NIST post-quantum timeline: what happens in 2030 and 2035
NIST has put a clock on the post-quantum transition. After standardizing ML-KEM, ML-DSA and SPHINCS+ in 2024, its guidance sets concrete milestones: classical public-key algorithms like RSA and elliptic-curve are deprecated after 2030 and disallowed after 2035. Those dates let organizations plan the migration backwards from a fixed deadline instead of treating it as indefinite.
What "deprecated" and "disallowed" mean
Deprecated after 2030 means classical algorithms are discouraged and should be phased out — you can still use them but you are on notice. Disallowed after 2035 means they are no longer acceptable for protecting federal information, and by extension for anyone following NIST guidance or subject to it through procurement. The gap between the two dates is the migration runway: begin during deprecation, complete before the disallowed line.
Why the deadline understates the urgency
The 2035 date is when classical crypto becomes disallowed, not when it becomes unsafe. Harvest-now-decrypt-later means data with a long confidentiality lifetime is already at risk today, because it can be recorded now and decrypted once quantum computers arrive. If your data must stay secret for ten years, migrating it in 2034 is too late — the recording happened a decade earlier. Plan by data lifetime, not just the compliance date.
Planning backwards
Inventory your cryptography and tag each use by how long its data must stay protected. Anything whose lifetime extends past the quantum horizon migrates first, regardless of the 2035 line. Adopt hybrid deployment now so you gain protection without regression. The standards are resistant to known classical and quantum attacks per NIST, not unbreakable — but they are the destination the timeline points to, and the runway is finite.
Try it yourself — live, free, verifiable in 30 seconds:
Start your PQC migration →