Q-Day is the name given to the hypothetical moment when a quantum computer becomes capable of breaking the public-key encryption and signature schemes in wide use today, such as RSA and elliptic-curve cryptography. From that point, data protected by those schemes, and the digital signatures that authorise payments and blockchain transactions, could no longer be relied on unless systems had already moved to quantum-resistant methods.
No quantum computer able to do this existed as of November 2026, and there is no agreed date for when, or whether, one will. Estimates from researchers and agencies vary widely, and this entry does not predict one. The term is used mainly in security planning, where it frames the work of replacing vulnerable algorithms before such a machine appears. The underlying technology is described under quantum computing and the methods at risk under public-key cryptography.
Q-Day in plain terms
Imagine every bank vault, front door and safe deposit box in the world used locks of the same basic design. The design has been safe for decades because picking it would take a burglar thousands of years. Now suppose engineers are building a new kind of tool that, once finished, could open that design in hours. Q-Day is the day that tool is finished.
Nobody knows when that will be. The sensible response is to start fitting new locks well before the tool exists, because changing every lock in the world takes years, and because some thieves may already be stealing locked boxes in the hope of opening them later.
Why quantum computers threaten current cryptography
Public-key systems rely on maths problems that ordinary computers cannot solve in any practical time, such as finding the prime factors of a huge number or reversing an elliptic-curve calculation. In 1994 the mathematician Peter Shor showed that a sufficiently large quantum computer could solve both problems efficiently. A machine running Shor's algorithm at scale could therefore work out a private key from its matching public key.
Symmetric encryption and hash functions are less exposed. Grover's algorithm offers only a square-root speed-up against them, which can be offset by using longer keys and outputs. The real Q-Day concern is about public-key methods, which secure web connections, software updates, card systems and crypto wallets.
Running Shor's algorithm on real key sizes would require a large machine with many reliable, error-corrected qubits. Today's devices are far smaller and noisier, which is why the timing remains uncertain.
Harvest now, decrypt later
Q-Day matters before it arrives. An attacker can record encrypted traffic today and store it until a quantum computer can read it. This "harvest now, decrypt later" risk applies to information that must stay secret for many years, such as government records, health data and long-term financial contracts. It is a main reason why security agencies have urged organisations to begin migrating now rather than waiting for clear evidence of a working machine.
Post-quantum standards
The US National Institute of Standards and Technology ran a multi-year public competition to select quantum-resistant algorithms. In August 2024 it published its first three finalised post-quantum standards:
- FIPS 203 (ML-KEM). A key-encapsulation method, derived from the CRYSTALS-Kyber submission, for establishing shared secret keys.
- FIPS 204 (ML-DSA). A digital signature scheme derived from CRYSTALS-Dilithium.
- FIPS 205 (SLH-DSA). A hash-based signature scheme derived from SPHINCS+, intended as a backup built on different maths.
Browsers, messaging apps and cloud providers have begun deploying hybrid schemes that combine a classical and a post-quantum algorithm, so that a connection stays secure if either one holds. Banks, card networks and payment infrastructure providers face a longer task because their systems include hardware, such as cards and terminals, that is slow to replace.
What Q-Day would mean for crypto
Cryptocurrencies are a frequently cited example because ownership rests entirely on digital signatures. The main points are:
- Exposed public keys. Bitcoin addresses are usually hashes of public keys, and the key is revealed only when coins are spent. Coins held in early output types that show the public key directly, or in addresses that have been reused, would be most at risk. A significant number of early bitcoin, including coins associated with Satoshi Nakamoto, sit in such outputs.
- Transactions in flight. A fast enough machine might derive a key from a transaction broadcast to the network and race to spend the coins first.
- Account-based chains. On Ethereum, any account that has sent a transaction has revealed its public key.
- Mining and hashing. Proof of work is less directly threatened, since quantum gains against hashing are limited.
Developers of several blockchains have discussed or proposed upgrades to add quantum-resistant signature types, which would need broad agreement and, in most cases, a coordinated fork. How to treat coins whose owners never migrate, possibly because the keys are lost, is a contentious question with no settled answer as of November 2026.