes — significantly. In May 2025, Google researcher Craig Gidney published a paper showing RSA-2048 could be broken with under one million qubits, down from his own 2019 estimate of 20 million. That's a 20× reduction in required resources. The AQTI's JVG algorithm (March 2026) claims even fewer qubits may be needed. These papers are why Google, Cloudflare and major governments have all moved their migration deadlines forward to 2029–2030.
Does Q-Day affect my passwords?
Not directly. Passwords are typically protected by hashing algorithms (bcrypt, Argon2, SHA-256) which are not broken by Shor's algorithm. The main threat is to public-key cryptography — RSA and ECC — which secures your connection to websites (HTTPS), your email, and your cryptocurrency wallets. Grover's algorithm could weaken symmetric encryption, but doubling key lengths (e.g. AES-256 instead of AES-128) provides sufficient protection.
What is "harvest now, decrypt later"?
It's an attack strategy where adversaries — typically nation-state intelligence agencies — intercept and store encrypted data today, even though they can't read it yet. Once a capable quantum computer exists, they retroactively decrypt everything they've collected. This means data you send today could be exposed in 2030. Medical records, diplomatic cables, and business communications with long-term sensitivity are most at risk.
scroll →
We are already having the wrong conversation in cryptography if we argue about whether we have one, three, or five years before quantum computers will break today's security algorithms. We must always be ahead of the curve — especially in the era of 'Store now, decrypt later'.
In three to five years' time, we will have that moment where from a cryptographic standpoint we have to adapt to quantum, for sure.
Preparing for a post-quantum world will be a complex change programme that makes fixing the Millennium Bug look easy.
The averaged expert estimate of the probability of a cryptographically relevant quantum computer emerging within the next 10 years is now between 28% and 49% — the highest in this report's history.
Q-Day could come as soon as 2025. The question is not if, but when — and most organisations are dangerously unprepared.
Elliptic curves are going to die. There is about a 20% chance that quantum computers capable of breaking today's cryptography arrive before 2030 — and that is not a risk Ethereum can afford to ignore.
It's a really serious threat, and I think the modern crypto community doesn't fully understand just how serious it is. My forecast is a matter of years — not decades.
When a suitably powerful quantum computer becomes available, conventional digital signature schemes will be broken — and all existing ledgers will be susceptible to attack. I built QRL because this is not a theoretical problem.