What is Q-day?
Q-day is an informal name for the point at which a quantum computer could undermine the public-key cryptography, mainly RSA and elliptic curve, that protects most of today's online banking, messaging and payments. No one knows when it will come, and it may not be a single, clearly announced day. For planning, what matters is that preparing takes years, so the work has to start long before any such machine exists.
Where the name comes from
Security people borrowed the shape of the name from "D-day": a single date after which everything changes. The machine that would make it happen has a more formal name, a cryptographically relevant quantum computer, or CRQC. Such a machine could use Shor's algorithm to work out private keys for RSA and elliptic-curve cryptography from information that is public by design.
In practice, "Q-day" is planning shorthand rather than a precise event. Different key sizes and schemes could become breakable at different times, and a capable machine wouldn't decrypt every record or compromise every system on the same day. Attacks would still need the data, and time on the machine.
What changes on Q-day, and what doesn't
| Type of cryptography | Used for | After Q-day |
|---|---|---|
| RSA and elliptic curve | Agreeing keys, signatures, certificates | Security undermined: plan to replace them before then |
| AES and modern hashes | Encrypting data, checking it hasn't changed | Weakened, not broken: AES-256 keeps a comfortable margin; hash requirements depend on how each hash is used |
| Post-quantum algorithms (ML-KEM, ML-DSA) | The replacements | Designed to resist known quantum attacks |
When is Q-day?
No one knows. Estimates depend on progress in quantum hardware, error correction and algorithms, so any specific year is best treated as a scenario, not a prediction.
What has changed is the size of the published estimates. In 2019, Google researcher Craig Gidney and Martin Ekerå estimated that breaking 2048-bit RSA would need about 20 million noisy qubits, under their assumptions. In 2025, Gidney's revised design needed under a million, running for less than a week, under its own assumptions about error rates and hardware speed. A lower estimate doesn't by itself move Q-day on the calendar, but it lowers the bar the hardware has to clear. Today's machines have hundreds to low thousands of physical qubits.
To test your own numbers against several timelines, try the Mosca calculator.
You don't need to know the date of Q-day to act. You need to know that your data must stay secret, and your systems take time to change, for longer than you'd be comfortable betting on.
Why "years away" isn't reassuring
Two reasons. First, an attacker can record encrypted traffic today and decrypt it after Q-day, a strategy called harvest now, decrypt later. Data that must stay confidential for many years is already at risk under that timeline. Second, replacing cryptography across a bank takes years, because it lives in thousands of systems, suppliers and payment networks.
That's why governments have published dates instead of waiting, though each binds different organisations:
- United States: NIST's transition plan, IR 8547, is still an initial public draft. It proposes deprecating today's vulnerable public-key algorithms from 2030 and disallowing them by 2035, for systems that follow NIST standards.
- Canada: the Canadian Centre for Cyber Security's roadmap sets milestones for federal government departments and agencies: high-priority systems by the end of 2031, the rest by the end of 2035.
- European Union: a coordinated roadmap of recommendations to member states points to high-risk systems by 2030 and the rest by 2035.
None of these is a direct legal deadline for every bank. Together they show the direction that regulators, suppliers and payment networks are taking.
Common confusions
- "Q-day means quantum computers arrive." Useful quantum computers for chemistry or research may arrive earlier. Q-day is specifically about breaking cryptography.
- "We'll get a warning." Planners don't assume so. Progress is published unevenly, and the first capable machine need not be announced.
- "After Q-day, everything is readable." Only data protected by vulnerable public-key methods, and only if someone recorded it or can reach it.
Sources and further reading
Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- Peer-reviewed paperHow to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubitsCraig Gidney and Martin Ekerå, Quantum, 2021
- PreprintHow to factor 2048 bit RSA integers with less than a million noisy qubitsCraig Gidney, 2025
- Peer-reviewed paperCybersecurity in an era with quantum computers: will we be ready?Michele Mosca, IEEE Security & Privacy, 2018
- Government guidanceNIST IR 8547 (Initial Public Draft): Transition to Post-Quantum Cryptography StandardsNIST, 2024
- Government guidanceRoadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001)Canadian Centre for Cyber Security, 2025
- Government guidanceA Coordinated Implementation Roadmap for the Transition to Post-Quantum CryptographyEuropean Commission / NIS Cooperation Group, 2025