Post-Quantum Migration Tracker
Who is ready for quantum computers?
A sourced overview of how blockchains, browsers, messengers, wallets and governments are moving from RSA and elliptic-curve cryptography to post-quantum algorithms. Every line links to the primary announcement or standard.
Status across all 28 projects
- On by default 12
- Available, opt-in 3
- In progress 10
- Planned 3
In March 2026, Google Quantum AI estimated that breaking the 256-bit elliptic curves used by Bitcoin and Ethereum could need fewer than half a million physical qubits, about 20 times fewer than earlier estimates. No such machine exists yet.
- Securing elliptic curve cryptocurrencies against quantum vulnerabilities Google Quantum AI, Mar 2026
Deadlines that drive the migration
- Aug 2024NIST publishes FIPS 203, 204, 205
- Today21 Oct 2026
- Dec 2026EU and Germany: crypto inventories and first steps
- 2028UK: discovery and migration plan done
- Dec 2029Ethereum L1 quantum-resistant (target)
- 2030NIST: RSA and ECC deprecated · EU: high-risk systems migrated · CNSA 2.0: signing and networking
- 2031UK: highest-priority migrations done
- 2033CNSA 2.0: browsers, servers, cloud and operating systems
- 2035NIST: RSA and ECC disallowed · UK, EU and US national security systems migrated
Standards & government deadlines
The algorithms everyone is migrating to, and the dates regulators have set for leaving RSA and elliptic curves behind.
| Project | Status | Where it stands | Last change | Sources |
|---|---|---|---|---|
| #NIST FIPS 203, 204, 205US National Institute of Standards and Technology | Final | ML-KEM (key exchange), ML-DSA and SLH-DSA (digital signatures) were published as final federal standards on 13 August 2024. Next: These are the algorithms most of the projects on this page are adopting. |
13 Aug 2024 |
|
| #NIST FIPS 206 (FN-DSA, Falcon)NIST | In development | Falcon-based signature standard with much smaller signatures than ML-DSA. NIST's project page still lists it as in development; no final standard yet. Next: Publication of the final standard. Until then, ML-DSA and SLH-DSA are the approved signature choices. |
— |
|
| #NIST HQC (backup key exchange)NIST | Selected | Selected in March 2025 as a backup to ML-KEM that relies on error-correcting codes instead of lattices. No draft standard published as of October 2026. Next: Draft standard, then a final standard; NIST's announcement expected the final version in 2027. |
11 Mar 2025 |
|
| #NIST IR 8547 transition timelineNIST | Draft | Initial public draft from 12 November 2024: quantum-vulnerable algorithms such as RSA, ECDSA and EdDSA are deprecated after 2030 and disallowed after 2035. Still marked as a draft. Next: Final version of the report. |
12 Nov 2024 |
|
| #NSA CNSA 2.0US National Security Agency (national security systems) | Mandated | Requires ML-KEM-1024 and ML-DSA-87. Exclusive use for software and firmware signing and networking equipment by 2030; for web browsers, servers, cloud services and operating systems by 2033. Next: All US national security systems quantum-resistant by 2035. |
7 Sep 2022 |
|
| #EU coordinated PQC roadmapEU Member States (NIS Cooperation Group) | Adopted | Roadmap published in June 2025: Member States start the transition by the end of 2026, high-risk use cases are migrated by the end of 2030, and as many systems as feasible by 2035. Next: National plans and cryptographic inventories by the end of 2026. |
23 Jun 2025 |
|
| #UK NCSC migration timelineUK National Cyber Security Centre | Guidance | Three milestones published in March 2025: discovery and an initial plan by 2028, highest-priority migrations by 2031, all systems migrated by 2035. Next: 2028 milestone for large organisations and critical national infrastructure. |
20 Mar 2025 |
|
| #Germany: national PQC guidelineBMI, BMDS and BSI | Guidance | Guideline published in October 2026 that adopts the EU dates: a cryptographic inventory and first migration steps by the end of 2026, high-risk systems by 2030, broad transition by 2035. Aimed at public administration and companies, including critical infrastructure. Next: Bodies such as UP KRITIS are asked to make the dates binding. |
Oct 2026 |
|
Blockchains
Public blockchains sign every transaction with elliptic-curve keys (ECDSA or Ed25519). Once a public key is visible on-chain, a large enough quantum computer could derive the private key.
| Project | Status | Where it stands | Last change | Sources |
|---|---|---|---|---|
| #BitcoinBitcoin protocol (BIP process) | Draft BIP | BIP-360 (Pay-to-Merkle-Root, P2MR) was merged into the BIPs repository as a draft in February 2026. It defines an output type without Taproot's key path, which protects coins against long-exposure attacks. It does not add a post-quantum signature scheme, and nothing is activated. Next: A separate proposal for post-quantum signatures, then a soft fork that needs broad consensus. Coins whose public keys are already exposed would still have to move. |
Feb 2026 |
|
| #EthereumEthereum Foundation and client teams | Roadmap: Dec 2029 | The Ethereum Foundation's protocol team aims for Ethereum L1 to be quantum-resistant across execution, consensus and data by December 2029, and treats the date as fixed until a reassessment in January 2027. User accounts still sign with ECDSA today. Next: Client teams can begin implementing the Hegotá fork in late Q4 2026; full post-quantum readiness is planned several hard forks later. |
7 Sep 2026 |
|
| #SolanaSolana ecosystem | Opt-in vault | An opt-in Winternitz vault (hash-based one-time signatures, a new key for every transaction) has been available since January 2025. Standard accounts still use Ed25519. Next: No protocol-wide migration has shipped. |
Jan 2025 |
|
| #AlgorandAlgorand Foundation | Native PQ accounts | Falcon-signed State Proofs since 2022. The v5.0.0 upgrade (August 2026) added native Falcon-1024 accounts that sign transactions with post-quantum signatures. Consensus and ordinary accounts still use Ed25519. Next: Broader quantum resilience, including consensus, targeted by the end of 2027. |
16 Aug 2026 |
|
| #AptosAptos Labs | Proposal | AIP-137 (December 2025) proposes SLH-DSA-SHA2-128s, a hash-based NIST standard, as an optional account signature type. Existing accounts stay as they are. Next: Governance approval and activation. |
Dec 2025 |
|
| #QRL (Quantum Resistant Ledger)The QRL Foundation | Hash-based since 2018 | The mainnet has used hash-based XMSS signatures since its launch in 2018. QRL 2.0 (Zond), a proof-of-stake chain with ML-DSA-87 and EVM smart contracts, runs as Testnet V2 since 31 March 2026. Next: QRL 2.0 mainnet after the external audits are complete; no date announced. |
31 Mar 2026 |
|
| #BB84 our projectHadamard (publisher of this tracker) | Live | ECDSA-free OP Stack Layer 2, live on Ethereum mainnet since 30 September 2026. Accounts are keccak hash-chain commitments instead of ECDSA keys, and every payment goes to a one-time address. Used for USDC and EURC payments. Next: Deposits and withdrawals still pass through Ethereum L1, which relies on ECDSA until Ethereum migrates. |
30 Sep 2026 |
|
Browsers, operating systems & internet infrastructure
Key exchange is protecting against "harvest now, decrypt later". Post-quantum certificates (authentication) are the next, harder step.
| Project | Status | Where it stands | Last change | Sources |
|---|---|---|---|---|
| #Google ChromeGoogle | Key exchange | Hybrid ML-KEM key exchange (X25519MLKEM768) is on by default since Chrome 131 (November 2024). Chrome 124 had already enabled the earlier Kyber draft on desktop. Next: Post-quantum certificates for authentication; not yet in use on the public web. |
Nov 2024 |
|
| #Mozilla FirefoxMozilla | Key exchange | X25519MLKEM768 on by default on desktop since Firefox 132 and on Android since Firefox 145; also over HTTP/3 (QUIC) on desktop since Firefox 135. Next: Post-quantum signatures are not supported yet. |
2025 |
|
| #Apple iOS, iPadOS & macOS networkingApple | Key exchange | On iOS 26, iPadOS 26 and later, TLS 1.3 with X25519MLKEM768 is on by default for the URLSession framework and the Network APIs, so most apps get it without code changes. Next: Post-quantum certificates, which depend on the wider web PKI. |
Sep 2025 | |
| #CloudflareCloudflare | Key exchange | Hybrid ML-KEM is on by default for connections from browsers to Cloudflare. Cloudflare Radar reported about two-thirds of human HTTPS traffic as post-quantum encrypted in 2026, up from about one-third in January 2025. Next: Connections from Cloudflare onward to customers' origin servers, where adoption is much lower. |
2026 |
|
| #OpenSSHOpenBSD project | Key exchange | OpenSSH 10.0 (April 2025) made the hybrid mlkem768x25519-sha256 the default key exchange. A hybrid with sntrup761 had been the default since OpenSSH 9.0. Next: Post-quantum host and user keys (signatures). |
9 Apr 2025 |
|
| #OpenSSLOpenSSL Foundation | Key exchange | OpenSSL 3.5 LTS (8 April 2025) added ML-KEM, ML-DSA and SLH-DSA and sends an X25519MLKEM768 key share by default in TLS 1.3. Supported until April 2030. Next: Adoption depends on Linux distributions shipping 3.5 or later. |
8 Apr 2025 |
|
| #Microsoft WindowsMicrosoft | APIs available | ML-KEM and ML-DSA became generally available in Windows 11, Windows Server 2025 and .NET 10 with the November 2025 updates, through the CNG cryptography APIs and certificate functions. Next: Applications and services have to adopt the new APIs. |
Nov 2025 |
|
| #Let's EncryptInternet Security Research Group | Certificates | Committed to Merkle Tree Certificates as its path to post-quantum certificates. Staging environment targeted for late 2026. Next: Production-ready environment in 2027. Current subscribers do not need to act yet. |
3 Jun 2026 |
|
Messaging
End-to-end encrypted messengers were among the first to add post-quantum key agreement.
| Project | Status | Where it stands | Last change | Sources |
|---|---|---|---|---|
| #SignalSignal Foundation | Key exchange + ratchet | PQXDH added post-quantum key agreement in 2023. In October 2025 Signal announced SPQR, which mixes ML-KEM into the ongoing ratchet (the "Triple Ratchet"). Conversations move to it automatically. Next: Upgrading remaining older sessions once all clients support SPQR. |
Oct 2025 |
|
| #Apple iMessageApple | Key exchange + rekeying | The PQ3 protocol adds post-quantum key establishment and periodic post-quantum rekeying. It shipped with iOS 17.4, iPadOS 17.4 and macOS 14.4 in 2024. Next: No further change announced. |
Mar 2024 |
|
Wallets, hardware & custody
A wallet can only sign with post-quantum keys once the chain accepts them, but devices, firmware and custodians can prepare earlier.
| Project | Status | Where it stands | Last change | Sources |
|---|---|---|---|---|
| #Trezor Safe 7Trezor (SatoshiLabs) | Device security | The device verifies its bootloader and firmware with hybrid SLH-DSA + Ed25519 signatures and uses ML-DSA-44 for device attestation. Transactions are still signed with each blockchain's own classical scheme. Next: Post-quantum transaction signing once blockchains support it. Older Trezor models cannot be upgraded this way. |
— | |
| #LedgerLedger | SDK | ML-KEM and ML-DSA were added to the Ledger SDK for its secure elements; Ledger lists protection against physical attacks as future work. Post-quantum transaction signing on consumer devices has not been announced. Next: Hardened implementations and wallet apps that use them. |
Jun 2026 |
|
| #CoinbaseCoinbase | Research | Formed an independent advisory board on quantum computing and blockchain in January 2026 to publish position papers and security recommendations. Next: Recommendations that feed into Coinbase's own post-quantum roadmap. |
23 Jan 2026 |
|
Nothing matches these filters.
How to read this tracker
- On by default Shipped and active for users without any action. For standards: final and in force.
- Available, opt-in Shipped, but users, developers or operators have to choose it.
- In progress Draft standard, testnet, proposal under review or a rollout that has started but is not complete.
- Planned Public roadmap, target date or research programme. Nothing shipped yet.
Statuses describe what users get today, not what has been announced. Key exchange and signatures are tracked separately where it matters: most of the web already encrypts with post-quantum key exchange, while post-quantum signatures and certificates are still early.
Each entry is checked against its sources at least once a week; the date at the top shows the last full review. Found something outdated? Write to info@hadamard.com with a source and we will update it.
Disclosure: Hadamard builds BB84, which is listed under Blockchains and marked as our project.
Cite, link or reuse
The data is free to reuse under CC BY 4.0. Please credit and link the tracker.
Hadamard (2026). Post-Quantum Migration Tracker. Retrieved 21 Oct 2026, from https://hadamard.com/post-quantum-tracker/<a href="https://hadamard.com/post-quantum-tracker/">Post-Quantum Migration Tracker by Hadamard</a>Link a single project with its anchor, for example /post-quantum-tracker/#ethereum.
Changelog
- Tracker launched.