Post-Quantum Migration Tracker
Who is ready for quantum computers?
A sourced overview of how blockchains, browsers, messengers, wallets and governments are moving from RSA and elliptic-curve cryptography to post-quantum algorithms. Every line links to the primary announcement or standard.
Status across all 28 projects
- On by default 12
- Available, opt-in 3
- In progress 10
- Planned 3
In March 2026, Google Quantum AI estimated that breaking the 256-bit elliptic curves used by Bitcoin and Ethereum could need fewer than half a million physical qubits, about 20 times fewer than earlier estimates. No such machine exists yet.
- Securing elliptic curve cryptocurrencies against quantum vulnerabilities Google Quantum AI, Mar 2026
Deadlines that drive the migration
- Aug 2024NIST publishes FIPS 203, 204, 205
- Today8 Nov 2026
- Dec 2026EU and Germany: crypto inventories and first steps
- 2028UK: discovery and migration plan done
- Dec 2029Ethereum L1 quantum-resistant (target)
- 2030NIST: RSA and ECC deprecated · EU: high-risk systems migrated · CNSA 2.0: signing and networking
- 2031UK: highest-priority migrations done
- 2033CNSA 2.0: browsers, servers, cloud and operating systems
- 2035NIST: RSA and ECC disallowed · UK, EU and US national security systems migrated
Standards & government deadlines
The algorithms everyone is migrating to, and the dates regulators have set for leaving RSA and elliptic curves behind.
| Project | Status | Where it stands | Last change | Sources |
|---|---|---|---|---|
| #NIST FIPS 203, 204, 205US National Institute of Standards and Technology | Final | ML-KEM (key exchange), ML-DSA and SLH-DSA (digital signatures) were published as final federal standards on 13 August 2024. Next: These are the algorithms most of the projects on this page are adopting. |
13 Aug 2024 |
|
| #NIST FIPS 206 (FN-DSA, Falcon)NIST | In development | Falcon-based signature standard with much smaller signatures than ML-DSA. NIST's project page still lists it as in development; no final standard yet. Next: Publication of the final standard. Until then, ML-DSA and SLH-DSA are the approved signature choices. |
— |
|
| #NIST HQC (backup key exchange)NIST | Selected | Selected in March 2025 as a backup to ML-KEM that relies on error-correcting codes instead of lattices. No draft standard published as of October 2026. Next: Draft standard, then a final standard; NIST's announcement expected the final version in 2027. |
11 Mar 2025 |
|
| #NIST IR 8547 transition timelineNIST | Final | Final version published on 27 October 2026, replacing the November 2024 draft. Quantum-vulnerable algorithms such as RSA, ECDSA and EdDSA remain deprecated after 2030 and disallowed after 2035. According to coverage, it aligns with Executive Order 14412: post-quantum key exchange by the end of 2030 and post-quantum signatures by the end of 2031 for high-value federal systems. Next: Deprecation of quantum-vulnerable algorithms after 2030. NIST says it will monitor developments and adjust the transition timeline if needed. |
27 Oct 2026 |
|
| #NSA CNSA 2.0US National Security Agency (national security systems) | Mandated | Requires ML-KEM-1024 and ML-DSA-87. Exclusive use for software and firmware signing and networking equipment by 2030; for web browsers, servers, cloud services and operating systems by 2033. Next: All US national security systems quantum-resistant by 2035. |
7 Sep 2022 |
|
| #EU coordinated PQC roadmapEU Member States (NIS Cooperation Group) | Adopted | Roadmap published in June 2025: Member States start the transition by the end of 2026, high-risk use cases are migrated by the end of 2030, and as many systems as feasible by 2035. Next: National plans and cryptographic inventories by the end of 2026. |
23 Jun 2025 |
|
| #UK NCSC migration timelineUK National Cyber Security Centre | Guidance | Three milestones published in March 2025: discovery and an initial plan by 2028, highest-priority migrations by 2031, all systems migrated by 2035. Next: 2028 milestone for large organisations and critical national infrastructure. |
20 Mar 2025 |
|
| #Germany: national PQC guidelineBMI, BMDS and BSI | Guidance | Guideline published in October 2026 that adopts the EU dates: a cryptographic inventory and first migration steps by the end of 2026, high-risk systems by 2030, broad transition by 2035. Aimed at public administration and companies, including critical infrastructure. Next: Bodies such as UP KRITIS are asked to make the dates binding. |
Oct 2026 |
|
Blockchains
Public blockchains sign every transaction with elliptic-curve keys (ECDSA or Ed25519). Once a public key is visible on-chain, a large enough quantum computer could derive the private key.
| Project | Status | Where it stands | Last change | Sources |
|---|---|---|---|---|
| #BitcoinBitcoin protocol (BIP process) | Draft BIP | BIP-360 (Pay-to-Merkle-Root, P2MR) was merged into the BIPs repository as a draft in February 2026. It defines an output type without Taproot's key path, which protects coins against long-exposure attacks. It does not add a post-quantum signature scheme, and nothing is activated. Next: A separate proposal for post-quantum signatures, then a soft fork that needs broad consensus. Coins whose public keys are already exposed would still have to move. |
Feb 2026 |
|
| #EthereumEthereum Foundation and client teams | Roadmap: Dec 2029 | The Ethereum Foundation's protocol team aims for Ethereum L1 to be quantum-resistant across execution, consensus and data by December 2029, and treats the date as fixed until a reassessment in January 2027. User accounts still sign with ECDSA today. Next: Client teams can begin implementing the Hegotá fork in late Q4 2026; full post-quantum readiness is planned several hard forks later. |
7 Sep 2026 |
|
| #SolanaSolana ecosystem | Opt-in vault | An opt-in Winternitz vault (hash-based one-time signatures, a new key for every transaction) has been available since January 2025. Standard accounts still use Ed25519. Next: No protocol-wide migration has shipped. |
Jan 2025 |
|
| #AlgorandAlgorand Foundation | Native PQ accounts | Falcon-signed State Proofs since 2022. The v5.0.0 upgrade (August 2026) added native Falcon-1024 accounts that sign transactions with post-quantum signatures. Consensus and ordinary accounts still use Ed25519. Next: Broader quantum resilience, including consensus, targeted by the end of 2027. |
16 Aug 2026 |
|
| #AptosAptos Labs | Proposal | AIP-137 (December 2025) proposes SLH-DSA-SHA2-128s, a hash-based NIST standard, as an optional account signature type. Existing accounts stay as they are. Next: Governance approval and activation. |
Dec 2025 |
|
| #QRL (Quantum Resistant Ledger)The QRL Foundation | Hash-based since 2018 | The mainnet has used hash-based XMSS signatures since its launch in 2018. QRL 2.0 (Zond), a proof-of-stake chain with ML-DSA-87 and EVM smart contracts, runs as Testnet V2 since 31 March 2026. Next: QRL 2.0 mainnet after the external audits are complete; no date announced. |
31 Mar 2026 |
|
| #BB84 our projectHadamard (publisher of this tracker) | Live | ECDSA-free OP Stack Layer 2, live on Ethereum mainnet since 30 September 2026. Accounts are keccak hash-chain commitments instead of ECDSA keys, and every payment goes to a one-time address. Used for USDC and EURC payments. Next: Deposits and withdrawals still pass through Ethereum L1, which relies on ECDSA until Ethereum migrates. |
30 Sep 2026 |
|
Browsers, operating systems & internet infrastructure
Key exchange is protecting against "harvest now, decrypt later". Post-quantum certificates (authentication) are the next, harder step.
| Project | Status | Where it stands | Last change | Sources |
|---|---|---|---|---|
| #Google ChromeGoogle | Key exchange | Hybrid ML-KEM key exchange (X25519MLKEM768) is on by default since Chrome 131 (November 2024). Chrome 150 (mid-2026) added support for ML-DSA certificates in TLS, for private PKI only, not for publicly trusted certificates. Next: A draft Chrome Quantum-resistant Root Program (August 2026) plans a root store that accepts only Merkle Tree Certificate authorities, around Q3 2027. |
14 Aug 2026 |
|
| #Mozilla FirefoxMozilla | Key exchange | X25519MLKEM768 on by default on desktop since Firefox 132 and on Android since Firefox 145; also over HTTP/3 (QUIC) on desktop since Firefox 135. Next: Post-quantum signatures are not supported yet. |
2025 |
|
| #Apple iOS, iPadOS & macOS networkingApple | Key exchange | On iOS 26, iPadOS 26 and later, TLS 1.3 with X25519MLKEM768 is on by default for the URLSession framework and the Network APIs, so most apps get it without code changes. Next: Post-quantum certificates, which depend on the wider web PKI. |
Sep 2025 | |
| #CloudflareCloudflare | Key exchange | Hybrid ML-KEM is on by default for connections from browsers to Cloudflare. Cloudflare Radar reported about two-thirds of human HTTPS traffic as post-quantum encrypted in 2026, up from about one-third in January 2025. Next: Connections from Cloudflare onward to customers' origin servers, where adoption is much lower. |
2026 |
|
| #OpenSSHOpenBSD project | Key exchange & signatures | OpenSSH 10.0 (April 2025) made the hybrid mlkem768x25519-sha256 the default key exchange. OpenSSH 10.6 (6 October 2026) turned on the hybrid post-quantum signature ssh-mldsa44-ed25519, which had been experimental since 10.4 (July 2026). Keys made with the experimental version have to be regenerated. Next: Wider use of post-quantum host and user keys by servers and clients. |
6 Oct 2026 |
|
| #OpenSSLOpenSSL Foundation | Key exchange | OpenSSL 3.5 LTS (8 April 2025) added ML-KEM, ML-DSA and SLH-DSA and sends an X25519MLKEM768 key share by default in TLS 1.3. Supported until April 2030. Next: Adoption depends on Linux distributions shipping 3.5 or later. |
8 Apr 2025 |
|
| #Microsoft WindowsMicrosoft | APIs and opt-in TLS | ML-KEM and ML-DSA became generally available in Windows 11, Windows Server 2025 and .NET 10 with the November 2025 updates, through the CNG APIs and certificate functions. Hybrid ML-KEM key exchange for TLS 1.3 in Schannel has since shipped for Windows 11 and Server 2025, including the Server 2025 update of 14 July 2026 (KB5099536). It is off by default. Next: Admins have to turn on post-quantum TLS in Schannel. Applications and services have to adopt the new APIs. |
14 Jul 2026 |
|
| #Let's EncryptInternet Security Research Group | Certificates | Committed to Merkle Tree Certificates as its path to post-quantum certificates. Staging environment targeted for late 2026. Next: Production-ready environment in 2027. Current subscribers do not need to act yet. |
3 Jun 2026 |
|
Messaging
End-to-end encrypted messengers were among the first to add post-quantum key agreement.
| Project | Status | Where it stands | Last change | Sources |
|---|---|---|---|---|
| #SignalSignal Foundation | Key exchange + ratchet | PQXDH added post-quantum key agreement in 2023. In October 2025 Signal announced SPQR, which mixes ML-KEM into the ongoing ratchet (the "Triple Ratchet"). Conversations move to it automatically. Next: Upgrading remaining older sessions once all clients support SPQR. |
Oct 2025 |
|
| #Apple iMessageApple | Key exchange + rekeying | The PQ3 protocol adds post-quantum key establishment and periodic post-quantum rekeying. It shipped with iOS 17.4, iPadOS 17.4 and macOS 14.4 in 2024. Next: No further change announced. |
Mar 2024 |
|
Wallets, hardware & custody
A wallet can only sign with post-quantum keys once the chain accepts them, but devices, firmware and custodians can prepare earlier.
| Project | Status | Where it stands | Last change | Sources |
|---|---|---|---|---|
| #Trezor Safe 7Trezor (SatoshiLabs) | Device security | The device verifies its bootloader and firmware with hybrid SLH-DSA + Ed25519 signatures and uses ML-DSA-44 for device attestation. Transactions are still signed with each blockchain's own classical scheme. Next: Post-quantum transaction signing once blockchains support it. Older Trezor models cannot be upgraded this way. |
— | |
| #LedgerLedger | SDK | ML-KEM and ML-DSA were added to the Ledger SDK for its secure elements; Ledger lists protection against physical attacks as future work. Post-quantum transaction signing on consumer devices has not been announced. Next: Hardened implementations and wallet apps that use them. |
Jun 2026 |
|
| #CoinbaseCoinbase | Research | Formed an independent advisory board on quantum computing and blockchain in January 2026; the board published its first position paper in April 2026. On 13 October 2026 Coinbase published its position on Bitcoin's post-quantum migration, favouring flexible designs such as P2MR (BIP-360) and P2TRv2 and wanting the question of dormant coins handled separately. Next: Post-quantum signing for Coinbase's own wallets and custody, which has not been officially announced. |
13 Oct 2026 |
|
Nothing matches these filters.
How to read this tracker
- On by default Shipped and active for users without any action. For standards: final and in force.
- Available, opt-in Shipped, but users, developers or operators have to choose it.
- In progress Draft standard, testnet, proposal under review or a rollout that has started but is not complete.
- Planned Public roadmap, target date or research programme. Nothing shipped yet.
Statuses describe what users get today, not what has been announced. Key exchange and signatures are tracked separately where it matters: most of the web already encrypts with post-quantum key exchange, while post-quantum signatures and certificates are still early.
Each entry is checked against its sources at least once a week; the date at the top shows the last full review. Found something outdated? Write to info@hadamard.com with a source and we will update it.
Disclosure: Hadamard builds BB84, which is listed under Blockchains and marked as our project.
Cite, link or reuse
The data is free to reuse under CC BY 4.0. Please credit and link the tracker.
Hadamard (2026). Post-Quantum Migration Tracker. Retrieved 8 Nov 2026, from https://hadamard.com/post-quantum-tracker/<a href="https://hadamard.com/post-quantum-tracker/">Post-Quantum Migration Tracker by Hadamard</a>Link a single project with its anchor, for example /post-quantum-tracker/#ethereum.
Changelog
- NIST IR 8547 transition timeline: NIST published the final IR 8547, replacing the initial public draft; the tracked next step (final version) is complete.
- Coinbase: The entry left out two sourced developments: the advisory board's first position paper (April 2026) and Coinbase's Bitcoin post-quantum migration position (13 October 2026). Reports of a post-quantum signing setup come only from secondary sources and are not included.
- Google Chrome: Chrome 150 added ML-DSA certificates for private PKI, and a draft quantum-resistant root program set out the plan for public post-quantum certificates.
- Microsoft Windows: Hybrid ML-KEM for TLS 1.3 in Schannel shipped. It is off by default, so the status stays opt-in.
- OpenSSH: OpenSSH 10.6 turned on hybrid ML-DSA signatures, so the entry's 'next' item (post-quantum host and user keys) is now partly done.
- Tracker launched.