Somewhere on the internet right now, an adversary may be copying encrypted traffic it cannot yet read — not to break it today, but to break it later. The gamble is called "harvest now, decrypt later," and it only pays off if a sufficiently powerful quantum computer eventually arrives to unlock the archive. That single bet is why a quiet but enormous project is underway across the internet's plumbing in 2026: replacing the math that protects almost every secure connection you make.
The pieces fell into place fast. In August 2024, the U.S. National Institute of Standards and Technology (NIST) published the first finalized post-quantum encryption standards after an eight-year contest [source: NIST, 2024]. The U.S. National Security Agency (NSA) has set hard deadlines for national security systems to switch by 2035 [source: NSA, 2022]. And your web browser has quietly started using the new cryptography already — by late October 2025, Cloudflare reported that most human-initiated traffic reaching its network was post-quantum protected [source: Cloudflare, 2025]. What follows separates what is genuinely settled from what is still an estimate, a claim, or an open question.
What the quantum threat actually is — and isn't
Start with a clarification, because the headline version of this story is usually overstated. A large quantum computer would not "break all encryption." It threatens a specific and crucial category: public-key cryptography — the algorithms like RSA and elliptic-curve cryptography (ECC) that let two strangers agree on a secret over an open line and that underpin digital signatures. These rely on math problems (factoring large numbers, computing discrete logarithms) that are hard for ordinary computers but that Peter Shor showed in 1994 a quantum computer could solve efficiently.
Symmetric encryption — the AES algorithm that actually scrambles the bulk of your data once a key is agreed — is a different case. The best known quantum attack (Grover's algorithm) merely weakens it, and doubling the key length restores the margin, which is why the NSA's post-quantum suite still relies on AES-256 rather than replacing it [source: NSA, 2022]. So the accurate framing is narrower than "the end of encryption": it is the key exchange and the signatures that are exposed.
That distinction is what makes "harvest now, decrypt later" (HNDL) the real motivation for acting now. An attacker who records today's encrypted session cannot read it — but the session key was set up with vulnerable public-key math. If a capable quantum computer arrives in, say, 2035, everything captured and stored between now and then becomes readable retroactively. Data with a long shelf life — health records, state secrets, biometric templates, intellectual property — is therefore already at risk today, even though the machine that would decrypt it does not yet exist [source: CISA, 2023].
The standards are finally here
For years the honest answer to "what should we migrate to?" was "wait for NIST." That wait ended. On August 13, 2024, NIST released three finalized standards: FIPS 203, known as ML-KEM, for key establishment; FIPS 204, ML-DSA, as the primary digital-signature standard; and FIPS 205, SLH-DSA, a hash-based signature scheme held in reserve [source: NIST, 2024]. The first two descend from the CRYSTALS-Kyber and CRYSTALS-Dilithium designs that won NIST's competition; the third is built on SPHINCS+. NIST described the process as an eight-year evaluation of 82 submissions from 25 countries, and its under secretary called the standards "the capstone of NIST's efforts to safeguard our confidential electronic information" [source: NIST, 2024].
Two of the three standardized families — ML-KEM and ML-DSA — rest on the mathematics of structured lattices. That shared foundation is efficient, but it is also a concentration of risk: if a deep flaw were ever found in lattice problems, both would be exposed at once. NIST's answer was to diversify. In March 2025 it selected a fifth algorithm, HQC, to be standardized as a backup key-establishment method built on error-correcting codes rather than lattices — deliberately different math, so that a break in one family would not take down the other [source: NIST, 2025]. A draft standard for HQC is expected around 2026 and a final one around 2027 [source: NIST, 2025]. A fourth signature standard, FN-DSA (based on FALCON), remains in draft as of mid-2026 [source: NIST, 2024].
How soon could a quantum computer break RSA?
This is the question everyone wants answered, and the honest answer is: nobody knows, and the estimates keep moving. Here the difference between an estimate and a demonstration matters enormously.
The estimates have been shrinking. In 2019, Google researchers Craig Gidney and Martin Ekerå calculated that factoring a 2048-bit RSA key would take roughly 20 million noisy qubits running for about eight hours [source: Gidney & Ekerå, 2019]. In May 2025, Gidney published a new analysis arguing the same task could be done with fewer than one million noisy qubits in under a week — about a twentyfold reduction in the qubit count, achieved largely by trading time for space and improving error correction [source: Gidney, 2025].
But read that carefully. It is a resource estimate for a fault-tolerant machine that does not yet exist, not a report of anyone factoring RSA-2048. Today's most advanced quantum processors operate at the scale of hundreds to low thousands of physical qubits with error rates far too high to run Shor's algorithm at cryptographic scale. The falling estimates tell you the theoretical bar is lower than once thought — a reason to take the threat seriously — not that "Q-Day" is imminent. Anyone who gives you a confident date is guessing; the responsible institutions plan for the possibility rather than a specific year.
The migration is already underway
While the timeline for the threat stays fuzzy, the response has become concrete — and, notably, it is being deployed ahead of the final internet standards rather than after them. The dominant strategy is hybrid: run a classical key exchange and a post-quantum one side by side, then combine both secrets, so an attacker must break both to win. That hedges against a flaw in the young post-quantum math while still defending against the quantum threat.
Secure messengers moved first. Signal shipped PQXDH in September 2023, layering CRYSTALS-Kyber on top of its existing X25519 key agreement so that, in its words, "any attacker must break both X25519 and CRYSTALS-Kyber to compute the same shared secret" [source: Signal, 2023]. Apple followed in February 2024 with PQ3 for iMessage, which uses ML-KEM not only for the initial handshake but throughout an ongoing conversation; Apple classifies PQ3 as "Level 3" and Signal's initial-key-only approach as "Level 2," and both were designed explicitly against harvest-now-decrypt-later [source: Apple, 2024]. These are company claims about their own protocols — though PQ3's design has also drawn independent academic security analyses, a layer of verification beyond the vendor's word.
The web followed. The hybrid key exchange named X25519MLKEM768 — combining X25519 with ML-KEM — is now switched on by default in mainstream browsers: Chrome desktop enabled it in March 2024, Chrome on Android and Firefox in November 2024, and Apple's platforms in October 2025 [source: Cloudflare, 2025]. On the network side, Cloudflare reported that as of the last week of October 2025 the majority of human-initiated traffic reaching it used post-quantum encryption, while about 39% of public websites supported post-quantum key agreement as of September 2025 [source: Cloudflare, 2025]. Those figures are Cloudflare's own measurements over its own traffic, not an independent census — but the direction is unambiguous. Tellingly, this rollout is running ahead of formal standardization: the IETF specification for these hybrid groups, draft-ietf-tls-ecdhe-mlkem, was still an internet-draft, not a finished RFC, in mid-2026 [source: IETF, 2026].
Deadlines with teeth
For most of the internet, adopting post-quantum cryptography is a choice. For parts of the U.S. government it is a schedule. The NSA's Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) names exactly two workhorses — ML-KEM-1024 for key establishment and ML-DSA-87 for signatures — and lays out a staged transition for national security systems, with new equipment expected to support the algorithms from 2027 and full adoption required by 2035 [source: NSA, 2022]. NIST's parallel guidance for the broader federal government, draft report IR 8547, is blunter about the old algorithms: cryptography at roughly the 112-bit security level, which includes RSA-2048 and the widely used ECC curve P-256, would be deprecated after 2030 and disallowed after 2035 [source: NIST, 2024].
The logic behind these dates is not that anyone expects a code-breaking quantum computer by 2030. It is HNDL plus inertia. Because migrating a large organization's cryptography takes years, and because data harvested now could be decrypted later, the guidance from CISA, NSA, and NIST has been consistent since 2023: inventory where you use vulnerable cryptography and build a transition plan now, rather than waiting for a machine to appear [source: CISA, 2023]. The deadline is a forcing function for a slow migration, not a prediction of the threat's arrival.
Why it is harder than a software update
If the algorithms are standardized and the browsers already ship them, why call it a "great migration" rather than a patch? Because cryptography is embedded in far more than browsers, and much of it is hard to reach and slow to change.
The post-quantum algorithms are also bulkier. ML-KEM keys and ML-DSA signatures are substantially larger than their RSA and ECC counterparts, which strains protocols, certificates, and constrained devices — the smart cards, industrial controllers, and embedded chips that may run untouched for a decade or more. Public-key infrastructure runs deep: the roots of trust baked into devices, code-signing systems, and long-lived digital certificates all have to move, often on hardware that was never designed to be updated. The concept the field keeps returning to is crypto-agility — building systems that can swap algorithms without being rebuilt — precisely because this will not be the last transition.
There is also a genuine counter-current worth stating plainly. The new lattice-based standards are younger and less battle-tested than RSA, which has absorbed four decades of attack. That is not a reason to delay — the harvest-now risk is real and the standards have survived years of public analysis — but it is why NIST is standardizing a mathematically independent backup in HQC, and why the hybrid approach that pairs new algorithms with classical ones is the prudent default rather than a full replacement [source: NIST, 2025]. Confidence in the new math should grow as scrutiny accumulates; it should not be assumed.
What to watch
Three things will tell you how this decade unfolds. The first is the hardware: not press releases about qubit counts, but credible progress toward the fault-tolerant scale that estimates like Gidney's assume — the gap between an estimate and a working machine is still the whole story [source: Gidney, 2025]. The second is whether the deadlines hold: whether CNSA 2.0's 2027 and 2035 gates and NIST's 2030/2035 cutoffs survive contact with the messy reality of legacy systems, or slip [source: NSA, 2022]. The third is the standards themselves — the finalization of HQC and FN-DSA, and whether lattice cryptography continues to withstand scrutiny or springs a surprise [source: NIST, 2025].
The measured read is neither panic nor complacency. No quantum computer can break RSA today, and none may for many years. But the standards are done, the deadlines are set, the largest gatekeepers have already switched on hybrid cryptography, and the harvest-now clock is running whether or not Q-Day ever arrives on schedule. The migration is not a prediction that the sky is falling. It is insurance being bought, at scale, against a risk no one can yet price — and the honest way to follow it is to watch what actually ships and what actually holds, not what gets announced.