Harvest Window Planner
Rank your data by how long a quantum computer could read it while still secret.
The year a code-breaking quantum computer exists. Rankings ignore it.
Your inventory
Migration order
Where RSA and ECC live
0 of 10 inventoriedHow the planner works
Harvest Window = x + y, or 0 when x is 0
Exposure ends = 2026 + x + y
Secrecy owed on Q-Day z = min(x, max(0, x + y − (z − 2026)))
Signing key start-by year = z − y
- x is how many years the data must stay secret; y is the years until migration completes.
- Data sent until migration ends stays secret until 2026 + x + y. Earlier Q-Days read some of it.
- Signing keys face forgery from Q-Day onward. Recorded signatures give nothing to decrypt.
Standards and dates
Checked 3 Nov 2026| Standard | What it does | Status |
|---|---|---|
| ML-KEM (FIPS 203) | Key encapsulation from CRYSTALS-Kyber. NIST names ML-KEM-768 the default. | Final, 13 Aug 2024 |
| ML-DSA (FIPS 204) | Lattice signatures from CRYSTALS-Dilithium. | Final, 13 Aug 2024 |
| SLH-DSA (FIPS 205) | Hash-based signatures from SPHINCS+, the conservative backup. | Final, 13 Aug 2024 |
| FN-DSA (FIPS 206) | Compact lattice signatures from Falcon. | Standardization underway, no final FIPS |
| HQC | Code-based key encapsulation, a backup to ML-KEM. | Selected 11 Mar 2025; FIPS in development |
| NIST IR 8547 | RSA, ECDSA, EdDSA, DH and ECDH: deprecated after 2030, disallowed after 2035. | Final, 27 Oct 2026 |
Harvest Window FAQ
What is the Harvest Window?
It is Mosca's inequality as a number of years: how long the data must stay secret (x) plus how long you will keep sending it under RSA or elliptic-curve cryptography (y). Records copied before migration finishes stay secret-bearing until 2026 + x + y. A quantum computer that arrives before then reads some of them while they still matter.
Why do signing keys have no Harvest Window?
A recorded signature gives an attacker nothing to decrypt later. The risk starts on Q-Day, when a quantum computer can forge new signatures with your key. So a code-signing or root CA row gets a start-by year instead: the Q-Day year minus the years the migration takes.
Which Q-Day year should I pick?
Nobody can date a cryptographically relevant quantum computer, so treat the slider as a sensitivity test. The Harvest Window ranking does not change with it. NIST IR 8547 deprecates quantum-vulnerable public-key algorithms after 2030 and disallows them after 2035, which makes 2035 a common planning year.
Is my inventory uploaded anywhere?
No. The rows and checklist stay in this browser's local storage, and the CSV is built on the page. Clear removes them.
Lifetimes are planning figures. Q-Day is your assumption. Planning aid only.