About Q-Advantage

The independent measurement layer over the post-quantum migration.

NIST finished choosing the algorithms. What is left is harder and more expensive: every organisation now has to decide when to turn post-quantum encryption on, and what it costs them — in latency, in connections per core, in bytes on the wire, in hardware bought sooner than planned. Nobody neutral has priced that.

We exist to make it measurable. Our mission is to make the true cost of post-quantum cryptography independently verifiable, so a migration decision can be checked instead of trusted. Every benchmark re-runs on a schedule. Every figure links to the run or the cited source that produced it.

We do not sell migration tools, and we never will. Selling them would destroy the only thing the market actually needs from us.

What we measure

We measure, track, rate, and price.

Four instruments, each answering a different part of the same question. Two are live today; the rating and the cost calculator are named here honestly as not yet published, rather than pre-announced as shipped. The discipline is identical across all of them: vendor-published or peer-reviewed sources only, every figure dated and methodology-tagged, every result reproducible from a public commit.

Q-Day Index

The threat horizon

Live

What it measures

A 0–100 score for how close today's quantum hardware is to breaking RSA-2048, computed against a named, published resource estimate (Gidney 2025, currently <1M physical qubits).

How

A multiplicative-gate score: distance is governed by logical-qubit capacity, two-qubit gate fidelity at the fault-tolerance threshold, and a multiplier rewarding a demonstrated below-threshold error-correction result. Every system's inputs come from a vendor data sheet or peer-reviewed paper, with the measurement method (XEB vs ECR vs randomized benchmarking) surfaced alongside the value. The 'readiness' axis — preconditions assembled toward breaking RSA — is shown as a separate, structurally different visual so the two are never confused.

Status

Eight scored systems plus two analog (N/A) entries and four footnoted candidates. Frontier sits in the low single digits today; the trajectory is the story.

Open Q-Day Index

Q-Shield

PQC benchmarks · daily

Live

What it measures

Independent performance benchmarks for the NIST-standardized post-quantum cryptographic algorithms — ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205).

How

Each algorithm is benchmarked across keygen, encap/decap (KEMs) and sign/verify (signatures) on a self-hosted GitHub Actions runner. CPU pinned to a single core, garbage collection disabled during measurement, 1,000 timed iterations per operation after 50 warmups. Full environment captured per run — CPU model, kernel version, liboqs version, git SHA, instance type — so every result is reproducible bit-for-bit. CPU steal-time and load average are captured so burstable-instance throttling is visible in the audit trail.

Status

Re-runs daily at 06:00 UTC. Every data point on the dashboard deep-links to the exact Actions run that produced it.

Open Q-Shield

How it works

Reproducibility is the product.

Every chart, score, and comparison on this site is the output of code in a public repo. The recipe, the run, the artifacts, and the result are linked end-to-end so anyone can audit, re-run, or fork what we publish.

Recipe in the repo.

The benchmark scripts, the scoring engine, and the dataset live in the public q-advantage repo. Every figure on the dashboard traces back to a versioned file.

Runs on real hardware.

Q-Shield benchmarks execute on a self-hosted GitHub Actions runner with CPU pinning and GC disabled during measurement. Full environment captured per run — CPU model, kernel version, liboqs version, git SHA — so every result is reproducible bit-for-bit.

Public Actions logs.

Every benchmark run is a public GitHub Actions workflow. Logs and artifacts are retained for 90 days; periodic database snapshots will be published as public releases for longer auditability.

Every result links back.

Every data point on the dashboard carries a deep-link to the exact Actions run that produced it. Click a sparkline dot, hit the run page, inspect the logs. No black box.

Browse workflow runs View benchmark recipes Source repository

Independence

The constraint is the product.

Every performance claim a buyer currently sees comes from someone selling something. That is the gap we occupy, and it only stays occupied if we are structurally unable to become one of those sellers. So the constraints are written down rather than promised:

No migration tooling, ever. Not a stage we are at — a permanent constraint.
No positions in anything we measure.
No rated party sees a result early, or influences methodology, scope, or timing.
Public methodology, published corrections. Surviving scrutiny is the credential.

Q-Advantage is built and run by Joshua Opaka, a solo founder — six years in production software engineering, with security as the through-line, and work spanning crypto infrastructure, banking, AI, and quantum. That span is the shape of the post-quantum value chain itself.

Two things worth stating before anyone asks. There is no vendor employment history and no product to sell, which is what makes the independence structurally credible rather than merely asserted. And this is not a credentialed cryptography lab — which is exactly why the methodology is fully public and every run is cross-validated against eBACS and liboqs’s own speed tools rather than published on trust.

The pipeline runs daily without a team because it was built to. If a number here is wrong, the fastest way to fix it is to tell us in public.

Frequently asked

Questions worth asking.

What is Q-Advantage?

The independent measurement-and-intelligence layer over the post-quantum migration. Not a migration vendor, not a security product. Q-Shield measures how the standardized PQC algorithms actually perform on production hardware, daily; the Q-Day Index tracks distance to a cryptographically relevant quantum computer. A vendor-implementation rating and a migration cost calculator are specced and not yet published. The through line is the same: what does turning post-quantum encryption on actually cost, and can you check the answer yourself.

Who runs Q-Advantage?

Joshua Opaka, solo, currently without external funding. The codebase, data, methodology, and Actions logs are all open for inspection. There is no paid tier today. When that changes — data subscriptions, reports, analyst access — it will be announced publicly with the terms in writing, and the line between what stays free and what is paid will be published as a principle rather than introduced quietly later. What will never be sold is migration tooling.

What does “vendor-neutral” mean in practice?

No quantum hardware or PQC software vendor pays for placement, ranking, or early access. The Q-Day Index hero is the field frontier, not a named winner; the table lists every machine with its own score and inputs. Every spec carries its source, measurement method, and confidence level so readers can judge the data, not trust ours.

Why does the Q-Day Index threat score sit in the single digits?

Because that is the honest reading today. The score is a multiplicative gate — it goes to zero whenever a system lacks demonstrated, standing, error-corrected logical qubits. Only one system in the dataset clears that bar at the time of writing. The trajectory is the story, not the absolute digit, and the readiness column tracks that trajectory.

Is there a projected Q-Day year?

Not yet. A projection is only as good as its model, and we have not built one that survives hostile inspection. When we publish one, the model, the assumptions, and the inputs will all be open. Anything else would be a guess dressed up as analysis.

How do you handle systems that don't fit the schema?

Analog Hamiltonian simulators (QuEra Aquila, Pasqal Orion Alpha) have no gate-model two-qubit fidelity, so they appear in the table as explicit N/A — a category difference, not a low score. Photonic and silicon-spin systems with peer-reviewed credentials but no deployed multi-qubit processor appear as footnotes with the specific reason they fall short of the scoring bar.

What is the sourcing bar for the dataset?

Vendor-published or peer-reviewed only. Every numeric field carries its URL, its confidence level (peer-reviewed vs vendor-published), the measurement method (XEB vs ECR vs randomized benchmarking, etc.), and the date the figure was true. Press releases, blog posts, and secondary aggregators do not clear the bar. Where they conflict with published values, the published value wins and the gap is noted — for example, Google's blog says “approaching 100 µs” coherence, the Nature paper says 68 µs; we cite the paper.

Can I challenge a number?

Yes — please. There is a feedback form at the bottom of the Q-Day Index page, and a public GitHub Issues tracker for anything you want a public record of. Concrete corrections improve every subsequent run.

Can I re-run a benchmark myself?

Yes. The Q-Shield benchmark script (benchmark/benchmark.py) is a standalone Python program; clone the repo, install liboqs at the matching version, and it produces the same JSON. The Q-Day Index emitter (benchmark/build-q-day-index.py) runs against the committed dataset and reproduces the dashboard JSON deterministically.

Is everything open source?

The benchmark code, the scoring engine, the dataset, the methodology document, and the frontend are all in the public q-advantage repository.

Contribute

Public critique is how this stays honest.

If you spot a wrong number, a weak source, a missing system, or a method tag we have misapplied — say so. If you want to discuss the scoring formula, the anchor target, or whether a vendor's claim clears the bar — open an issue.

GitHub organisation Open an issue hello@qadvantage.io