Quantum Threat Timeline Calculator
Estimate when a cryptographically relevant quantum computer could break your encryption — based on Shor's algorithm requirements and current hardware progress.
The asymmetric encryption protecting blockchain wallets, web traffic, and digital signatures today — ECC, RSA, and related schemes — relies on mathematical problems that are hard for classical computers but efficiently solvable by a large-scale quantum computer running Shor's algorithm. The question is no longer whether this will happen, but when.
This calculator applies the logical qubit requirements published by Webber et al. (2022) to three quantum hardware progress scenarios, producing an estimated critical threshold year — the point at which a quantum computer could feasibly execute the attack. Select your algorithm and scenario below to see the projection.
1 — Select cryptographic algorithm
2 — Select quantum progress scenario
Sustained investment and incremental error-correction improvements.
Timeline — ECC-256 / Moderate Scenario
All scenarios for ECC-256
Harvest Now, Decrypt Later
Adversaries are recording encrypted traffic and on-chain public keys today, intending to decrypt them once a cryptographically relevant quantum computer exists. Blockchain transactions from 2026 that expose a public key may be vulnerable in 2039 — regardless of when you upgrade.
Understanding the Quantum Threat to Cryptography
Why asymmetric encryption is uniquely vulnerable
Public-key cryptography — the technology securing blockchain wallets, HTTPS connections, and digital certificates — is built on mathematical trapdoor functions: operations easy to perform in one direction but practically impossible to reverse classically. Elliptic curve discrete logarithm problems (ECDLP) and integer factorization underpin ECC and RSA respectively. A quantum computer running Shor's algorithm can solve both in polynomial time, collapsing the security of every ECC and RSA key to near zero.
The gap between physical and logical qubits
Headlines about “1,000-qubit quantum computers” are misleading for cryptographic threat assessment. Those counts refer to physical qubits, which are noisy and error-prone. Running Shor's algorithm reliably requires fault-tolerant logical qubits — units constructed from many physical qubits with quantum error correction applied. At current surface code overhead, approximately 1,000 physical qubits are needed per logical qubit. Breaking ECC-256 requires around 2,330 logical qubits, implying roughly 2.3 million high-quality physical qubits. We are not there yet — but the gap is closing.
Why the threat is already active
The “harvest now, decrypt later” strategy means adversaries do not need to wait until quantum computers are ready to begin collecting data. Every blockchain transaction that exposes a public key is permanently recorded on a public ledger. Every TLS session log stored by a network adversary today is a candidate for future decryption. The sensitive data exposed in 2025 may be decrypted in 2039. This collapses the traditional “we'll upgrade when the threat is real” approach: the threat is already real for any data that must remain confidential beyond the quantum threshold.
What the model in this calculator assumes
The calculator uses an exponential doubling model applied to a 2024 baseline of 5 fault-tolerant logical qubits — a conservative estimate of the real-world error-corrected capability of state-of-the-art systems. Three doubling periods represent different investment and breakthrough scenarios. The logical qubit thresholds come directly from Webber et al. (2022), the most widely cited peer-reviewed paper on fault-tolerant quantum attack timelines. Important caveats: this model does not capture algorithmic improvements to Shor's algorithm, hardware scaling plateaus, or the possibility that entirely new quantum computing paradigms emerge. Use the outputs as planning anchors, not forecasts.
Frequently Asked Questions
QuanChain eliminates this threat permanently
TADEQS ensures no public key is ever exposed on-chain — making harvest-now-decrypt-later attacks structurally impossible, at every quantum security level.