The Post-Quantum Apocalypse: Why Your Encryption Will Break by 2030

[StoneCold]

Almost every piece of sensitive information moving across the internet today, banking transactions, medical records, government communications, corporate trade secrets, private messages, is protected by a small handful of mathematical problems that are extraordinarily hard for a classical computer to solve. RSA encryption relies on the difficulty of factoring enormous numbers into their prime components. Elliptic curve cryptography, which underpins most of the TLS connections securing web traffic today, relies on a related but distinct hard problem involving points on an elliptic curve. Both have held up for decades against every classical attack thrown at them. Neither is expected to survive a sufficiently powerful quantum computer. This essay explains what that threat actually looks like, why the danger is not a distant future problem but an active one unfolding right now, and why the migration timelines governments and major technology companies have quietly committed to all converge on roughly the same uncomfortable window: before 2030.

The mathematics of the threat: Shor's algorithm

The specific danger has a name and a three decade old pedigree. In 1994, mathematician Peter Shor published an algorithm showing that a sufficiently large and stable quantum computer could factor large numbers, and separately solve the discrete logarithm problem underlying elliptic curve cryptography, exponentially faster than any known classical algorithm. For most of the following thirty years this remained a fascinating theoretical result with little practical bite, because building a quantum computer with enough stable, error corrected qubits to actually run Shor's algorithm against real world key sizes was, and largely still is, far beyond current hardware. That gap is what has let RSA and elliptic curve cryptography remain safe in practice for decades even after their theoretical vulnerability was proven.

The gap has been closing, and closing faster than most outside the field appreciate. Resource estimates for exactly how many qubits it would take to break RSA-2048, the encryption standard underlying a huge share of current internet security, have fallen dramatically. Early estimates from 2019 put the requirement at roughly 20 million physical qubits. By 2025, refined estimates incorporating better error correction techniques and more efficient circuit designs had pushed that figure below one million noisy qubits, a genuinely enormous reduction in less than six years. No quantum computer with anywhere near that qubit count exists as of 2026, current leading systems from IBM, Google and others operate in the range of hundreds to low thousands of physical qubits, but the trajectory of that resource estimate, consistently falling as researchers find cleverer ways to run the same algorithm, is precisely the pattern that has convinced cryptographers, national security agencies and major technology companies that treating this as a distant, speculative concern is a mistake.

Harvest now, decrypt later: why the threat is already active

Here is the part of this story that transforms an abstract future risk into a present, active one. An adversary does not need a working quantum computer today to benefit enormously from quantum computing's eventual arrival. They only need to intercept and store encrypted data now, and wait. This strategy has a name, harvest now, decrypt later, and it fundamentally changes the calculus of when organizations need to act. Security researchers describe this as a temporal asymmetry unlike almost any other threat model in cybersecurity, where vulnerability and the capability to exploit it normally arrive together. With harvest now, decrypt later, the vulnerability exists the moment data is encrypted with a quantum breakable algorithm, while the capability to exploit it may not arrive for years or decades, but once it does, everything harvested in the meantime becomes instantly and retroactively exposed. Nation state intelligence agencies, and increasingly well resourced criminal organizations, are widely assumed to already be running exactly this kind of collection operation against high value encrypted traffic, banking communications, government cables, defense contractor correspondence, precisely because the attack requires no current cryptanalytic breakthrough at all, only the ability to intercept traffic and enough storage capacity to hold onto it.

The reason this matters so urgently right now comes down to a deceptively simple piece of arithmetic known as Mosca's theorem, formulated by Canadian cryptographer Dr Michele Mosca, co-founder of the Institute for Quantum Computing at the University of Waterloo. Mosca's genius was to sidestep the genuinely unanswerable question, exactly when will a cryptographically relevant quantum computer arrive, and reframe the problem around a question that actually can be answered with the information an organization already has. The theorem states that if X, the time it takes your data to remain confidential, meaning its required shelf life, plus Y, the time it takes your organization to actually complete a migration to quantum resistant cryptography, together exceed Z, the number of years until a cryptographically relevant quantum computer arrives, then you are already too late, your data will be exposed regardless of what you do from this point forward. Because migration for a large or complex organization can easily take five to ten years once you account for inventorying every system using vulnerable cryptography, testing replacements, and rolling changes out across legacy infrastructure that was never designed to be easily updated, and because plenty of data genuinely needs to stay confidential for a decade or two, medical records, national security material, escrow and property records, long term financial agreements, the arithmetic works out badly even under fairly conservative estimates of when quantum computers actually arrive. A title company whose escrow and closing records carry a twenty year confidentiality obligation, facing a realistic multi year migration timeline, is already inside the danger window today, even assuming the most cautious current quantum hardware projections turn out to be correct.

What the experts actually predict, and how confident they are

Nobody in this field claims to know the exact date a cryptographically relevant quantum computer will exist, and it is worth being honest about that uncertainty rather than pretending the threat has a fixed, knowable deadline. The most cited ongoing effort to actually poll expert opinion systematically is the Quantum Threat Timeline Report, published annually by the Global Risk Institute in Toronto and co-authored by Mosca himself since 2019. Its seventh edition, published in March 2026 and based on the aggregated opinions of 26 leading experts in the field, concluded that a full scale, cryptographically relevant quantum computer was quite possible within the next ten years, and likely within the next fifteen. Separate academic surveys have converged on a similar range, placing roughly fifty percent probability on a cryptographically relevant quantum computer capable of breaking RSA-2048 existing within fifteen years, with most expert timelines clustering somewhere in the 2030 to 2040 window. The uncertainty in these estimates is real and should be taken seriously, this is genuinely difficult hardware engineering and past predictions in quantum computing have both undershot and overshot actual progress at different points. But the range of expert opinion has been narrowing and, if anything, shifting earlier rather than later as error correction techniques and resource estimates have both improved faster than expected.

The regulatory and standards response: a coordinated global migration

The response from governments and standards bodies has moved from cautious monitoring to active mandate over the past two years, and the timeline it has settled on is genuinely instructive. The US National Institute of Standards and Technology finalized its first three post quantum cryptography standards in August 2024, FIPS 203, known as ML-KEM, for key exchange, FIPS 204, known as ML-DSA, for digital signatures, and FIPS 205, known as SLH-DSA, as a hash based backup algorithm built on fundamentally different mathematics as insurance against any future weakness discovered in the other two. A fourth standard, FIPS 206, is expected to follow in 2026. NIST's own transition guidance, published as NIST IR 8547, sets a formal deprecation date of 2030 for RSA-2048 and equivalent elliptic curve algorithms for federal systems, with a hard disallowment following in 2035. The National Security Agency's CNSA 2.0 advisory goes further for national security systems specifically, requiring new procurements to support quantum resistant cryptography starting in January 2027. The European Union and the UK's National Cyber Security Centre have published broadly parallel timelines, targeting high risk critical infrastructure migration by around 2030 and a fuller transition by 2035.

What makes this genuinely striking is how far ahead of these regulatory floors the technology companies with the deepest visibility into actual quantum hardware progress have chosen to move voluntarily. Google announced a 2029 internal deadline for completing its own full post quantum migration, a detail that carries particular weight given that Google's own research division is among the groups producing the falling resource estimates that define how close the threat actually is, they are, in a real sense, grading their own homework and choosing to move faster than any regulator currently requires. Cloudflare matched that same 2029 target within weeks of Google's announcement and reported that more than 65 percent of human generated traffic on its network was already protected with post quantum encryption as of April 2026. Microsoft has set an early adoption target of 2029 with a full transition across all products completed by 2033. Apple deployed post quantum cryptography into iMessage through its PQ3 protocol as early as 2024, well ahead of any of these broader industry timelines. The consistent pattern across every organization with genuine technical visibility into how quantum hardware is actually progressing is the same, they are treating 2029 to 2030 as the point by which migration needs to be substantially complete, not merely started.

The scale of 2026's institutional response reflects just how seriously this is now being taken. The year has been informally designated the Year of Quantum Security, a coordinated industry and government initiative backed by the FBI, NIST and the US Cybersecurity and Infrastructure Security Agency, specifically aimed at accelerating both public awareness and organizational migration readiness before the window described by Mosca's theorem closes further.

The practical gaps still standing in the way

None of this means the transition is simple or that the infrastructure to support it is fully ready, and being honest about the remaining gaps matters as much as being honest about the urgency. As of early 2026, no hardware security module vendor had yet completed a FIPS 140-3 Level 3 validation that specifically includes the new post quantum algorithms, meaning the certified hardware needed to deploy this cryptography at the highest assurance levels required by many regulated industries simply did not yet exist in fully validated form. The new algorithms themselves also come with real practical tradeoffs, lattice based schemes like ML-KEM and ML-DSA generally require meaningfully larger key sizes than the RSA and elliptic curve algorithms they replace, which has real implications for bandwidth, storage and performance in systems that were never designed with those larger keys in mind. Blockchain systems face a genuinely harder version of this problem than most centralized organizations, since there is no single authority that can simply mandate a coordinated migration, Bitcoin specifically has multiple competing proposals for how to handle the transition with no consensus reached on any of them, and any coin whose public key has already been exposed on chain, which describes a meaningful share of the oldest Bitcoin addresses including ones widely believed to belong to Bitcoin's own creator, sits in a permanently harvest now decrypt later exposed position that a future migration cannot retroactively fix.

Why this cannot wait for certainty

The uncomfortable conclusion sitting underneath all of this technical detail is genuinely simple, even though the exact arrival date of a cryptographically relevant quantum computer remains uncertain, waiting for that uncertainty to resolve before acting is itself the mistake Mosca's theorem was specifically designed to expose. The threat is not really about some dramatic future morning when quantum computers suddenly switch on and break the internet overnight, that framing, however dramatic, obscures the actual mechanism of harm. The real threat is happening continuously, right now, every day that sensitive long lived data gets encrypted with algorithms known to be quantum vulnerable and transmitted across networks that patient, well resourced adversaries are already positioned to intercept and simply wait out. By the time a cryptographically relevant quantum computer genuinely exists, for any organization holding data that needs to stay confidential for years into the future, it will already be too late for that specific data, the theft will have already happened, quietly, years earlier, with the actual decryption merely a formality deferred to a later date. That is precisely why every organization with a genuine technical stake in getting this timeline right, from national security agencies to the cloud providers building the infrastructure the rest of the internet depends on, has independently converged on the same conclusion, treating 2029 or 2030 not as a distant hypothetical but as the practical deadline by which the migration needs to be substantially finished, because the actual danger of harvest now, decrypt later began the moment quantum computing became merely plausible rather than certain, and that moment has already passed.

[WWFRoss95]

Really solid rundown of Mosca's theorem, that's the part most casual coverage of this topic skips entirely in favour of vague "quantum computers will break encryption someday" hand-waving, and the x+y>z framing is genuinely the clearest way I've seen it explained. Where I think the essay slightly overstates its case is the framing that every major company has "independently converged" on 2029 to 2030, because that convergence isn't really independent, Google, Cloudflare and Microsoft are all drawing on the same small pool of resource estimates and the same handful of quantum hardware roadmaps, so seeing them land on similar deadlines is less a triangulated consensus and more several organizations reading the same tea leaves. I'd also push back gently on how the piece handles expert uncertainty, the Global Risk Institute survey is genuinely valuable, but it's still 26 people's opinions rather than anything close to a hard scientific prediction, and quantum computing specifically has a rough track record of both wildly missed and wildly beaten timelines depending on the specific technical hurdle in question. None of that changes the core argument though, the Mosca's theorem logic holds regardless of exactly when Q-Day actually lands, if your data needs to stay secret for 15 years and your migration takes 7, the math doesn't care whether the quantum computer shows up in 2032 or 2038, you still needed to start years ago. That's genuinely the strongest part of the essay and I think it deserved even more emphasis relative to the specific date predictions, which are always going to be the shakiest part of any piece like this.

[Griffin39]

Strong piece, and I want to build on what the previous reply said about the date predictions being the weakest link, because I think there's an even bigger structural problem buried in how "migration" gets talked about here that's worth naming directly. The essay treats migration completion as basically a binary switch, an organization either has or hasn't finished moving to post-quantum algorithms, but real infrastructure doesn't work that way, there's a massive difference between updating your own outward facing TLS endpoints, which is genuinely achievable on a multi-year timeline, and actually replacing cryptography baked into decades-old legacy systems, embedded devices, or third-party vendor software you don't control and can't easily patch.

A lot of the 2029 deadlines being cited are corporate PR commitments for the parts of the stack those companies actually control end to end, which is genuinely impressive but is not the same claim as "our entire ecosystem including every downstream dependency will be quantum safe by then." The HSM certification gap the essay mentions almost in passing is honestly a bigger deal than it gets credit for, if the actual hardware needed to run this cryptography at the assurance levels regulated industries require isn't even fully validated yet, that's a genuine bottleneck independent of any company's stated ambition or internal deadline. I think the essay's core argument about urgency is completely correct, but I'd want any organization reading this to walk away thinking about migration as a long tail of partial, uneven progress across different systems rather than a single date they either hit or miss