Can quantum computers break RSA-2048?
No. As of 2026, no quantum computer has factored anything larger than toy numbers like 15 and 21, and breaking RSA-2048 would take roughly a million physical qubits running error correction running for days — about a thousand times more qubits than today's best machines, at error rates they have not yet reached. The theory has been settled since Shor's 1994 algorithm, and resource estimates keep falling, which is why NIST published replacement algorithms in August 2024.
Yes — established 1994 Shor's algorithm reduces factoring to finding the period of a^x mod N, which a quantum computer solves efficiently using the quantum Fourier transform. Interference cancels the amplitudes of measurement outcomes inconsistent with the true period and reinforces the consistent ones. This is a mathematical result about an idealised machine; it says nothing about when such a machine will exist.
Yes, but only for toy numbers: 15 and 21 These demonstrations used heavily compiled circuits that exploit prior knowledge of the answer, so they validate the physics of period-finding rather than any real attack. In 25 years the record has moved from a 4-bit number to a 5-bit number; RSA-2048 is a 2048-bit number. There has been no demonstrated progress toward cryptographically relevant sizes.
Feasible on paper with 20 million noisy qubits running for 8 hours (2019 estimate) Gidney and Ekera's 2019 estimate cut the space-time cost of factoring RSA-2048 by roughly 100x versus earlier estimates, by combining better arithmetic, windowing, and lattice surgery. It is a costed engineering blueprint for a machine nobody can build, under explicit physical assumptions — useful as a benchmark, not a schedule.
Feasible on paper with under 1 million noisy qubits running for under a week (2025 estimate) Gidney's 2025 update cut the 2019 qubit requirement by ~20x using approximate residue arithmetic, yoked surface codes for idle storage, and magic state cultivation. The significant fact is the trend: the estimated cost of the attack has fallen by orders of magnitude in six years through algorithmic improvements alone, with no hardware breakthrough required.
No — the demonstrated state of the art is one good logical qubit Willow was the first demonstration that error correction actually improves as you add qubits — a genuine milestone, and still roughly three orders of magnitude in qubit count and many orders of magnitude in sustained operations away from any RSA-relevant computation. No machine in 2026 can run Shor's algorithm on anything beyond toy inputs.
IBM targets a fault-tolerant machine by 2029 — still well short of RSA-breaking scale Even taken at face value, Starling's 100 million operations is orders of magnitude below the billions of Toffoli gates that current RSA-2048 estimates require, and Blue Jay would still fall short on operation count. Roadmaps are plans, not demonstrations — several past quantum roadmaps have slipped — but this is the first generation of roadmaps aimed squarely at fault tolerance rather than raw qubit counts.
Why does Shor's algorithm threaten RSA at all?
RSA is secure because multiplying two large primes is easy but recovering them from the product is slow. The best classical algorithm (the general number field sieve) runs in subexponential time — add bits to the key and the attack cost explodes. RSA-2048 is comfortably out of classical reach.
Shor's algorithm changes the mathematics, not the engineering. It reduces factoring to finding the period of the function a^x mod N, and a quantum computer finds periods efficiently. The circuit prepares a superposition over exponents, computes the modular exponential, then applies the quantum Fourier transform. The QFT arranges the amplitudes so that outcomes inconsistent with the true period cancel and consistent ones reinforce — you measure once and get period information with good probability. No state "tries every factor at once"; interference concentrates probability on the answer.
The result is polynomial scaling — roughly cubic in the key size. Against that, adding bits to RSA barely helps: the asymmetry that protects RSA classically disappears. That is why the question is only about hardware, and has been since 1994.
How far away is a machine that could actually do it?
The two most cited engineering estimates both come with explicit assumptions (0.1% gate error, 1 microsecond error-correction cycle, nearest-neighbour connectivity):
- 2019 (Gidney–Ekera): ~20 million physical qubits, 8 hours — Quantum 5, 433
- 2025 (Gidney): under 1 million physical qubits, under a week — arXiv:2505.15917
Note both numbers count physical qubits doing error correction, noisy physical qubits assumed at 0.1% error — better than most spec-sheet qubits today — so the counts are not directly comparable to vendor qubit counts, which are not directly comparable. Today's largest processors have on the order of a thousand physical qubits, and the best demonstrated error-corrected object is a single logical qubit. The gap is roughly a factor of 1,000 in qubit count, plus sustained fault-tolerant operation for days, plus real-time classical decoding at scale — none of which has been demonstrated.
What would change the answer: error rates falling well below 0.1% across million-qubit devices, or codes (like IBM's qLDPC approach) cutting the overhead dramatically, or further algorithmic improvements. The 20x drop in estimated cost between 2019 and 2025 came entirely from better algorithms — that trend is the strongest argument for taking the threat seriously on a 10-15 year horizon rather than dismissing it.
What has actually been demonstrated on real machines?
The complete list of factoring milestones is short: 15 was factored on a 7-qubit NMR machine in 2001, and 21 in 2012. Both used compiled circuits that bake in knowledge of the answer — they confirm the physics, not the attack. Claims of factoring larger numbers with quantum annealers or variational methods do not use Shor's algorithm and do not scale.
The genuinely important hardware result is different: Google's Willow chip showed in December 2024 that logical error rates fall exponentially as the error-correcting code grows. That is the property every resource estimate assumes. One below-threshold logical qubit is not an attack on anything — but it is the first rung of the ladder the estimates describe. Compare current devices on the QPU index and side by side, or run a toy period-finding circuit yourself in the lab.
Should you do anything about it now?
Yes, for one specific reason: harvest now, decrypt later. Encrypted traffic recorded today can be decrypted by whatever machine exists in 2035 or 2040. If your data must stay confidential that long — health records, state secrets, key escrow — the migration clock started years ago.
The defence, unlike the attack, is practical today. NIST finalised three post-quantum standards in August 2024: FIPS 203 (ML-KEM) for key exchange, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. NIST's draft transition guidance (IR 8547) deprecates RSA-2048 after 2030 and disallows it after 2035. Hybrid post-quantum key exchange already ships in mainstream TLS stacks.
So the honest summary: nobody can break RSA-2048 today, no roadmap machine gets there before 2030, and you should migrate anyway — because migrations take a decade and recorded ciphertext is patient. See also the Bitcoin question and whether AES is affected (it mostly is not).
Classifications follow the QPU137 editorial policy: every applied label carries a date, source, scale, and hardware, or it does not render. Found an error? Report it.