Q-Day is the informal name for the moment a quantum computer becomes capable of breaking widely used public-key cryptography, such as RSA-2048 or the elliptic curves used in TLS. The machine that can do this is called a cryptographically relevant quantum computer (CRQC).
What happens on Q-Day
From that point, any data protected only by quantum-vulnerable key exchange is at risk, including traffic recorded in the past. Any signature scheme based on RSA or elliptic curves can be forged. Certificates, code signing, secure boot and document signatures stop providing reliable authenticity.
When will it happen?
No one knows. Estimates vary widely and depend on progress in qubit quality, error correction and algorithms, and published resource estimates for breaking RSA have fallen several times. Crucially, Q-Day may not be public: a state actor that achieves it has every incentive to keep it secret.
Why the date matters less than the deadlines
Three facts make waiting for certainty a poor strategy:
- Harvest now, decrypt later means data captured today is exposed on Q-Day, whenever it arrives.
- Migration takes years. Replacing cryptography across networks, PKI, devices and applications is a multi-year programme.
- Deadlines are already set. NIST IR 8547 deprecates quantum-vulnerable algorithms from 2030 and disallows them from 2035. CNSA 2.0 sets earlier milestones for national security systems.
In practice, regulators and customers will treat quantum-vulnerable cryptography as non-compliant well before any Q-Day.
Preparing for Q-Day
- Build a cryptographic inventory and a migration roadmap.
- Adopt hybrid post-quantum key exchange for data in transit.
- Move roots of trust such as firmware and code signing to PQC signatures.
- Design for crypto-agility, so the next algorithm change is routine.