What Is Q-Day? Post-Quantum Cryptography (PQC) Explained

Q-Day is the cybersecurity term for the moment quantum computers become powerful enough to break today’s main public key encryption systems, including RSA and elliptic curve cryptography (ECC). Nobody can put a date on it yet, but recent research suggests it may be closer than we thought.

This post covers how quantum computing threatens today’s encryption, where we are on the quantum timeline, what post-quantum cryptography (PQC) is, and what you should do now to prepare.

Why Today’s Encryption Works

Modern public key encryption relies on math that is easy in one direction and painfully hard in the other. Take two enormous prime numbers and multiply them together: that is easy, and the product becomes the basis for a key. Reversing the process to find the original primes is the hard part.

That is the key point. Encryption is not truly uncrackable. It is that the time and energy needed to break it with today’s technology make it mathematically infeasible. Factoring a 2048-bit RSA key would take hundreds or even thousands of years with classical computers. Security people call this brute-force infeasibility: encryption’s safety is not absolute, it is just computationally out of reach.

Bits vs Qubits: Why Quantum Changes the Math

Classical computers work in binary bits. A bit is either a one or a zero. A quantum bit, or qubit, exists in a quantum state that can be both one and zero at the same time. This is called superposition, and it means a qubit represents a probability distribution instead of a fixed value.

The easiest way to picture it is a coin flip:

• In a classical computer, the coin lands on heads or tails. You get one result, one state.
• In a quantum system, while the coin spins in the air, it is both heads and tails at once. Quantum algorithms do their work during that spin, exploring many possibilities simultaneously.

When the coin lands and the state collapses, you get a single result, but that result reflects a computation performed across a massive number of possibilities in parallel. Instead of trying keys one after another, which could take hundreds of years, a quantum algorithm can collapse the search from effectively impossible to potentially crackable.

That advantage shows up in specific problems, particularly large-number factorization and discrete logarithms, which is exactly the math behind RSA and ECC today.

The Quantum Computing Timeline: How Close Is Q-Day?

Based on current estimates from agencies, academic research and industry, the video lays the road to Q-Day out in four eras:

1. Today, the NISQ era (roughly 100 to 500 qubits). NISQ stands for noisy intermediate-scale quantum. This is where Google’s Willow chip sits, and even by Google’s own definition it is not powerful enough to break cryptography. Qubits are extremely sensitive to their environment: tiny vibrations, temperature changes or electromagnetic interference knock them out of their quantum state, a process called decoherence. Coherence times today run from microseconds to milliseconds, with high error rates.
2. Early fault tolerance (about 1,000 to 10,000 qubits). Basic quantum error correction and a handful of logical qubits that stay coherent long enough for deeper, but still limited, operations.
3. The cryptographically relevant zone (about 100,000 to 1,000,000 qubits). Surface-code-style error correction, and the range where breaking RSA-2048 becomes theoretically possible.
4. Full-scale quantum computing (20 million qubits and up). Where analysts previously expected quantum computers to become cryptographically relevant, which most put one to three decades out.

Google’s 2025 Estimate: RSA-2048 With Less Than a Million Qubits

The third era matters most to us because of a 2025 paper from Google Quantum AI. In it, Craig Gidney estimates that a 2048-bit RSA integer could be factored in less than a week by a quantum computer with less than a million noisy qubits.

That is a big shift. The earlier estimate, which Gidney co-published in 2019, was 20 million noisy qubits for an 8-hour break. The new paper does not say Q-Day is here. It says the hardware bar for breaking RSA-2048 is far lower than we previously assumed, and that makes a strong case for moving away from RSA-2048 and other schemes that are not quantum safe sooner rather than later.

Harvest Now, Decrypt Later: Why Q-Day Is Already a Problem

Here is why this matters today and not just on Q-Day. Any encrypted data harvested now can be stored indefinitely until a quantum system can decrypt it. Once that capability exists, those historical archives become readable.

This is called harvest now, decrypt later, and it is not theoretical. Nation states and well-resourced actors already have every incentive to collect and keep encrypted traffic for long-horizon intelligence.

What Is Post-Quantum Cryptography (PQC)?

The answer to Q-Day is post-quantum cryptography: new cryptographic algorithms designed to resist quantum attacks while still running on the classical systems we use today.

PQC algorithms do not rely on factorization or discrete logarithms. Instead they use other families of math, such as:

• Lattice-based cryptography: easy to generate, hard to reverse
• Multivariate quadratic equations: interconnected variables where changes ripple through
• Code-based cryptography: messages hidden in noise that is hard to decode

These problems do not suddenly become easy just because a quantum algorithm is applied to them, so the work factor stays high even for quantum hardware.

NIST PQC Standards and Migration Guidance

NIST has already issued recommendations for organizations to begin migrating, and it has standardized the key building blocks:

• Key establishment: ML-KEM (FIPS 203)
• Digital signatures: ML-DSA (FIPS 204) and SLH-DSA (FIPS 205)
• Inventory: guidance on finding where RSA and ECC are used today
• A phased transition plan, including hybrid mode, so new PQC-capable systems stay interoperable with existing ones while you gain quantum resistance

Most vendors have added support for the NIST-selected algorithms over the last few years, often in hybrid configurations, so enterprises can start testing, piloting and gradually deploying quantum-safe cryptography now.

Where things stand in 2026: NIST plans to deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035, with high-risk systems moving much earlier. In June 2026, Executive Order 14412 set deadlines for U.S. federal agencies to move their high value assets and high impact systems to PQC for key establishment by December 31, 2030, and for digital signatures by December 31, 2031.

How to Prepare for Q-Day Now

The most important step is to take inventory of how your sensitive data is stored and encrypted, then sort it:

• Non-essential data: Decide what truly needs to exist ten years from now. If data has no clear long-term business purpose, regulatory requirement or evidentiary need, securely wipe it. Do not spend PQC effort protecting data that does not need to be around that long anyway.
• Data at rest you keep, and newly encrypted data: Protect it with quantum-resistant schemes so that, if it is ever harvested, it stays protected. That includes making sure your storage encryption, key management and archival systems are post-quantum ready.
• Data in motion: The risk is not that today’s sessions get broken today. It is that your encrypted traffic is captured now and decrypted later. For transient flows such as TLS sessions, IPsec VPN tunnels and API traffic, look for technologies and vendors with PQC ready and built into the encryption stack.

Q-Day Won’t Arrive in a Single Day

To frame this realistically, Q-Day will not show up as one announcement. By the time we see commercial or lab demonstrations of quantum computers breaking real cryptography, nation states and well-resourced actors have likely been using the capability for some time. When Q-Day does arrive, global secrecy resets overnight, and from that point only quantum-safe systems can be trusted.

The migration takes years, which is why the time to start is now.

For the full walkthrough, including the quantum timeline and NIST’s building blocks, watch Post-Quantum Cryptography (PQC) Explained: The Race to Q-Day on The CISO Perspective YouTube channel.

Sources:

• Craig Gidney, Google Quantum AI: How to factor 2048 bit RSA integers with less than a million noisy qubits (arXiv, 2025)
• Gidney and Ekerå: How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits (arXiv, 2019)
• Google: Meet Willow, our state-of-the-art quantum chip
• NIST: Post-quantum cryptography FIPS approved (FIPS 203, 204, 205), Aug 13, 2024
• NIST CSRC: Post-Quantum Cryptography project and migration guidance
• Federal Register: Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, June 25, 2026

Make sure to follow us across all platforms for more explainers on cybersecurity and emerging tech.