No official source we checked gives a date for when quantum computers will break today's public-key encryption. NIST says only that some experts predict a capable device could appear within a decade. A 2027 deadline is a claim, not a finding. Preparing now is still sensible, because migration is slow.
Myth: authorities have set a date for Q-Day
Fact: NIST's announcement of its first post-quantum standards says it does not give a specific date. It notes that some experts predict a device able to break current encryption could appear "within a decade". CISA's quantum page says such capability does not yet exist and that government and critical infrastructure organizations must begin preparing now.
Those two statements fit together. Nobody can say when, and the work takes years, so you start before you know.
Myth: all encryption breaks at once
Fact: the risk applies mainly to public-key algorithms used for key exchange and digital signatures, such as RSA and elliptic curve schemes. NIST's three finalized standards are ML-KEM for key establishment, and ML-DSA and SLH-DSA for signatures, released in August 2024. NIST says these "can and should be put into use now".
Myth: there is nothing to do until the standards settle
Fact: NIST encouraged administrators to start integrating them right away, and said there is no need to wait for further standards. The project page, last updated August 2026, also describes additional work, such as HQC as a backup key-encapsulation method and further signature schemes. Those are backups and extras, not reasons to pause.
Why the date still matters to you
The date matters because of data lifetime. If information must stay secret for many years, an attacker could record encrypted traffic today and decrypt it later. See Harvest now, decrypt later: who should worry.
What to do in a quiet week
- Make a list of where you use public-key cryptography: TLS, VPNs, code signing, certificates, SSH, tokens.
- Note how long the data behind each one must stay confidential.
- Ask each vendor for their migration plan.
- Fix the cheap thing first: make algorithms configurable rather than hard-coded.
Start with the inventory in Start a cryptographic inventory this week.
How to answer a stakeholder who asks
A simple script works. The date is unknown and no official source gives one. The work to move is long, so it starts now. And the first step is cheap: list where we use public-key cryptography and how long the data behind it must stay secret. That answer turns an abstract fear into a ranked task list and gives you something to show at the next review.
It is also fair to say what you will not do: you will not stop shipping while waiting for a date, and you will not rewrite everything in a hurry. You will make algorithms replaceable, adopt the finalized standards where your libraries and vendors support them, and track NIST for updates.
Quick check
Has NIST predicted 2027 for quantum attacks?
No. NIST gives no specific date and notes only that some experts predict a device could appear within a decade.
Should I wait for quantum computers to exist before migrating?
NIST says to start integrating the finalized standards now, because full rollout takes a long time.
Sources
- NIST: first 3 finalized post-quantum encryption standards
- CISA: quantum and post-quantum cryptography
- NIST: Post-Quantum Cryptography project
Last reviewed: 19 October 2026.
