Cryptographic risk observatory · Updated 19 Aug 2026
What is Q-Day? The point when a quantum computer becomes powerful and reliable enough to break the public-key cryptography protecting today's internet—especially RSA and elliptic-curve systems.
Encrypted data can be stolen now and decrypted later, so the exposure window may open years before Q-Day itself. QDayWatch tracks the technology, migration progress, and the gap between them.
See below for the expert inputs, weighting, and calculation behind the estimate.
See how it's calculated ↓QDayWatch composite · Updated August 2026
8 years from the current data review
Source envelope · 2029–2038| Source | Published | Input class | Published basis | Model year | Weight |
|---|---|---|---|---|---|
| Global Risk InstituteSource ↗ | MAR 2026 | 26-expert survey | 50% crossing interpolated from the 10- and 15-year probability ranges | 2038 | 45% |
| GartnerSource ↗ | FEB 2025 | Threat forecast | Public-key cryptographic algorithms expected to break by 2029 | 2029 | 20% |
| IBMSource ↗ | MAR 2026 | Hardware roadmap | 2,000 logical qubits and one billion gates targeted for 2033+ | 2034 | 15% |
| IonQSource ↗ | AUG 2026 | Hardware roadmap | 80,000 logical qubits targeted for 2030 | 2030 | 10% |
| GoogleSource ↗ | MAR 2026 | Security deadline | Company-wide post-quantum migration target | 2029 | 10% |
Independent expert aggregation receives the largest weight. Direct threat research follows. Vendor roadmaps and migration deadlines receive smaller weights because they measure different parts of the path to cryptographic capability.
(2038 × 45%) + (2029 × 20%) + (2034 × 15%) + (2030 × 10%) + (2029 × 10%)
= 2034Mosca's inequality
Use the QDayWatch estimate—or choose another scenario—to test whether data lifetime plus migration time fit before a cryptographically relevant machine arrives.
The planning horizon extends 7 years beyond this scenario.
Migration takes Y years. Data created at the end of that migration can remain valuable for another X years—this is why the terms add.
PQC transition horizon
2035ONE YEAR AFTER THE MODEL ESTIMATENIST describes a transition that removes quantum-vulnerable algorithms from its standards by 2035, with higher-risk systems moving earlier. The QDayWatch composite currently centers Q-Day in 2034.
NIST transition guidance ↗Calculating transition horizonHarvest now / decrypt later
An attacker does not need a quantum computer today to target information that will still matter when one becomes available.
Prioritize information whose value outlives the time needed to discover, replace, test, and retire vulnerable cryptography.
Cryptographic impact
It changes the security assumptions behind specific primitives. Public-key systems face a qualitatively different failure mode from symmetric encryption and hashing.
Why “quantum-safe” is too simple: AES and SHA are not subject to Shor's public-key break, but quantum algorithms still affect their security margins. Algorithm, key size, mode, and use case all matter.
Cryptographic inventory
Migration is an infrastructure problem. Select a layer to see why replacing an algorithm is rarely a one-line configuration change.
Selected layer
The Q-Day Watch
Architectures, error rates, connectivity, code overhead, and logical operations differ. Physical qubit totals are not a common unit of cryptanalytic capability.
Surface-code error suppression
Λ = 2.14 ± 0.02A distance-7 logical memory used 101 physical qubits and achieved a 0.143% logical error per correction cycle. Its lifetime exceeded its best constituent physical qubit by 2.4×.
Demonstrated for memory—not a general-purpose fault-tolerant cryptanalytic computer.
Error decreased as code distance increased in the cited surface-code experiment.
Long, reliable logical circuits at cryptanalytic scale have not been publicly demonstrated.
No public demonstration has factored a production RSA-2048 key using quantum computing.
Resource estimate monitor
Resource estimates are models, not machine specifications. Two estimates from related research show how assumptions and algorithmic improvements can move the result without moving hardware capability.
Readiness
Quantum capability
PQC migration
These indicators track the two forces that move the QDayWatch estimate: accelerating quantum capability and the remaining migration gap.
Standards monitor
Standardized, selected, candidate, deprecated, and withdrawn are different states. QDayWatch keeps them separate.
Key establishment
Primary general-purpose KEM. Parameter sets: 512, 768, and 1024.
Source ↗Digital signatures
Primary lattice-based digital signature standard.
Source ↗Digital signatures
Stateless hash-based alternative with different security assumptions.
Source ↗Digital signatures
Compact lattice-based signatures; standardization remains underway.
Source ↗Key establishment
Code-based backup KEM selected to add mathematical diversity.
Source ↗Digital signatures
Withdrawn in 2026 after a newly discovered attack; never deployed as a NIST standard.
Source ↗The road to Q-Day
A record of observable changes in algorithms, standards, policy, and error correction.
A candidate signature scheme is removed from consideration. NIST states that the finding does not affect the finalized ML-KEM or ML-DSA standards.
NIST ↗A new preprint substantially reduces the estimated physical-qubit count under the paper's stated assumptions, while extending projected runtime to under a week.
Craig Gidney ↗NIST selects a code-based backup for general encryption, adding mathematical diversity to the standards pipeline.
NIST ↗Google Quantum AI reports that logical errors fall as code distance grows on Willow, a meaningful error-correction milestone—not a cryptanalytic break.
Nature ↗IR 8547 outlines an expected path to deprecate and remove quantum-vulnerable algorithms by 2035, with higher-risk systems moving earlier.
NIST ↗Intelligence feed
Publication date and event date are tracked separately so old events cannot look new—and new analysis can be placed in context.
A new attack led the HAWK team to withdraw its signature candidate. NIST says finalized PQC standards are unaffected.
NIST listed several minor issues for correction in a future revision. The ML-DSA standard remains final and available.
A preprint estimates that under one million noisy qubits could factor RSA-2048 in under a week—under explicit, demanding assumptions.