PQC Deadline Calculator
The post-quantum dates changed in 2026. NIST IR 8547 is now final (27 October 2026): every quantum-vulnerable public-key algorithm is deprecated after 2030 and disallowed after 2035. Executive Order 14412 and OMB M-26-15 set earlier dates for US federal high value assets and high impact systems. Pick who you are and what your system does, and see the dates that apply, with the days left and the source for each.
Everything runs in your browser and nothing is sent to us. Many pages still quote the 2024 draft of IR 8547; this one uses the final.
1. Who are you?
2. What does the system do with cryptography?
3. Your deadlines
Pick who you are and what the system does to see the dates that apply.
4. Mosca check: are you already late?
Enter your own numbers in years. Nobody knows when a cryptographically relevant quantum computer will exist, so Z is your estimate, not a fact we supply.
Records retention, secrecy of trade data, health or personal data.
Inventory, testing, vendor upgrades and rollout, end to end.
Your organisation's planning assumption.
“Mosca's theorem emphasizes the urgency of migrating to post-quantum algorithms by introducing a simple but powerful timeline: if "X" represents the number of years that data must be kept secure, and "Y" is the estimated time needed to complete the transition, then organizations must start transitioning to post-quantum algorithms before X + Y exceeds the expected time Z for a cryptanalytically relevant quantum computer to be built.”
Source: NIST IR 8547 (final, October 2026), Sec. 3. Original idea: Mosca, IACR ePrint 2015/1075 (Nov 2015).
5. Take the dates with you
A calendar file with one all-day event per deadline shown above (with its source), and a Markdown summary with the days left and your Mosca check.
TL;DRWhat this calculator does
5 points
- Pick who you are and what the system does with cryptography. The page lists the post-quantum deadlines that apply, in date order, with the years and days left from today.
- NIST IR 8547 is final (27 Oct 2026): RSA, ECDSA, EdDSA, DH, ECDH and MQV are deprecated after 2030 and disallowed after 2035, at every strength.
- US federal high value assets and high impact systems have earlier dates under EO 14412 and OMB M-26-15: PQC key establishment by 31 Dec 2030 and signatures by 31 Dec 2031. Agencies must support TLS 1.3 by 2 Jan 2030.
- EU, UK and Canada dates come from their published roadmaps. Australian and NSA CNSA 2.0 dates are shown only as "reported, check source" because their primary pages could not be verified.
- A Mosca check compares how long your data must stay secret plus how long migration takes against your own estimate of when a cryptographically relevant quantum computer arrives.
Frequently asked questions
When do RSA and ECC stop being allowed?
Under NIST IR 8547 (final, October 2026), RSA, ECDSA, EdDSA, finite-field DH, ECDH and MQV are deprecated after 2030 and disallowed after 2035 under NIST standards and guidelines, at every key size. Deprecated means you may still use them but must accept the risk. Disallowed means they are no longer allowed for that purpose; only legacy use, such as verifying an old signature, remains.
What are the US federal PQC deadlines in 2026?
Executive Order 14412 (22 Jun 2026) and OMB M-26-15 (24 Jun 2026) require federal high value assets and high impact systems to use PQC for key establishment by 31 Dec 2030 and for digital signatures by 31 Dec 2031. Agencies must support TLS 1.3 by 2 Jan 2030, and the full migration runs to 2035. These dates do not apply to national security systems or to the private sector.
Do the federal deadlines apply to private companies?
Not directly. EO 14412 and M-26-15 bind federal agencies. The order also told the FAR Council to propose a rule requiring covered contractors to comply with NIST FIPS, including the PQC FIPS, by 31 Dec 2030; that rule had not been published as of 13 Nov 2026. The NIST IR 8547 dates still matter to everyone who buys or builds against NIST standards.
What is Mosca's inequality?
If X is how many years your data must stay secret, Y is how long your migration takes and Z is how many years until a cryptographically relevant quantum computer exists, you are at risk when X + Y is greater than Z. NIST IR 8547 restates it as: start transitioning before X + Y exceeds Z. Nobody knows Z, so the calculator uses your own estimate.
What are the EU and UK post-quantum deadlines?
The EU coordinated roadmap (June 2025) asks Member States to start by the end of 2026, finish high-risk use cases by the end of 2030 and medium-risk ones by the end of 2035. The UK NCSC sets three milestones: discovery and an initial plan by 2028, the highest-priority migrations by 2031, and full migration by 2035.
Does symmetric encryption need to change?
Mostly not. NIST IR 8547 says approved symmetric primitives with at least 128 bits of classical security meet post-quantum Category 1 or better, so AES-128 and above are fine. NIST symmetric standards at the 112-bit level will be disallowed in 2030, and SHA-1 will be disallowed in FIPS-validated modules after 2030.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.