Home / Tools / Mosca's inequality calculator
Free tool · runs in your browser
Mosca's inequality calculator: is your data already at risk?
Mosca's inequality says: if X + Y > Z, you have a problem. X is how long your data must stay secret, Y is how long your migration to post-quantum cryptography will take, and Z is how long until a quantum computer can break today’s encryption.
Built by Kyeson Blake Utley for the free Quantum Defense course.
How to read it
Michele Mosca, a quantum computing researcher, framed the question with those three numbers. If X + Y is bigger than Z, data you encrypt the old way near the end of your migration will still need protecting after a cryptographically relevant quantum computer (CRQC) exists. If that traffic is being recorded today, it will be exposed while it still matters.
- X (shelf life) is the one people underestimate. Health records, trade secrets, legal files and government data often need decades.
- Y (migration time) is the only number you control. Replacing a cryptographic algorithm everywhere it hides takes large organizations years.
- Z (time to a CRQC) is unknown. Treat it as a range and try both ends.
What do experts say about Z?
Nobody can give you a date. In a 2015 note, Mosca estimated a one-in-two chance of breaking RSA-2048 by 2031. The Global Risk Institute’s 2024 survey of 32 experts put the likelihood of a machine that breaks RSA-2048 within 24 hours at roughly 19% to 34% within ten years. Resource estimates keep falling: from about 20 million noisy qubits (Gidney and Ekerå, 2019) to fewer than one million (Gidney, 2025) for factoring RSA-2048. The full discussion, with sources, is in the lesson below.
This tool comes from Lesson 6: Harvest now, decrypt later, part of a free 18-lesson post-quantum cryptography course. Every figure there links to its source.
Questions
What is Mosca's inequality?
A rule of thumb from quantum computing researcher Michele Mosca: if the time your data must stay secret (X) plus the time your migration takes (Y) exceeds the time until a cryptographically relevant quantum computer exists (Z), data encrypted with today's public-key cryptography will be exposed while it still matters.
Why does it matter before quantum computers exist?
Because of harvest now, decrypt later. Encrypted traffic recorded today can be stored and decrypted once a quantum computer exists, so long-lived data is already at risk.
What value should I use for Z?
There is no reliable date. Try a range: published estimates and expert surveys differ widely, so check whether your conclusion survives a pessimistic guess.
How do I make X + Y smaller?
You usually can't change X, so shorten Y: start your cryptographic inventory now, deploy hybrid post-quantum key exchange where you can, and prioritize systems that carry long-lived data.