Nobody can give a reliable date. CISA says the machines that can break modern public-key encryption do not yet exist. The dates you see, such as 2030 and 2035, are policy and transition targets, not forecasts. The sound approach is to plan by how long your data must stay secret.
What official sources say
CISA states that once quantum computers are powerful enough they will be able to break many widely used encryption and signature algorithms, and that quantum decryption capable of breaking modern public-key encryption does not yet exist. It tells agencies and critical infrastructure operators to start preparing now.
NIST's FAQ on post-quantum cryptography does not address when quantum computers will arrive.
What dates mean
The 2035 date comes from National Security Memorandum 10, quoted in NIST IR 8547: the goal of mitigating as much quantum risk as is feasible by 2035. It is a deadline for a program of work. It says nothing about when a machine will exist. NIST's draft also says timelines vary and some systems need earlier transitions.
What researchers' estimates show
Resource estimates for attacks have fallen. Craig Gidney's May 2025 paper estimates RSA-2048 could be factored with fewer than a million noisy qubits in under a week, compared with a 2019 estimate of about 20 million qubits. That tells you the target moved closer on paper. It does not tell you when hardware will meet the assumptions.
How to plan without a date
Use an inequality instead of a prediction. Three numbers matter:
- How long your data must stay secret.
- How long your migration will take.
- How long until a capable machine exists, which is unknown.
If the first two add up to more than you are comfortable guessing about the third, start now. For most short-lived data the sum is small. For records that last decades, it is not.
Signals worth watching
- NIST final reports and updated schedules.
- Updated resource estimates from credible research.
- Deployment data from large operators, such as share of traffic using post-quantum key agreement.
- Guidance from your own sector regulator.
Signals worth ignoring
- Vendor countdown clocks.
- Headlines that count qubits without error rates.
- Claims of broken RSA without a peer-reviewed or reproducible basis.
What to tell your board
We cannot predict the date. We can control our exposure. Here is our inventory, our ranking by data lifetime, and our plan.
Keep the conversation concrete. Ask each team which of their systems carry data that must stay secret past a decade, and what it would take to change the key exchange on those. That question gets real answers, while a debate about dates does not.
Quick check
Is 2035 the year quantum computers will break RSA?
No. It is the federal goal for finishing migration, not a hardware prediction.
Should we wait for more certainty before acting?
For long-lived data, waiting costs more than starting, because migration takes years and data can be recorded today.
Sources
Last reviewed: 19 October 2026.
