When will Q-Day come? What research in 2025 and 2026 shows

What Q-Day means

“Q-Day” refers to the day on which a quantum computer can break the public-key cryptography in widespread use today. This mainly means RSA and elliptic-curve algorithms, on which TLS, VPNs, code signing, PKIs and digital identities rely. Experts speak of a cryptographically relevant quantum computer, or CRQC for short.

That such a machine could break these algorithms has been known since 1994, when Peter Shor published the corresponding quantum algorithms. What remains open is when a machine large enough and with low enough error rates can be built. Research on this question moved significantly in 2025 and 2026. This article summarizes the most important work and puts into context what it proves and what it does not.

One term up front: today's quantum computers work with physical qubits, which are error-prone. Quantum error correction combines many physical qubits into one more stable logical qubit. Resource estimates therefore usually give both numbers. For the question of how far away the hardware still is, the number of physical qubits is what counts.

What experts expect: the Quantum Threat Timeline Report

The best-known long-term survey is the Global Risk Institute's Quantum Threat Timeline Report. For it, Michele Mosca and Marco Piani of evolutionQ survey experts from research and industry every year. The seventh edition, dated 9 March 2026, is based on the answers of 26 experts. Global Risk Institute

The result: respondents consider a cryptographically relevant quantum computer within the next ten years “quite possible”, with a probability of 28 to 49 percent. Within 15 years they consider it “likely”, at 51 to 70 percent. The report series defines such a machine as one that can break RSA-2048 within 24 hours.

A survey of 26 people is not a measurement. Its value lies in the time series: the same question has been asked for years, and the estimates have moved earlier across the editions.

What the BSI expects

The BSI, Germany's Federal Office for Information Security, has had the state of quantum computer development assessed in a dedicated study since 2017, most recently updated in 2025. Germany's national guideline on the post-quantum migration summarizes the result as follows: it is likely that such a quantum computer will be feasible within 15 years at most, that is, by 2040 or earlier. The basic assumptions of quantum error correction were fully verified in 2024, and further progress could shorten this period considerably. Guideline, PDF

For the high-security domain, the German federal government is more cautious. There, it works on the hypothesis that cryptographically relevant quantum computers will be available at the beginning of the 2030s. The guideline cites a Bundestag printed paper (Drucksache) from February 2025 for this.

The assessments of the BSI and the experts are therefore close: no breakthrough tomorrow, but a realistic possibility within the lifetime of systems being planned today.

Hardware estimates are falling

What has moved above all are the estimates of how large a quantum computer would need to be for an attack. Three papers from 2025 and 2026 are central here.

RSA-2048 with under a million qubits. In May 2025, Craig Gidney of Google Quantum AI estimated that a quantum computer with fewer than one million noisy qubits could factor a 2048-bit RSA integer in less than a week. arXiv:2505.15917 In 2019, his estimate together with Martin Ekerå was still 20 million qubits. arXiv:1905.09749 The hardware assumptions stayed the same: a square grid with nearest-neighbor connections only, an error rate of 0.1 percent per gate and an error correction cycle of one microsecond. The savings come from better algorithms and more efficient error correction, not from better hardware. The price is a longer runtime.

RSA-2048 with around 100,000 qubits. In February 2026, the Australian company Iceberg Quantum presented the “Pinnacle” architecture. It replaces the error correction commonly used so far with so-called qLDPC codes. Under the same assumptions about error rate and cycle time, Iceberg estimates around 98,000 physical qubits for a runtime of about one month, or around 471,000 qubits for about one day. arXiv:2602.11457 So far, the architecture has only been tested in simulations. It requires connections between distant qubits and very fast error decoding, neither of which has yet been demonstrated at this scale.

Elliptic curves in minutes. At the end of March 2026, Google Quantum AI, together with researchers from the Ethereum Foundation and Stanford University, published resource estimates for 256-bit curves, which secure Bitcoin and Ethereum, among others. Two optimized circuits manage with fewer than 1,200 logical qubits and fewer than 90 million Toffoli gates, or fewer than 1,450 logical qubits and fewer than 70 million Toffoli gates. On superconducting hardware with an error rate of 0.1 percent, this corresponds to fewer than 500,000 physical qubits and a runtime of a few minutes. Google puts this at roughly a 20-fold reduction compared with the previous best estimate. Google Research, arXiv:2603.28846

How Google published is also remarkable. The circuits themselves were not released, so as not to hand attackers a blueprint. Instead, a zero-knowledge proof demonstrates that the estimates are correct. For companies, that is a signal: research itself now treats the topic as security-relevant.

What the numbers do not say

However striking the curve, the papers have clear limits.

• The machine does not exist. Google's Willow chip had 105 qubits when it was presented in December 2024 and demonstrated error correction below the critical threshold. Google The hardware is far from hundreds of thousands of qubits computing with error correction over days or weeks.
• The assumptions are optimistic, but not exotic. All of the estimates mentioned assume an error rate of 0.1 percent and cycle times in the microsecond range. Individual platforms reach such values today, but not at this size and not sustained over time.
• Most of the papers are preprints. They have not yet been peer-reviewed. In Iceberg's case, the results also come only from simulations.
• The progress comes from algorithms. That is also the unsettling side. Every reduction in recent years came from better mathematics and better error correction. Such advances are hard to predict and can come suddenly.

Anyone who derives a precise date from this reads more into the papers than they support. The robust statement is a different one: the bar has fallen by more than an order of magnitude in seven years, without any change in the hardware assumptions.

Why uncertainty is no reason to wait

For planning, a simple consideration that goes back to Michele Mosca helps. Three time spans need to be compared:

• how long data must remain confidential,
• how long the migration to post-quantum cryptography takes,
• how long it will take until a cryptographically relevant quantum computer exists.

If the sum of the first two is greater than the third, the migration comes too late. Data intercepted and stored today can then be decrypted later (“store now, decrypt later”).

The EU roadmap for the post-quantum migration builds on exactly this. It classifies use cases as high risk if data must remain confidential for at least ten years, and estimates the duration of a complete migration at five to ten years. EU roadmap, PDF Even someone who does not expect Q-Day until 2040 arrives, with ten years of confidentiality and five years of migration, at a start in 2025 at the latest.

For signatures, the pressure is lower, because a signature only needs to hold until the quantum computer exists. On the other hand, migration times there are the longest: PKIs, firmware updates and long-lived devices cannot be rebuilt in a year. That is why the EU roadmap calls for software and firmware updates to be signed quantum-safe by default by 2030.

Conclusion

Research provides no date for Q-Day, but a clear direction. Experts consider a cryptographically relevant quantum computer within ten years quite possible, the BSI considers it likely by 2040, and the estimated hardware requirements fell sharply in 2025 and 2026. For companies, the exact year is not the decisive question anyway. What matters is whether their own data must remain confidential for longer than the migration allows. Which dates the authorities derive from this, and which of them are binding, is covered in Post-quantum cryptography: the 2026, 2030 and 2035 deadlines and which of them are binding.

Sources

• Quantum Threat Timeline Report 2025 (Michele Mosca, Marco Piani, Global Risk Institute, 9 March 2026)
• Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie (Joint guideline of the BMDS, BMI and BSI, 12 October 2026)
• How to factor 2048 bit RSA integers with less than a million noisy qubits (Craig Gidney, arXiv, 21 May 2025)
• How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits (Craig Gidney, Martin Ekerå, arXiv 2019, published in Quantum 2021)
• The Pinnacle Architecture: Reducing the cost of breaking RSA-2048 to 100 000 physical qubits using quantum LDPC codes (Iceberg Quantum, arXiv, February 2026)
• Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations (Babbush, Zalcman, Gidney et al., arXiv, 30 March 2026)
• Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly (Google Research, 31 March 2026)
• Meet Willow, our state-of-the-art quantum chip (Google, 9 December 2024)
• A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (EU PQC Workstream of the NIS Cooperation Group, June 2025)