Q-Day Explained: What It Means, Why Nobody Knows the Date, and the Early Warning Signs
What people mean by Q-Day
Q-Day is not an official term. It is shorthand for the moment a quantum computer becomes powerful and reliable enough to run Shor's algorithm against the public key cryptography that protects the internet. Researchers usually call such a machine a cryptographically relevant quantum computer, or CRQC. Two families are at risk: RSA and elliptic curve cryptography. Both rely on math problems that Shor's algorithm could solve efficiently on a big enough, error-corrected machine.
Important honesty point: as of 2026-10-09 no quantum computer can do this. The resource estimates in the sections below are paper designs, not demonstrations. Anyone who tells you the exact year is guessing, and this site will not do that.
What is not at risk
Quantum computers are not a magic lock pick. Symmetric encryption such as AES-256 and hash functions are affected only mildly (see Grover's algorithm and hash functions). The exposed pieces are the public key parts: key exchange, digital signatures and certificates. That is a big list, but it is a bounded one, and replacements have been standardized by NIST (see how NIST chose them).
Why the date is a range
Three separate uncertainties multiply together.
- Hardware: Today's machines are far smaller and noisier than the error-corrected systems the estimates assume. How fast labs close that gap is unknown. See the state of play in error correction.
- Algorithms: Estimates have fallen sharply over the years as researchers found cleverer circuits. They could fall further, or hit a floor. Nobody can schedule a clever idea.
- Secrecy: A government lab might be ahead of public papers, or behind them. Public information is all anyone outside can use.
Because of this, serious sources give probabilities over spans of years. The Global Risk Institute survey, for example, reported on a page dated 9 March 2026 that its 26 experts put a CRQC at 28% to 49% likely within 10 years, depending on how answers are read. That is a range of opinion from a small sample, not a forecast. The full numbers are in our survey guide.
Why people care before Q-Day arrives
Two reasons. First, harvest now, decrypt later: an adversary can record encrypted traffic today and wait. Data that must stay secret for decades is already in scope. Second, migration is slow. Replacing cryptography across every device, certificate and contract takes years, so planners start early. UK guidance, for instance, sets milestones for 2028, 2031 and 2035 (see the advisories guide).
Early warning signs to watch
There will probably not be a single dramatic announcement. These are the kinds of signals that would matter, and they are our reading of the field, not a checklist from any agency:
- Logical qubit counts and error rates. The estimates need on the order of 1,000 or more good logical qubits running billions of operations. Watch for demonstrations of many logical qubits running long, deep circuits, not just a few qubits held for short times. See the surface code and error correction.
- Real-time decoding and scaling. Fast classical hardware that corrects errors as they happen is a quiet but essential piece.
- Manufacturing scale. Roadmaps that move from hundreds of physical qubits to tens of thousands and then hundreds of thousands, with real delivery dates and real yields.
- Smaller factoring and discrete-log demos with error correction. Breaking toy-size keys with fault-tolerant logic would be a milestone. Beware of old claims that used tricks or pre-known answers.
- New resource estimates. Each credible drop in required qubits shortens the gap. Several landed in 2025 and 2026 (see the RSA history and the elliptic curve update).
- Agency language changing. If standards bodies pull deadlines earlier, that signals that insiders' risk views have shifted.
How to read headlines
Treat "quantum computer breaks encryption" headlines with care. Ask: which key size, which machine, was it simulated, and was it a paper estimate? Most are the last one. For a calmer look at the hype cycle, see quantum computing myths.
Bottom line
Q-Day is a risk to plan for, not a date to bet on. This page is education, not financial advice, and it makes no prediction about the price of any asset. The QNT memecoin is independent of Quantinuum Ltd, which is a real company and is not connected to the token.
Sources and further reading
- Global Risk Institute: Quantum Threat Timeline Report 2025 (page dated 9 March 2026)
- PostQuantum.com: analysis of the Quantum Threat Timeline Report 2025
- Babbush et al., Google Quantum AI (30 March 2026): Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities, whitepaper
- Gidney (May 2025): How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv
- UK NCSC: PQC migration timelines
Reported as of 2026-10-09. Resource estimates are theoretical preprints or whitepapers, surveys are opinion, and government dates are planning targets, so check the primary documents. Nothing here is financial advice or a prediction of any asset price. The QNT memecoin is independent of Quantinuum Ltd, the real company, and of every lab, chain and government named on this page.
Frequently asked questions
What is Q-Day?
Q-Day is informal shorthand for the day a quantum computer can break widely used public key cryptography such as RSA and elliptic curves. It is not an official date, and no such machine exists as of 2026-10-09.
Will Q-Day break all encryption?
No. Public key parts such as key exchange and signatures are the exposed pieces. Symmetric encryption like AES-256 and hash functions are only mildly affected.
Do experts agree on when Q-Day will happen?
No. A Global Risk Institute survey reported a 28% to 49% chance within 10 years, depending on how answers are read, from only 26 experts. Treat it as a range of opinion, not a forecast.
Keep reading
- What Do Experts Say About Q-Day? The Global Risk Institute Survey Numbers
The Quantum Threat Timeline Report asks quantum experts when a cryptographically relevant computer could arrive. Here are the numbers, and their limits. - Harvest Now, Decrypt Later: The Quantum Threat Explained
Harvest now, decrypt later means collecting encrypted data today to unlock it with a future quantum computer. What it is and who should care. - What Governments Assume About Q-Day, and a Calm What-To-Do-Now List
NIST, NSA, UK NCSC and Germany's BSI set migration dates without naming a Q-Day. Here is what they say, plus a practical list for people and companies.
All Quantum computing guides | Back to top | Search the site
Main pages: Quantum computing explained | Quantum and crypto | Companies | Quantum news | Glossary