Q-Day is the informal name for the point when a quantum computer becomes powerful and reliable enough to break the public-key cryptography used across today’s internet. It is not a scheduled date, and no authority knows when it will happen. The practical deadline arrives earlier: organizations need years to find vulnerable cryptography, replace it and test the systems around it.
NIST’s new migration road map, published October 27, 2026, makes that distinction concrete. The agency says a cryptanalytically relevant quantum computer is still in development, but the transition to post-quantum cryptography has to begin before one exists.
Sources checked: October 29, 2026.
What Q-Day means
“Q-Day” is shorthand rather than the name of a single technical milestone. NIST uses the more precise phrase cryptanalytically relevant quantum computer, or CRQC: a machine capable of defeating cryptography that is currently used to protect real systems.
The risk centers on public-key cryptography. Public keys let a browser establish a secure connection with a website, let software verify a digital signature and let two parties exchange secrets without first sharing a password. Much of that infrastructure relies on mathematical problems that conventional computers cannot solve efficiently.
A sufficiently capable quantum computer would change the calculation for widely used public-key systems. That is why Q-Day is described as a cryptographic deadline, not simply the launch of a faster computer.
For the basic ideas behind the hardware, see what a qubit is and how quantum computing works.
Q-Day has no confirmed date
Forecasts vary because building a CRQC requires more than adding qubits. The machine needs enough useful, controlled quantum operations to run a cryptanalytic attack at scale. Error rates, error correction, connectivity and the overhead of turning physical qubits into reliable logical qubits all matter.
NIST says no one knows how long it will take to build a cryptographically relevant quantum computer. Its public introduction to post-quantum cryptography notes that estimates vary widely and that information-system migrations have historically taken 10 to 20 years.
That uncertainty is not a reason to choose an arbitrary countdown. It is a reason to work from the lifetime of the data and the time needed to replace the cryptography. A secret that must remain confidential for 15 years has a different risk profile from a session token that expires in minutes.
What would be at risk
The first concern is public-key cryptography that is vulnerable to quantum algorithms. It appears in more places than a visible lock icon in a browser:
- key establishment for encrypted network connections;
- digital signatures on software updates, documents and transactions;
- certificates that bind public keys to services or devices;
- identity, authentication and access-control systems;
- hardware roots of trust and long-lived embedded equipment.
Replacing an algorithm in a library is only one part of the job. Protocols, certificates, devices, suppliers, backup systems and compatibility rules may also need to change.
Q-Day does not mean every protected file instantly becomes public or every security control stops working. The exposure depends on which algorithm protects a system, how that algorithm is used, what an attacker has collected and whether the surrounding software has been migrated.
“Harvest now, decrypt later” moves the deadline forward
An attacker does not have to wait for Q-Day to collect useful material. NIST describes a harvest now, decrypt later threat: encrypted traffic or files can be captured today and stored in the hope that a future quantum computer will decrypt them.
That makes the retention period important. Medical records, government material, trade secrets and identity data may still be valuable when a future machine arrives. Moving those use cases to quantum-resistant key establishment can matter before an attacker can break anything in real time.
The threat also explains why the migration calendar is not a prediction of Q-Day. A 2035 transition target is a planning deadline for reducing exposure, not a claim that a CRQC will appear in 2035.
Post-quantum standards already exist
NIST finalized its first three principal post-quantum standards in August 2024:
- FIPS 203, ML-KEM, for establishing a shared secret;
- FIPS 204, ML-DSA, for digital signatures;
- FIPS 205, SLH-DSA, a stateless hash-based signature standard.
These algorithms are designed to run on conventional computers while resisting attacks from future quantum machines. They are not quantum computers, and users do not need quantum hardware to deploy them.
NIST says ML-KEM, ML-DSA and SLH-DSA can and should be put into use now. It is also developing additional algorithms as backups or alternatives. Our guide to post-quantum cryptography explains what these standards replace and why migration is broader than choosing a new algorithm.
The 2028, 2031 and 2035 milestones
The UK National Cyber Security Centre gives large organizations a practical sequence:
- By 2028: define migration goals, discover where cryptography is used and build an initial plan.
- By 2031: complete the earliest high-priority migrations and refine the full road map.
- By 2035: complete migration across systems, services and products, except for a limited tail of especially difficult technology.
NIST’s 2026 transition report also works toward 2035, while bringing high-value and high-impact US federal systems forward: key establishment by 2030 and digital signatures by 2031 under the federal timetable it describes.
These dates are not identical obligations for every private organization. They show why discovery cannot wait until a quantum breakthrough is announced. Procurement cycles, old hardware and supplier dependencies can outlast a rushed security program.
What migration work looks like now
A useful first step is a cryptographic inventory. Teams need to know which applications, protocols, certificates, libraries, appliances and devices depend on vulnerable public-key algorithms. The inventory should include systems bought from suppliers, not only software written in-house.
The next steps are prioritization and crypto-agility:
- identify data that must remain confidential for many years;
- find systems that are difficult or impossible to update;
- ask suppliers which standardized post-quantum options they support and on what schedule;
- test new algorithms for performance, interoperability and failure behavior;
- design configurations that can change again without replacing the whole product;
- plan certificate, key and hardware transitions alongside the software change.
NIST’s report also discusses hybrid approaches that combine conventional and post-quantum cryptography. A hybrid can reduce dependence on one new component, but it adds computational and operational cost. It still needs careful implementation and does not remove the need for an inventory.
What individuals need to do
Most people should not buy an unverified “quantum-safe” product or replace every device today. Consumer protection will mostly arrive through operating-system, browser, messaging, cloud and financial-service updates.
The useful actions are ordinary but specific: keep supported software updated, replace devices that no longer receive security fixes and pay attention to providers’ migration notices. Organizations handling long-lived sensitive data need a formal plan sooner; an individual user usually needs trustworthy products that implement the standards correctly.
