A cryptographically relevant quantum computer — one that can break RSA and elliptic-curve cryptography — does not exist yet and may be a decade or more away. The migration to post-quantum cryptography is happening anyway, on a simple logic: data encrypted today and recorded by an adversary can be decrypted the day such a machine exists, so anything that must stay secret for ten years is already exposed.
That logic has carried PQC from research to standards to production traffic faster than almost any cryptographic transition in history.
Why it matters
Public-key cryptography is load-bearing everywhere: TLS, VPNs, code signing, messaging, banking, government systems. Replacing it is not a patch but a rebuild of assumptions baked into protocols, hardware and compliance regimes over forty years. The organizations that start the inventory late will discover — as they did with Y2K and the SHA-1 deprecation — that cryptography hides in places nobody documented.
How it works
NIST's August 2024 standards cover the two jobs public-key crypto does: ML-KEM (from CRYSTALS-Kyber) for key establishment, and ML-DSA (Dilithium) plus SLH-DSA (SPHINCS+) for digital signatures, all based on mathematical problems believed hard even for quantum computers. Deployment uses hybrid mode — classical and post-quantum algorithms run together — so security is no worse than today even if a flaw appears in the new schemes.
The internet-scale rollout is already visible: Chrome, Cloudflare and Google's infrastructure have negotiated hybrid key exchange for a large fraction of real TLS connections since 2024, quietly proving the performance cost is tolerable. What remains is everything that isn't a browser talking to a major CDN: enterprise applications, embedded devices, code-signing chains, hardware security modules, and the long tail of protocols that assume RSA-sized keys.
Evidence
NIST's FIPS 203, 204 and 205 are published and final. CISA, NSA and international partners have issued migration guidance with explicit timelines — NSA's CNSA 2.0 requires national security systems to prefer PQC by the late 2020s. Cloudflare's radar data shows the share of TLS connections using post-quantum key exchange climbing steadily, and the major cloud providers offer PQC-enabled TLS in their load balancers and key-management services.
The competing read
Security agencies argue urgency: harvest-now-decrypt-later means the attack surface exists today, and migrations take a decade, so starting now is already late. Some cryptographers counsel measured pace: the new algorithms are young, implementation bugs are being found, and a rushed migration to immature libraries creates its own risks. The synthesis the industry has landed on is hybrid deployment and crypto-agility — build systems that can swap algorithms, deploy hybrids where libraries are mature, and inventory everything before promising dates.
What happens next
The unglamorous middle: cryptographic inventories, vendor questionnaires, hardware refresh cycles for devices that can't be upgraded in software, and compliance frameworks adding PQC deadlines. The organizations that treat this as an asset-management problem rather than a research problem will finish first.