Can quantum computers break RSA-2048?
No. As of 2026, no quantum computer has factored anything bigger than toy numbers like 15 and 21. Breaking RSA-2048 would take roughly a million physical qubits running error correction for days. That is about a thousand times more qubits than today's best machines, at error rates they have not yet reached. The theory has been settled since Shor's 1994 algorithm, and cost estimates keep falling, which is why NIST published replacement algorithms in August 2024.
Yes — established 1994 Shor's algorithm turns factoring into finding the period of a^x mod N, which is how often its values repeat. A quantum computer solves that efficiently using the quantum Fourier transform. Interference cancels the amplitudes of results that don't fit the true period and boosts the ones that do. This is a math result about an ideal machine. It says nothing about when such a machine will exist.
Yes, but only for toy numbers: 15 and 21 These demonstrations used heavily compiled circuits that build in knowledge of the answer. So they check the physics of period-finding, not a real attack. In 25 years the record has moved from a 4-bit number to a 5-bit number. RSA-2048 is a 2048-bit number. There has been no shown progress toward sizes that matter for cryptography.
Feasible on paper with 20 million noisy qubits running for 8 hours (2019 estimate) Gidney and Ekera's 2019 estimate cut the space-time cost of factoring RSA-2048 by about 100x compared with earlier estimates. They combined better arithmetic, windowing (handling several bits at once) and lattice surgery (a way to link logical qubits). It is a costed engineering blueprint for a machine nobody can build, under clearly stated physical assumptions. It is useful as a benchmark, not a schedule.
Feasible on paper with under 1 million noisy qubits running for under a week (2025 estimate) Gidney's 2025 update cut the 2019 qubit need by about 20x. It used approximate residue arithmetic, 'yoked' surface codes for cheaper storage of idle qubits, and magic state cultivation (a cheaper way to make special states that some gates need). The key fact is the trend. The estimated cost of the attack has fallen by orders of magnitude in six years, from better algorithms alone, with no hardware breakthrough needed.
No — the demonstrated state of the art is one good logical qubit Willow was the first demonstration that error correction actually improves as you add qubits. That is a real milestone. It is still about three orders of magnitude (1,000 times) short in qubit count, and many orders of magnitude short in sustained operations, of any RSA-relevant computation. No machine in 2026 can run Shor's algorithm on anything beyond toy inputs.
IBM targets a fault-tolerant machine by 2029 — still well short of RSA-breaking scale Take Starling at face value. Its 100 million operations are still orders of magnitude below the billions of Toffoli gates that current RSA-2048 estimates need. Blue Jay would still fall short on operation count. Roadmaps are plans, not demonstrations, and several past quantum roadmaps have slipped. But this is the first generation of roadmaps aimed squarely at fault tolerance rather than raw qubit counts.
Why does Shor's algorithm threaten RSA at all?
Why care? RSA protects a lot of the internet. It helps your browser set up secure connections and checks digital signatures. If it broke, secrets sent today could be read later.
RSA rests on a simple fact. Multiplying two big prime numbers is easy. A prime can only be divided evenly by 1 and itself, like 3, 5 or 7. But going backward, finding the two primes from their product, is very slow. This backward job is called factoring. Try it small. 3 × 5 = 15 is instant. But which two primes multiply to 391? You have to hunt. (The answer is 17 × 23.) RSA-2048 uses a product about 617 digits long.
The best classical method, the general number field sieve, runs in subexponential time. That means its cost still explodes as keys get longer, just not quite as fast as doubling with every extra bit. RSA-2048 is comfortably out of classical reach.
Shor's algorithm changes the math, not the engineering. It turns factoring into finding the period of the function a^x mod N. A period is how often a pattern repeats. "mod N" means the remainder after dividing by N, like hours wrapping around a clock face.
Here is a worked example with N = 15 and a = 2. The powers of 2 are 2, 4, 8, 16, 32 and so on. Their remainders after dividing by 15 are 2, 4, 8, 1, 2, 4, 8, 1. The pattern repeats every 4 steps, so the period is 4. Now take 2^(4/2) = 2^2 = 4. Then 4 − 1 = 3 and 4 + 1 = 5. Those are exactly the factors of 15.
A quantum computer finds periods efficiently. The circuit first sets up a superposition over many exponents x. That is a state holding amplitudes for all of them. An amplitude is a number that says how strongly the machine leans toward each result. Next the circuit computes a^x mod N. Then it applies the quantum Fourier transform (QFT). The QFT arranges the amplitudes so that results that don't fit the true period cancel out, and results that fit add up. It works a bit like noise-cancelling headphones, where waves that are out of step cancel. Unlike headphones, nothing here is sound. The "waves" are amplitudes in the math. You measure once and get period information with good probability. No state "tries every factor at once". Interference piles probability onto the answer.
The result is polynomial scaling, roughly cubic in the key size. Cubic means doubling the key length makes the work about 2 × 2 × 2 = 8 times bigger. Against that, adding bits to RSA barely helps. The gap that protects RSA from ordinary computers disappears. That is why the question is only about hardware, and has been since 1994.
How far away is a machine that could actually do it?
The two most cited engineering estimates both state their assumptions clearly. They assume 0.1% gate error, a 1-microsecond error-correction cycle, and qubits wired only to their neighbours.
- 2019 (Gidney–Ekera): about 20 million physical qubits, 8 hours — Quantum 5, 433
- 2025 (Gidney): under 1 million physical qubits, under a week — arXiv:2505.15917
Both numbers count physical qubits, the real hardware parts, all busy running error correction. Groups of them act as logical qubits, reliable qubits built from many error-prone ones. Both estimates also assume physical qubits with 0.1% error, which is 1 mistake per 1,000 operations. That is better than most spec-sheet qubits today. So these counts are not directly comparable to the qubit counts vendors advertise.
Now compare. Today's largest processors have about a thousand physical qubits. The best shown error-corrected object is a single logical qubit. Work the gap: 1,000,000 ÷ 1,000 = 1,000. So the gap is roughly 1,000 times in qubit count. Add days of nonstop fault-tolerant running, plus real-time classical decoding at scale. None of that has been shown.
What would change the answer? Error rates falling well below 0.1% across million-qubit devices. Or codes, like IBM's qLDPC approach, cutting the overhead sharply. Or more algorithm improvements. Do the arithmetic on the trend: 20 million ÷ 1 million = 20. So the estimated cost fell about 20 times between 2019 and 2025, entirely from better algorithms. That trend is the strongest reason to take the threat seriously on a 10-15 year horizon rather than dismissing it.
What has actually been demonstrated on real machines?
The complete list of factoring milestones is short. 15 was factored on a 7-qubit NMR machine in 2001. 21 followed in 2012. Both used compiled circuits that build in knowledge of the answer. They confirm the physics, not the attack. It is like a magic trick rehearsed with a card you already know. Claims of factoring larger numbers with quantum annealers or variational methods do not use Shor's algorithm, and they do not scale.
The truly important hardware result is different. In December 2024, Google's Willow chip showed that logical error rates fall exponentially as the error-correcting code grows. That is the property every cost estimate assumes. A logical qubit like this is called below-threshold: its errors shrink as its code grows. One of them is not an attack on anything. But it is the first rung of the ladder the estimates describe. Compare current devices on the QPU index and side by side, or run a toy period-finding circuit yourself in the lab.
Should you do anything about it now?
Yes, for one specific reason: harvest now, decrypt later. Someone can record encrypted traffic today and store it. Whatever machine exists in 2035 or 2040 could then unlock it. It is like stealing a locked diary and waiting years for a key. If your data must stay secret that long, the clock to upgrade started years ago. Think of health records, state secrets and key escrow.
The defence, unlike the attack, is practical today. In August 2024, NIST finalised three post-quantum standards, built to resist quantum attacks:
- FIPS 203 (ML-KEM) for key exchange.
- FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures.
NIST's draft transition guidance (IR 8547) deprecates RSA-2048 after 2030 and disallows it after 2035. Hybrid post-quantum key exchange, which mixes old and new methods, already ships in mainstream TLS software.
So the honest summary: nobody can break RSA-2048 today, and no roadmap machine gets there before 2030. You should migrate anyway, because migrations take a decade and recorded messages can wait. See also the Bitcoin question and whether AES is affected (it mostly is not).
Classifications follow the QPU137 editorial policy: every applied label carries a date, source, scale, and hardware, or it does not render. Found an error? Report it.