Nobody knows exactly what year that quantum computers will break encryption, and anyone who names one is selling something. What exists instead is a range of serious estimates, a set of government deadlines, and one deadline that has already passed.
The threat
When quantum computers reach critical mass, three cryptographic systems will fall in sequence: ECC-256 (crypto), RSA-2048 (banking and web), RSA-4096 (government and military).
Breaking RSA or elliptic-curve encryption takes a large, error-corrected, gate-model quantum computer running Shor's algorithm. The timeline for this threat hinges on both what the threshold is for the number of error-corrected physical qubits required and when quantum computers will reach that threshold.
The estimates
Surveys of researchers, including the Global Risk Institute's annual quantum threat timeline, cluster meaningful probability in the 2030s, with tails on both sides.
As for the crypto industry, the Ethereum Foundation estimates that quantum computers could break ECDLP-256 by the early 2030s, with Google planning to internally migrate to post-quantum cryptography by 2029. Leaders at top tech companies, including Microsoft, Google, IBM, and Nvidia, have all recently moved forward their timelines, advancing their predictions to a 2-5 year time horizon.
The estimates for the number of qubits needed to break cryptography keep shrinking, and fast. In March 2026, Google Quantum AI put a ECDSA break at fewer than 500,000 physical qubits and about nine minutes of runtime, a roughly 20-fold drop from prior estimates. By September, IonQ's end-to-end blueprint had it at 19,397 trapped-ion qubits and 26 days per attempt for Bitcoin, a scale its own roadmap reaches around 2028.
The federal deadline
It’s not just what pundits predict will happen, but also government timelines that can provide insights into when cryptographic systems will fall.
The National Institute of Standards and Technology (NIST) already finalized post-quantum standards in 2024, including hash-based signatures. The NSA's CNSA 2.0 guidance requires national security systems to migrate, with full compliance, by 2031.
Migrations of that size are only scheduled when planners believe the threat window is imminent and real. That timeline tracks closely with predictions from the industry and researchers of quantum threat in the early 2030s.
The deadline that already passed
For sensitive, financially important systems, quantum doom day is not the only date that matters.
Store now, decrypt later means data recorded today, intercepted traffic, or public blockchains where every signing address has published its key, becomes crackable retroactively the day the machine works.
If a secret needs to remain a secret ten years from now, its protection deadline was the day it was first exposed. For crypto holders that is concrete: millions of addresses have already exposed their public keys on chain, permanently.
Quantum doomsday clock
It is clear that the threat is real, the timeline is approaching, and preparation needs to start now.
To help the world prepare before it’s too late, we are now closely tracking the quantum threat at quantumdoomclock.com.
We analyze data from every major quantum computer manufacturer including IBM, Google, IonQ, Rigetti, and more to project when quantum computers will have enough qubits to break current cryptography.
Our goal isn't to spread fear, it's to provide accurate, up-to-date information that helps individuals, organizations, and policymakers make informed decisions about cryptographic security.
