When will quantum computers threaten your cryptographic systems?
Scenario analysis grounded in published hardware benchmarks and resource estimates. Not a prediction. A decision-support tool.
Every CISO planning a PQC migration needs to estimate Z in the X+Y vs Z timing test: when will a cryptographically relevant quantum computer arrive? This tool puts the published data in one place so you can see what the researchers and hardware vendors actually report.
Based on published data as of April 2026 Complementary to GRI expert surveys No account required
Select your cryptographic systems
Which algorithms does your organization use? Select all that apply. Three common defaults are pre-selected.
Vulnerable to Shor's algorithm (asymmetric cryptography)
RSA-2048
Most TLS certificates, email encryption, VPNs, code signing
RSA-3072
Higher-security TLS, government systems, long-lived certificates
RSA-4096
PGP keys, root CAs, long-term document signing
ECDSA P-256
TLS 1.3, Apple/Google certificates, FIDO2/WebAuthn, IoT
ECDSA P-384
Government high-assurance, CNSA Suite, some financial systems
ECDSA secp256k1
Bitcoin, Ethereum, most blockchain networks
Ed25519
SSH keys, Signal protocol, WireGuard, modern TLS
Affected by Grover's algorithm (symmetric cryptography)
AES-128
Reduced to 64-bit equivalent. Low practical risk at scale. Many legacy systems.
AES-256
128-bit equivalent post-Grover. Quantum-safe. Standard recommendation.
SHA-256
Grover gives quadratic speedup on preimage. Minimal practical impact.