Q-Day: When Quantum Computers Break Encryption

Q-Day is the name security specialists give to the moment a quantum computer first becomes powerful enough to break the encryption that protects the modern internet. It is not a date on any calendar, and no machine can do it yet, but the idea has moved from a distant thought experiment to a planning assumption inside governments and large companies.

This guide explains what Q-Day actually is, which encryption it threatens, and why the response has to begin years before the hardware arrives. It also sets out the realistic timeline, the post-quantum cryptography standards meant to blunt the threat, and the practical steps an organisation can take now. For the wider science behind the machines involved, our complete guide to quantum computing covers the physics in full.

What Q-Day Means

Q-Day refers to the first day a working quantum computer can defeat the public-key cryptography that the internet depends on. The term is deliberately dramatic, because the change it describes is sudden in effect even though the engineering behind it is slow and incremental.

The reason a single day matters is that public-key encryption is binary in a practical sense. Either an algorithm is hard to break or it is not, and the arrival of a sufficiently capable machine flips that state for everyone at once. On that morning, secrets that were safe the night before are no longer safe at all.

It helps to be precise about the machine in question. Researchers call it a cryptographically relevant quantum computer, meaning one large and accurate enough to run a code-breaking algorithm against real keys. The milestone is simply the day such a machine first exists and is used, whether that fact is announced or kept quiet.

The term is often confused with the general progress of quantum computing, but the two are not the same. Useful quantum machines for chemistry or optimisation may arrive well before any computer can threaten encryption, so this is a specific milestone rather than a synonym for the technology maturing.

The Encryption Q-Day Puts at Risk

To see why the threat matters, it helps to know what public-key cryptography does. Every time a browser shows a padlock, two parties that have never met agree on a secret key over an open channel, and they verify each other with digital signatures. That handshake is what Q-Day threatens.

Three families of algorithm carry most of that load today, and all three rest on mathematics that a quantum computer can unravel. They are the schemes that scramble a connection before any real data passes through it.

• RSA secures key exchange and digital signatures, and its safety depends on the difficulty of factoring very large numbers into their prime parts.
• Diffie-Hellman lets two parties establish a shared secret, and it relies on the hardness of the discrete logarithm problem.
• Elliptic-curve cryptography does the same work as the two schemes above with smaller keys, which is why it dominates mobile devices and messaging apps, and it depends on a discrete logarithm problem of its own.

These algorithms protect far more than web browsing. They sign software updates, authenticate payment networks, secure virtual private networks, and underpin the certificates that let devices trust one another. A capable quantum computer puts that entire layer of trust in question, which is why the issue reaches well beyond cryptographers.

Why Shor’s Algorithm Changes Everything

The threat behind Q-Day is not vague. It rests on a specific result published in 1994 by the mathematician Peter Shor, who showed that a quantum computer could factor large numbers and solve discrete logarithms efficiently.

That matters because the security of RSA and elliptic-curve cryptography assumes those exact problems are effectively impossible at scale. A classical computer would need longer than the age of the universe to factor a modern RSA key, while the same method reduces the task to something a large quantum machine could finish in hours or days.

The catch is the size of machine required, and that gap is the only reason Q-Day has not already arrived. Running Shor’s algorithm against a real key demands a quantum computer with vast numbers of stable, error-corrected qubits, far beyond anything built so far. Progress in quantum error correction is what slowly closes that gap.

It is worth stressing that this is a known, published method rather than a secret. The underlying mathematics has been understood for three decades, and the suspense lies entirely in the engineering of the hardware needed to run it.

Harvest Now, Decrypt Later

The most common objection to worrying about the threat is that the hardware is years away, so there is no urgency. That reasoning misses the single most important feature of the danger.

Encrypted data can be recorded today and stored untouched until a quantum computer exists to open it. Security specialists call this harvest now, decrypt later, and it means an adversary does not need a code-breaking machine in hand to benefit from one in the future. They only need patience and storage.

The consequence is that the threat reaches backwards in time. Any secret transmitted now that must remain confidential for a decade or more is already exposed, because the traffic protecting it could be sitting in an archive waiting for the hardware to catch up. Diplomatic cables, medical records, intelligence files, and trade secrets all fall into that category.

This is the reasoning that turns Q-Day from a future problem into a present one. The deadline for protecting long-lived data is not Q-Day itself, but the day that data is first sent, and for many records that day has already passed.

When Will Q-Day Arrive?

Predicting the date of Q-Day is genuinely hard, because it depends on engineering progress that has not happened yet. Forecasts therefore come as probability ranges rather than fixed years, and they should be read in that spirit.

Expert surveys of cryptographers and quantum specialists have for several years placed a meaningful chance of a capable machine within a ten to fifteen year window. The Quantum Threat Timeline Report, compiled by Michele Mosca and Marco Piani for the Global Risk Institute, gathers those opinions each year and finds a spread across the 2030s and 2040s rather than a single date.

Modelled forecasts have pulled the central estimate earlier than the surveys do. The most quoted of them puts the baseline in 2033, and because that figure now turns up in board papers and vendor decks without its working, the next section sets out where it comes from and what it assumes.

Government planning reflects that shift. The United States and several European states have set deadlines to complete their migration to quantum-safe cryptography around 2030 to 2035, which is a deliberately conservative posture that assumes the threshold could come at the early end of the range. Our overview of the quantum computing roadmap to 2035 tracks the milestones in detail.

The honest summary is that no one can name the year of Q-Day with confidence. The responsible planning assumption is not a best guess but a worst plausible case, because the cost of being early is modest while the cost of being late is the loss of a great deal of sensitive data.

The 2033 Baseline and Who Produced It

The most widely quoted single year for Q-Day is 2033, and it comes from one specific model rather than from any consensus. Project Eleven, an applied lab working on cryptography for blockchains, published The Quantum Threat to Blockchains in 2026, and its model places the baseline scenario in 2033, with an optimistic case in 2030 and a pessimistic case in 2042.

The method matters more than the number, because a date without a method is only a mood. Project Eleven treats the question as supply against demand, asking when a machine’s logical qubit capacity and its budget of logical operations will exceed what Shor’s algorithm needs against RSA-2048. It adds a wall-clock ceiling of a hundred days, on the reasoning that an attack taking longer than that would not count as cryptographically relevant.

The three scenarios differ only in how fast the inputs improve. The 2033 baseline assumes physical qubit counts double each year, that two-qubit gate quality improves by a tenth each year from a 2026 starting point of 99.95 per cent, and that the algorithmic requirement falls by a fortieth each year. The 2030 case assumes those rates are faster and the 2042 case assumes they are slower, which is the honest way to present a forecast of this kind.

The authors are candid about where their model departs from physics, and that candour is a reason to take it seriously rather than to dismiss it. They fix the target logical error rate at one in a thousand trillion and work backwards to a code distance, which inflates the distance badly, so they compensate with an error suppression factor of between five and ten. Their own note records that the suppression factor measured in recent Google and Quantinuum experiments is about two, so the model is running on an assumption that hardware has not yet met.

One relationship belongs on the record for anyone weighing the report. Project Eleven lists Dolev Bluvstein, chief executive of the neutral-atom company Oratomic, among its advisers, and the report’s citation list includes an Oratomic paper arguing that Shor’s algorithm is possible with roughly ten thousand reconfigurable atomic qubits. That does not make the model wrong, but a forecast that leans on work from a company its adviser runs is worth reading with the connection in view.

The practical use of any of these dates is not to plan for the year itself. It is to notice that the official migration deadlines described later in this guide land at or after the middle forecast, which leaves no slack if the middle forecast turns out to be right.

How Big a Quantum Computer Q-Day Needs

A natural question is how large a machine the attack actually requires, and the answer has shifted dramatically as the research has matured. The figure is not fixed, because it depends on both the hardware and the cleverness of the algorithms running on it.

The reference point for years was a 2019 estimate by Craig Gidney and Martin Ekerå, published in the journal Quantum in 2021, which put the job at roughly twenty million noisy physical qubits running for eight hours. That number shaped a decade of thinking and made the threat feel comfortably distant, since the best machines of the day held only dozens of qubits.

Gidney revised his own figure in May 2025, cutting the requirement to fewer than a million noisy physical qubits at the cost of a longer run of under a week. The saving came from three named changes rather than one breakthrough, namely approximate residue arithmetic, storing idle logical qubits in yoked surface codes, and using magic state cultivation in place of a larger distillation factory.

What makes the revision striking is what did not change. Gidney kept the hardware assumptions of the earlier paper, a gate error rate of one in a thousand, a surface-code cycle of one microsecond and a square grid with nearest-neighbour links, so the twentyfold reduction came entirely from better algorithms and better error-correcting codes. The bar for Q-Day can fall without a single new qubit being built, which is the part of this story that most timelines miss.

Even the reduced figure is far beyond current machines, which operate in the range of hundreds to a few thousand physical qubits. A 2026 preprint from Paul Webster and colleagues argues that quantum low-density parity-check codes could bring the count to about a hundred thousand physical qubits, though that work has not been independently replicated and no such machine exists. The trend of these estimates has consistently been downward, and that direction of travel is itself a reason for caution.

How Many Logical Qubits Actually Exist

Physical qubit counts are the wrong yardstick for Q-Day, because the attack needs error-corrected logical qubits rather than noisy physical ones. On that measure the honest number is far smaller than almost any headline suggests, and it has not moved for more than eighteen months.

The largest number of logical qubits ever operated with repeated, real-time error correction and no discarded results is one. That was Google’s Willow processor, reported in Nature in December 2024, which ran a distance-seven surface code below the error-correction threshold and suppressed the logical error rate by a factor of 2.14 for every two-step increase in code distance. The same work demonstrated decoding fast enough to keep up with the machine, at an average latency of sixty-three microseconds, sustained over a million cycles at distance five.

Every larger figure in circulation is something else, and the difference is not a technicality. Error detection is not error correction, because a distance-two code can notice that something went wrong without being able to say what or where, so the only available response is to throw the run away. Post-selection is the same manoeuvre under another name, keeping only the runs in which nothing was flagged, and the fraction kept is the number that tells you whether the method would survive contact with a real algorithm.

Quantinuum’s February 2026 preprint carries the strongest large claim that survives that test. Working on the 98-qubit Helios processor, the team ran a two-level concatenated iceberg code at distance four holding 48 logical qubits, and reported an acceptance rate of 0.62, meaning that a little under two shots in five were discarded. The same paper reports 94 logical qubits in a distance-two iceberg code, which detects errors without being able to correct them, so it is the 48 rather than the 94 that belongs in any comparison.

IBM’s July 2026 preprint is often read as seventy logical qubits, and it needs its context restored. The team encoded a seventy-qubit, depth-seventy Clifford circuit doped with 468 T gates into spacetime codes using 97 physical qubits, suppressing gate error rates roughly tenfold, and certified a fidelity lower bound of 0.284 with 95 per cent confidence. That certificate came at a post-selection rate of 5.90 times ten to the minus four, which is about one surviving shot in every seventeen hundred.

Set all of that against the requirement, and the shape of the Q-Day problem becomes clear. Breaking RSA-2048 needs something on the order of a thousand logical qubits, so the distance between one and a thousand is the whole of the question. This is why records for raw physical qubit counts are a poor guide to how close the day is, and why our logical qubit tracker follows the corrected count instead.

Google’s own paper puts a price on closing that gap. Extrapolating from its measured error rates, the team calculated that reaching a logical error rate of one in a million would need a distance-twenty-seven logical qubit built from 1,457 physical qubits, and that is the cost of a single logical qubit. The same paper notes that halving the physical error rate would improve distance-twenty-seven performance by four orders of magnitude, so the overhead is a function of qubit quality rather than a fixed tax.

Company roadmaps project a much steeper climb, and they should be read as projections rather than as results. IBM targets around 200 logical qubits in its Starling system in 2029 and around 2,000 in Blue Jay in 2033, while QuEra targets 256 logical qubits in 2028 and more than a thousand in 2028 or 2029. None of these machines exists, and every one of those dates is a commercial commitment rather than a measurement.

Reading a Logical Qubit Announcement

Because the definitions in use differ so widely, a logical qubit headline means very little on its own. Three further numbers turn almost any announcement back into something comparable, and all three are normally in the paper even when they are missing from the press release.

The first is whether errors were corrected or merely detected, which follows from the code distance. A distance-two code can spot a single fault but cannot locate it, so the run has to be discarded, whereas correction needs distance three or more. An announcement that quotes a logical qubit count without a code distance is describing an unspecified quantity.

The second is the acceptance rate, sometimes called the post-selection rate. If a demonstration keeps one shot in seventeen hundred, then a real computation would have to run seventeen hundred times longer to compensate, and that is not an engineering detail but a ceiling on how far the technique can scale.

The third is whether decoding happened while the machine was running. Reconstructing what went wrong from a syndrome record after the experiment has finished is a legitimate piece of analysis, but a computer running Shor’s algorithm has to decode fast enough to decide which gate to apply next, and offline decoding demonstrates nothing about that.

Publication status is worth a moment as well. A result reporting 24 and 28 logical qubits on a neutral-atom processor, from Microsoft and Atom Computing, is widely cited and has remained a preprint with no journal publication for more than twenty months since it first appeared. It is nonetheless sometimes described in print as a Nature paper, which it is not, so the peer-review status of a result is worth checking before it is quoted as settled.

What Q-Day Does Not Break

Q-Day is a serious problem, but it is a specific one, and a clear picture has to include what stays safe. Overstating the threat is as unhelpful as ignoring it, because it leads to wasted effort and misplaced alarm.

Symmetric encryption is the main survivor. Algorithms such as AES, which both sides use with a shared key, are only modestly weakened by quantum search methods. The practical effect is that a quantum attacker roughly halves the effective key length, so moving from AES-128 to AES-256 restores a comfortable margin and symmetric ciphers come through intact.

Modern hash functions are in a similar position. The families used today remain robust against known quantum attacks, and where extra caution is wanted, longer output sizes close the gap. The mathematics the attack undermines is narrowly the public-key kind, not encryption as a whole.

This distinction is the foundation of the whole defence. Because symmetric cryptography survives, the migration ahead is not a rebuild of all encryption but a targeted replacement of the public-key layer, which is a large job but a bounded one.

Post-Quantum Cryptography and the NIST Standards

The defence against Q-Day already exists, and it is called post-quantum cryptography. These are encryption algorithms designed to run on ordinary computers while resisting attacks from quantum ones, because they rest on mathematical problems that Shor’s algorithm cannot solve.

The United States standards body NIST ran a multi-year public competition to select them, and in 2024 it finalised the first standards. The headline schemes are ML-KEM for key exchange, published as FIPS 203 and based on a submission known as Kyber, together with ML-DSA in FIPS 204 and SLH-DSA in FIPS 205 for digital signatures. A fourth scheme, FN-DSA, has been announced as the future FIPS 206, but no draft of that standard had been published as of August 2026, so anyone building today has three finalised algorithms rather than four. You can read the official detail in the post-quantum cryptography standards published for the world after Q-Day.

Most of these algorithms rely on the mathematics of structured lattices, a problem family with no known efficient quantum attack. SLH-DSA takes a different route, building signatures purely from hash functions, which gives the standards set a deliberate variety so that a future weakness in one approach does not undo the whole defence.

Crucially, these algorithms run on the laptops, phones, and servers people already own. Defending against Q-Day does not require quantum hardware of your own, only new software, and our guide to post-quantum computing walks through how the migration is meant to unfold.

Crypto-Agility and the Migration Problem

Having standard algorithms is only the start. The harder task is replacing the cryptography woven through decades of software, hardware, and protocols, much of which was never designed to be swapped out easily.

Engineers describe the goal as crypto-agility, the ability to change cryptographic algorithms without rebuilding a system from scratch. Many older products hardcoded their encryption, so preparing for Q-Day often means finding cryptography that nobody documented and that no current team fully remembers.

The migration also has to handle a long transition. For years, systems will run both classical and post-quantum algorithms side by side in what are called hybrid modes, so that a flaw in a new scheme does not immediately break security. That dual-running adds complexity and cost, and it is one reason the response is measured in years rather than months.

History gives a sobering benchmark. Earlier cryptographic transitions, such as retiring weak hash functions, took the better part of a decade even with no looming deadline. Q-Day adds a deadline whose date is unknown, which makes an early and orderly start far more valuable than a rushed one later.

Government Deadlines Driving the Q-Day Response

Q-Day has become a matter of formal policy, not just expert concern. Several governments have issued binding instructions that set the pace of migration, and these deadlines are now the clearest signal of how seriously the threat is taken.

The clearest American statement is NIST Internal Report 8547, issued as an initial public draft in November 2024, which sets the schedule out in table form. It deprecates RSA, ECDSA, finite-field Diffie-Hellman and elliptic-curve Diffie-Hellman at the 112-bit security level after 2030, and disallows those algorithms entirely after 2035 along with their stronger 128-bit variants.

That schedule sits underneath National Security Memorandum 10, which the report quotes as setting the goal of mitigating as much of the quantum risk as is feasible by 2035. The National Security Agency runs a separate track for national security systems under a policy known as CNSA 2.0, whose requirements differ from the civilian schedule and are published through its own advisories rather than through NIST.

The United Kingdom has published the most explicit staging of the work. Guidance from the National Cyber Security Centre, issued in March 2025, asks organisations to have defined their migration goals and completed a discovery exercise by 2028, to have carried out their highest-priority migration work and refined their roadmap by 2031, and to have completed migration of all systems, services and products by 2035.

Other regions have followed similar paths. European cybersecurity agencies have urged organisations to begin migration without waiting for Q-Day, and several national bodies have published roadmaps with milestones in the same 2030 to 2035 window. Major technology vendors have aligned their product timelines with these dates, which is why supplier roadmaps are now a practical source of pressure as well as government rules.

For private organisations, these government deadlines act as a useful anchor. Even where the rules do not apply directly, they signal the timeline that regulators, auditors, and customers will soon expect, which makes them a sound basis for planning a response.

Quantum Key Distribution, a Different Defence

Post-quantum cryptography is not the only technology mentioned in the same breath as Q-Day. Quantum key distribution is a separate idea, and the two are often confused even though they solve the problem in very different ways.

Quantum key distribution uses the physics of single particles of light to share an encryption key between two points. Any attempt to intercept the key disturbs the particles and is detected, so its security rests on the laws of physics rather than on a hard mathematical problem. Our explainer on the quantum internet covers how such links are built.

The limitations are practical rather than theoretical. Quantum key distribution needs dedicated optical fibre or line-of-sight links, specialised hardware, and trusted relay points over long distances. It also secures only the key exchange step, so it does not remove the need for ordinary software encryption.

For these reasons, most experts treat post-quantum cryptography as the main answer to Q-Day and quantum key distribution as a niche complement. The software standards can be deployed everywhere at modest cost, while key distribution suits a small set of high-value links.

Mosca’s Inequality and Why Timing Matters

The clearest way to turn the uncertainty around Q-Day into a concrete decision comes from the cryptographer Michele Mosca, who set the problem out in IEEE Security and Privacy in 2018 as a comparison of three time spans. His formulation matters because it shows that an organisation can already be too late to protect its data long before Q-Day arrives. It does not depend on knowing the exact year, which is precisely why security planners find it so useful.

The power of this framing is that it makes the harvest-now threat tangible. An organisation whose records must stay confidential for ten years, and whose migration will take five, is exposed the moment Q-Day falls within fifteen years, which every forecast described above allows. This is the reasoning behind the government deadlines, and it is why the practical question for most organisations is how quickly to migrate rather than whether to bother at all.

The inequality is also the cleanest argument against waiting for certainty. Because Z is the only term nobody can measure, and because X and Y are both under an organisation’s own control, the sensible move is to shorten Y rather than to keep arguing about Z. Our guide to preparing for quantum computing sets out how that work is usually sequenced.

How an Organisation Should Prepare for Q-Day

Preparing for Q-Day can feel overwhelming, but the work breaks into a clear sequence of steps. None of them requires a quantum computer, and the early stages cost little beyond focused effort.

• Build a cryptographic inventory. Map where public-key encryption is used across applications, networks, and devices, since you cannot migrate what you have not found.
• Rank data by shelf life. Identify which secrets must stay confidential for ten years or more, because that data faces the harvest-now risk and should move first.
• Demand crypto-agility from vendors. Ask suppliers for their post-quantum roadmap and favour products that can change algorithms without a full replacement.
• Pilot the new standards. Test ML-KEM and the post-quantum signature schemes in hybrid mode on non-critical systems to build practical experience before Q-Day forces the pace.
• Write a migration plan. Set internal milestones aligned with the 2030 to 2035 government deadlines, and assign clear ownership for each stage.

The encouraging part is that the first two steps deliver value on their own. A clear cryptographic inventory and a ranked view of sensitive data improve security today, regardless of when Q-Day actually arrives, so the early work is never wasted.

What Q-Day Means for You Personally

Most coverage of the threat focuses on governments and corporations, which can leave individuals unsure whether the topic affects them. The reassuring answer is that the heavy lifting is not yours to do.

The cryptography on a personal phone or laptop is updated by the companies that build the operating systems, browsers, and messaging apps. Several major messaging services have already begun adding post-quantum protection to their key exchange, and that work reaches users automatically through ordinary software updates.

The single most useful habit is therefore the simplest one. Keeping devices and applications updated ensures that post-quantum defences arrive as soon as vendors ship them, which is the main way this protection will reach the public.

It is also worth keeping a sense of proportion. Q-Day is a genuine concern for long-lived institutional secrets, but for an individual the everyday risks of weak passwords and phishing remain far more pressing than a future quantum attack, and good basic security habits still matter most.

Q-Day Hype Versus Reality

Q-Day is a vivid idea, and vivid ideas attract exaggeration. A clear-eyed view has to separate the genuine threat from the marketing that has grown around it.

On the alarmist side, some coverage suggests that current quantum computers can already break encryption, or that Q-Day is months away. Neither claim holds up, because the hardware gap remains enormous and is measured in orders of magnitude. Headlines announcing that a small machine has factored a tiny number are real results, but they are nowhere near a threat to working keys.

On the dismissive side, others argue that because Q-Day has not happened, it never will, or that it can be ignored until the hardware appears. That view fails against the harvest-now problem, which makes long-lived data vulnerable today regardless of when the machine is finished.

The grounded position sits between the two. Q-Day is probably years away, its exact date is unknown, and the sensible response is a steady, well-planned migration that starts now. Reading announcements with that frame turns most Q-Day hype back into something measurable.

How We Will Know Q-Day Is Close

Because Q-Day depends on visible engineering progress, it will not arrive without warning signs. Watching the right indicators is more useful than guessing at a date.

The clearest signal is the count of logical qubits running with real-time correction and no post-selection, which has stood at one since December 2024. A machine threatening encryption needs roughly a thousand of them, so watching that number rather than the physical qubit record gives a far better sense of the timeline. The second number to watch is the error suppression factor, which Google measured at 2.14 on Willow and which several forecast models assume will reach five or more.

Other indicators include demonstrations of Shor’s algorithm factoring steadily larger numbers, improvements in the error-correction overhead that resource estimates assume, and shifts in the published forecasts of leading cryptographers. Each of these moves the expected date of Q-Day by a measurable amount.

The reassuring conclusion is that Q-Day is unlikely to be a true surprise to anyone paying attention. The warning signs will accumulate for years beforehand, which is precisely why a migration that starts early has time to finish in good order.

Before and After Q-Day, Compared

The practical change that Q-Day brings is easiest to see laid out side by side. The table below contrasts the cryptographic world as it works today with the world that the post-quantum transition is building.

Seen this way, Q-Day is less an apocalypse than a forced upgrade. The work is large and the deadline is uncertain, but the destination, a quantum-safe internet, is already well defined and partly built.

Key Q-Day Terms

A handful of terms come up repeatedly in any serious discussion of Q-Day. This short glossary keeps them in one place so the rest of the coverage is easier to follow.

• Q-Day: the still-unknown future day a quantum computer can break today’s standard public-key encryption.
• Cryptographically relevant quantum computer: a machine large and accurate enough to run a code-breaking algorithm against real keys.
• Shor’s algorithm: the 1994 quantum method that factors large numbers and solves discrete logarithms, the engine of the Q-Day threat.
• Harvest now, decrypt later: the tactic of storing encrypted data today to decrypt it once Q-Day arrives.
• Logical qubit: a single protected qubit built from many physical ones by an error-correcting code, and the unit in which a Q-Day machine is actually measured.
• Post-selection: keeping only the runs of an experiment in which no error was flagged, which improves the reported result and is reported as an acceptance rate.
• Post-quantum cryptography: encryption algorithms that run on ordinary computers but resist quantum attacks.
• ML-KEM: the NIST-standardised key-exchange algorithm, based on the scheme formerly known as Kyber.
• Crypto-agility: the ability to change cryptographic algorithms without rebuilding a system from scratch.
• Quantum key distribution: a hardware-based method of sharing keys whose security rests on physics rather than mathematics.

These terms cover most of what a newcomer meets in coverage of Q-Day. A far deeper reference is available in our full quantum computing glossary.

Further reading and tutorials

Each link below is a deeper companion piece on the QZ site. The PQC and post-quantum-cryptography pillars cover the defences, the cryptography pages cover the underlying algorithms, and the qubit and quantum-computing pillars cover the hardware that will eventually drive Q-Day.

• Top post-quantum cryptography companies, the vendor landscape building the FIPS-203/204/205 migration tooling.
• Top 20 post-quantum cryptography terms, a glossary for the algorithms cited in this guide.
• Quantum cybersecurity: preparing for the future of data security, the practitioner pillar on enterprise migration.
• What is a qubit?, the foundational explainer on the physical primitive Q-Day depends on.
• What is quantum computing? The complete 2026 guide, the parent pillar covering the full stack.
• Quantum internet 101, an overview of quantum key distribution and the QKD networks that complement post-quantum cryptography.
• Quantum computing glossary, the encyclopedic reference for every term in this article.

Frequently Asked Questions

The honest summary is that Q-Day is a real but manageable threat. No machine can break strong encryption today, the best hardware runs a single error-corrected logical qubit against a requirement of about a thousand, and the defence in the form of post-quantum cryptography is already standardised and shipping.

What has changed is the direction of the estimates rather than the state of the hardware. The qubit bill fell twentyfold in six years on unchanged hardware assumptions, and that is the reason to treat the migration deadlines as real even while the machines remain small.

What Q-Day demands is not panic but planning. Organisations that inventory their cryptography, protect their long-lived secrets first, and migrate steadily toward the new standards will meet Q-Day prepared. For the wider context, our complete guide to quantum computing and our overview of quantum cybersecurity are the natural next steps.