Quantum computers that can break today's encryption

How far are we from quantum computers that can break today's encryption?

No quantum computer has broken the public-key encryption that protects online banking and messaging, such as RSA-2048. A 2024 Google Quantum AI result used a 101-qubit code to keep one logical memory stable. A 2025 preprint estimates that factoring a 2048-bit RSA number would need fewer than one million noisy physical qubits, and no machine of that size exists.

AI illustration · Illustrative scene, not a photograph of the specific device or experiment.
WHERE WE AREEngineering prototypes

Getting closer. Prototypes exist, but not in real-world use.

Google Quantum AI reported a surface-code memory in which the logical error rate fell as the code grew, which is the core error-correction step. That result used a 101-qubit distance-7 code and is a preprint. The estimate for breaking RSA-2048 in the sources reviewed is a theoretical preprint by Gidney (2025), not a hardware demonstration. No source reviewed shows a quantum computer factoring a key of practical size, so the field is at the engineering prototype stage rather than a working machine.

The tech tree

Everything recorded on Vrulum that this future needs, oldest foundations at the top and the goal at the bottom. Lines show what each step requires.

What it takes: Quantum computers that can break today's encryption Unlocked Being researched Locked
  1. 2018Topological qubitsLab demonstration Being researched.
  1. 1995Quantum error correctionLab demonstrationRequires: Topological qubits. Being researched.
  1. 2024Post-quantum encryption standards publishedDone Unlocked.
  2. 2024Quantum error correction shown below thresholdDone Unlocked.
  3. 2024Migration of public-key systems away from quantum-vulnerable algorithmsIn progress Being researched.
  4. 2025Resource estimate for factoring 2048-bit RSADone Unlocked.
  5. Date not recordedReliable logical operations on error-corrected qubitsIn progress Being researched.
  6. Date not recordedFault-tolerant machine with enough logical qubits for useful algorithmsNot started Locked.
  7. Date not recordedCryptographically relevant quantum computerNot started Locked.
  8. Date not recordedQuantum-vulnerable algorithms no longer used in new or legacy systemsNot started Locked.
  1. GoalQuantum computers that can break today's encryptionGoalRequires: Quantum error correction, Quantum error correction shown below threshold, Reliable logical operations on error-corrected qubits, Resource estimate for factoring 2048-bit RSA, Fault-tolerant machine with enough logical qubits for useful algorithms, Cryptographically relevant quantum computer, Post-quantum encryption standards published, Migration of public-key systems away from quantum-vulnerable algorithms, Quantum-vulnerable algorithms no longer used in new or legacy systems. Locked.

The road so far

3 of 8 steps done, 2 in progress.

  1. Done · 24 Aug 2024Quantum error correction shown below threshold

    Google Quantum AI reported a distance-7 surface-code memory on 101 qubits. Its logical error rate fell by a factor of 2.14 when the code distance increased by two. Decoder latency was measured over up to one million cycles on a distance-5 code with real-time decoding. This is a preprint result, later published in Nature in 2025. [1]

  2. In progressReliable logical operations on error-corrected qubits

    Stable logical memories have been shown. Logical gates and multi-step calculations on error-corrected qubits at useful scale have not been shown in the sources reviewed. [1]

  3. Done · 21 May 2025Resource estimate for factoring 2048-bit RSA

    Gidney estimated that a 2048-bit RSA integer could be factored in less than a week with fewer than one million noisy qubits. The estimate assumes a 0.1% gate error rate and a 1 microsecond surface-code cycle. It is a theoretical preprint and has not been demonstrated. [2]

  4. Not startedFault-tolerant machine with enough logical qubits for useful algorithms

    Running Shor's algorithm on a key of practical size needs many logical qubits working together. No machine of this kind has been reported in the sources reviewed.

  5. Not startedCryptographically relevant quantum computer

    A machine able to break RSA-2048 would need the scale described in the 2025 estimate, which is around a million noisy physical qubits. No such machine exists.

  6. Done · 13 Aug 2024Post-quantum encryption standards published

    NIST published FIPS 203 (ML-KEM), a key-establishment standard designed to resist quantum attacks, on 13 August 2024. [3]

  7. In progress · 12 Nov 2024Migration of public-key systems away from quantum-vulnerable algorithms

    NIST's transition guidance, NIST IR 8547, was released as an initial public draft in November 2024. The draft sets out a migration plan but is not yet a final document in the sources reviewed. [4]

  8. Not startedQuantum-vulnerable algorithms no longer used in new or legacy systems

    Final dates for deprecating and disallowing RSA and elliptic-curve algorithms are not confirmed in the sources reviewed.

Why it matters

Much of the internet relies on public-key cryptography such as RSA and elliptic-curve schemes. A quantum computer large enough to run Shor's algorithm at useful size could break those schemes. Governments and standards bodies are therefore replacing them with post-quantum algorithms now, because data stolen today can be decrypted later once a suitable machine exists.

What stands in the way

  • A useful machine needs about one million noisy physical qubits in the 2025 estimate, far above the scale of published experiments.
  • Logical gates and the special states they need add large overheads, which lengthen run times.
  • Decoders must process error data in real time at very large scale, which is not yet demonstrated.
  • The 2025 estimate assumes a surface-code architecture, a 0.1% gate error rate and a 1 microsecond cycle time, and its resource counts depend on those inputs.
  • Building, wiring and cooling millions of qubits reliably is not yet shown.

Signals to watch

  • Peer-reviewed publication of the Gidney factoring estimate, with its assumptions checked.
  • Logical gates on error-corrected qubits at distance 7 or higher, reported in a published experiment.
  • Growth in the number of logical qubits in a single published device.
  • Publication of the final NIST IR 8547 with dated migration deadlines.
  • Peer-reviewed comparison of resource estimates across different error-correcting codes.

Sources

  1. preprint
    Quantum error correction below the surface code threshold
    Rajeev Acharya. arXiv (preprint), 24 Aug 2024.
  2. preprint
    How to factor 2048 bit RSA integers with less than a million noisy qubits
    Craig Gidney. arXiv (preprint), 21 May 2025.
  3. standard
    Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203)
    National Institute of Standards and Technology, 13 Aug 2024.
  4. government report
    Transition to Post-Quantum Cryptography Standards (NIST IR 8547, initial public draft)
    Dustin Moody, Ray Perlner, Andrew Regenscheid et al.. National Institute of Standards and Technology, 12 Nov 2024.

Last reviewed 21 Oct 2026.