Google Sets 2029 as Its Post-Quantum Deadline, Earlier Than NIST's Roadmap

In late March 2026, Google said it aims to finish migrating its systems to post-quantum cryptography by 2029. Cloudflare announced a similar target. Both dates are tighter than the 2030 deprecation point in NIST's roadmap, and both rest on a simple fear: encrypted data stolen today can be read later.

Why the date moved

Google pointed to progress in quantum hardware, error correction and, crucially, shrinking resource estimates for Shor's algorithm, the method that would break RSA and elliptic-curve cryptography. In 2019, researchers estimated that factoring a 2048-bit RSA key would need about 20 million physical qubits running for roughly eight hours. A May 2025 analysis by Craig Gidney cut that to fewer than one million qubits in under a week, around 20 times fewer. Two further studies in March 2026 claimed lower figures still, one suggesting under 100,000 physical qubits under assumptions not yet proven at scale. Some headline numbers mix logical and physical qubits, so they should be read with care.

Store now, decrypt later

Google's engineers describe harvest-now-decrypt-later collection as the main motive for acting early. An adversary does not need a working quantum computer today to benefit: it only needs to record traffic and wait. That makes key exchange the first priority, and there the web is already moving. Cloudflare reported in October 2025 that 53% of human web traffic used post-quantum key exchange. Signatures and certificates, where most enterprise work remains, lag behind.

NIST finalised its first three post-quantum standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). Its transition guidance, which vendor commentary attributes to NIST IR 8547, deprecates 112-bit-security algorithms such as RSA-2048 after 2030 and disallows them after 2035. The NSA has a 2033 target for national security systems.

Why it matters

NIST's own guidance notes that moving from standard to full deployment has historically taken 10 to 20 years. A 2029 finish line therefore means most organisations are already behind. Entrust's 2026 survey found only 38% of organisations actively transitioning. The hard part is inventory: finding every library, certificate, VPN and embedded device that uses RSA or elliptic curves.

Not everyone accepts Google's schedule. Several experts argue that qubit-count claims are not the same as a working machine, and the timeline of a cryptographically relevant quantum computer remains uncertain. Even so, migration is a prudent hedge because the cost of being early is small.

What migration actually involves

Post-quantum migration is mostly plumbing, and the plumbing is the problem. The work breaks into three layers. Key exchange, the handshake that sets up an encrypted session, is the most urgent because recorded traffic can be attacked later; hybrid schemes that combine a classical exchange with ML-KEM let operators deploy now without betting everything on a new algorithm. Digital signatures, used for certificates, code signing and firmware, are the second layer, and they are harder: post-quantum signatures are larger, which stresses protocols, certificate chains and constrained devices. The third layer is everything embedded in hardware or long-lived products, such as industrial controllers, smart cards and satellites, where cryptography cannot easily be updated.

Entrust's guidance recommends starting with a cryptographic inventory: find every place that uses public-key cryptography, rank by data lifetime and exposure, and set up crypto-agility so algorithms can be swapped without rewriting applications. Data with long secrecy requirements, such as health records, state secrets and trade secrets, is the highest priority because it is the target of harvest-now-decrypt-later collection.

Google's decision to name a date matters mostly as a forcing function for the supply chain. When a company of its size and Cloudflare publicly commit to 2029, vendors that sell into them, from hardware makers to certificate authorities, have a deadline to meet. Browser vendors and TLS libraries have already shipped hybrid key exchange, which explains the high share of web traffic now using it, but that figure says little about the back-end links between data centres, the VPNs and the internal services that make up most enterprise traffic.

Governments are moving on parallel tracks. The NSA's 2033 goal for national security systems and NIST's 2030 and 2035 milestones frame the public-sector schedule. The risk for ordinary organisations is that they treat these dates as someone else's problem; since a decade or more is a typical migration length, even a 2035 disallowance date is close for large estates.

What to watch

• Whether other cloud providers and browser makers adopt 2029-type targets.
• Progress on post-quantum certificates and signatures, the next hurdle after key exchange.
• Independent validation of the lower qubit estimates.

Sources

1. Google Says Q-Day Coming, Migration Deadline Now 2029 — PYMNTS
2. Google targets 2029 for post-quantum cyber readiness — Computer Weekly
3. Google, Cloudflare want post-quantum cryptography by 2029 — Information Age (ACS)
4. How to Migrate Your Platform for Post-Quantum Cryptography — Entrust