When will there be a quantum computer that threatens cryptography?

This question comes up naturally after every article announcing a new “revolutionary” quantum computing experiment, and every time a YouTuber voices skepticism about the technology.

I don't want to waste your time, so here is the short answer. The authorities have set migration deadlines that say what they believe: NIST (in the US) deprecates today's cryptographic algorithms after 2030 and disallows them after 2035, and the European Commission recommends the same dates to member states. So I would think of a time horizon between the completion of the Sibiu–Pitești motorway and the opening of the Cluj metro — two long-awaited Romanian infrastructure projects. Honestly, I would be surprised to ride that metro under the statue of Matthias Corvinus in Cluj while still using today's cryptographic protocols undisturbed.

In what follows, I want to describe as clearly as possible where quantum computers stand and which engineering barriers still have to be overcome, so that you can form an informed opinion.

The target for attacking RSA

In 1994, Peter Shor published a paper containing an algorithm with two applications: factoring large numbers and solving the discrete logarithm problem. Much of today's cryptography rests on these two problems, which are considered hard to solve with classical computers.

RSA — now used mainly for electronic signatures (certificates, JWTs and so on) — relies on the difficulty of factoring. We generally use RSA-2048, meaning a 2048-bit key.

Elliptic-curve algorithms rely on the discrete logarithm problem: ECDSA for signatures and ECDH for key exchange (when HTTPS connections are set up). They are leaner, using 256-bit keys.

Data on disk is generally encrypted with symmetric keys. Shor's algorithm poses no risk to them, so they are considered largely safe.

If we take the key lengths we want to break and add some auxiliary working space, the conclusion is that we need a few thousand qubits. The order of magnitude is thousands. But there is something important to keep in mind. Shor designed these algorithms with nothing but a sheet of paper in front of him, without access to a physical machine. So he used the concept of an ideal qubit, which models quantum information perfectly. In reality, quantum information is very fragile, and the physical qubits in today's quantum computers have high error rates — both errors at rest (they simply lose the stored information) and operation errors (operations performed on them don't always give the expected result). That is why we need error-correcting codes. These spread the information out and build one logical qubit from a set of physical qubits. We are talking about hundreds or even a thousand physical qubits for a single logical qubit of the kind Shor imagined in 1994.

From here on, to avoid confusion, when I simply say “qubits” I mean physical ones; I will always name logical qubits explicitly. I will call operations on qubits gates, by analogy with the logic gates of classical Boolean circuits.

Not all qubits are equal

A qubit is any “system” that can hold a superposition of two basis states, interfere and produce entanglement. Just as a classical bit can be implemented in several ways (a transistor switched on or off, a region of a disk magnetized or not, and so on), a qubit can also be built in several ways. Each technology has advantages and drawbacks. I will mention some of them.

Superconducting qubits are electrical circuits cooled to a few thousandths of a degree above absolute zero. This is the technology favored by the tech giants, IBM and Google. Their main advantage is speed: a relevant set of operations, such as an error-correction cycle, takes under a microsecond. The major drawback is that they all have to be laid out in the same plane, so each qubit can only operate with its neighbors (at most four, when arranged in a grid). Most of the specialist literature is about them, and the most advanced error-correcting codes are built around qubits laid out in a plane. Their error rate is on the order of 10⁻³, and the largest chips today have a few hundred qubits of this kind.

Trapped ions are individual, electrically charged atoms suspended in a vacuum by oscillating electric fields. This is where we find the most advanced companies dedicated entirely to quantum: IonQ and Quantinuum. The main advantages are that any qubit can interact with any other, and that their error rate is lower, with published records approaching 10⁻⁴. They are usually arranged in a line or a ring, and to perform an operation between two ions, the ions have to be physically moved next to each other. Which brings us to the main drawback: every operation takes longer — an error-correction cycle takes on the order of a millisecond. Here we are talking about chips with fewer than a hundred qubits.

Neutral atoms in laser traps (developed by companies such as QuEra and Pasqal) deserve a mention because they are the approach that has scaled most spectacularly in recent years. Their advantages and drawbacks are similar to those of ions, with the added benefit that many atoms can be moved at the same time, which gives a flexibility that fixed chips don't have.

There are other technologies too, such as spins in silicon (Diraq, Intel and Equal1, which has an office in Timișoara), Majorana qubits (Microsoft) and photonic qubits (Xanadu). The latter work differently, based on measurements, because photons cannot be stored.

Which differences matter for cryptography? One is the error rate, which determines how many physical qubits we need per logical qubit. Then connectivity, which determines which error-correcting code we can use. Finally, operation time. The first two criteria favor ions and neutral atoms, but they run three orders of magnitude slower than superconducting qubits. For this reason, some people split the technologies into fast (superconducting, spins in silicon, photonic) and slow (ions, neutral atoms).

Progress in theory

I have talked about hardware, but the big progress has been in theory. Over recent years, different groups have improved the way Shor's algorithm is implemented.

For RSA-2048, the estimate in 2012 was on the order of one billion physical qubits. In 2019, Craig Gidney and Martin Ekerå brought it down to 20 million, with a run time of eight hours. In 2025, Gidney published an estimate of under one million qubits, running in less than a week.

For 256-bit elliptic curves, the estimate in 2023 was nine million. In 2026, a Google team reduced the requirement to about half a million, with a run time on the order of minutes — fast enough to attack a bitcoin transaction in real time.

A thousand times fewer in thirteen years. Without any quantum computer getting better. Just people thinking more cleverly.

The gap is closing

The chart shows the two trends. The vertical axis is the number of qubits, on a logarithmic scale; the horizontal axis covers the last fourteen years. The top line is the academic estimate: how many physical qubits it would take to break RSA-2048. The bottom line is industrial reality: the largest superconducting processor released each year.

The gap between them is several orders of magnitude, but we can see it closing.

Of the theoretical estimates, I kept only the well-founded ones, with assumptions that have been demonstrated experimentally or are well studied: superconducting qubits only (to match the hardware line), laid out in a grid (nearest-neighbor), using demonstrated error-correcting codes (the surface code). I left out two recent papers that are nonetheless worth mentioning. The Pinnacle architecture (Webster et al., Iceberg Quantum, 2026) brings the requirement for RSA below 100,000 qubits with a one-month run, but uses a code that needs long-range connectivity. And a group from Harvard and Caltech (Cain et al., 2026) shows that on neutral atoms, again for RSA, 13,000 qubits would be enough — but the run would take a thousand days.

As for hardware, the line rose until 2023 — 1,121 qubits on IBM's Condor processor — and has been falling since. Not because the industry backed off, but because it changed the criterion. It turned out that a chip with a thousand mediocre qubits is no closer to a useful computer than one with a hundred and fifty very good ones. Manufacturers moved from quantity to fidelity and connectivity.

So: the top line is falling fast, and the bottom line is deliberately flat. That doesn't mean the two are about to meet. It means that, for now, the engine of progress is mathematics, not hardware.

What remains to be solved

Three problems stand between today's demonstrations and a machine that breaks RSA.

First: the error threshold. Error correction only works if the physical qubits are already good enough. Below a certain error threshold, adding qubits improves the result; above it, adding qubits makes things worse — you correct more slowly than the errors appear. Operating below the threshold was only demonstrated in December 2024, by Google, with the Willow processor: 101 physical qubits for a single logical qubit, with the error rate halving at each increase in code size. It is a fundamental result, but for a single logical qubit.

Second: T gates. Surface codes provide only a limited set of operations “for free”, which is not enough for a useful computation. The rest — in particular T gates — are obtained by consuming special states called magic states, produced through a process called distillation. Shor's algorithm needs tens of millions of these operations for elliptic curves and billions for RSA-2048. In the proposed architectures, a large part of the processor's surface computes nothing: it is a magic-state factory feeding the rest. The good news is that in 2025, distillation was fully demonstrated experimentally at the logical level, on neutral atoms, by a QuEra–Harvard–MIT team.

Third: interaction between logical qubits. Two logical qubits don't “touch” directly. The code patches that represent them are merged and split on the surface of the chip, using a technique called lattice surgery. This needs free space for routing, an orderly geometry and a classical decoder that processes measurements in real time, every microsecond. The classical side of the problem is far from trivial.

Where we stand experimentally

The record of the last two years is substantial — and easy to overstate.

Below-threshold operation has been demonstrated on superconducting qubits. Magic-state distillation has been demonstrated at the logical level. Dozens of logical qubits have been operated at once — 96 logical qubits on 448 atoms at QuEra, and 48 logical qubits from 98 physical ones on Quantinuum's Helios system (trapped ions), with error rates ten to a hundred times better than those of the physical qubits. IBM has announced a move from surface codes to qLDPC codes, which promise up to a 90% reduction in the number of physical qubits needed, and is targeting a system with 200 logical qubits around 2029.

What has not been demonstrated: any of this at the scale and for the duration Shor's algorithm requires. An algorithm that breaks RSA-2048 means thousands of logical qubits working correctly for days on end, a magic-state factory producing continuously, decoders that don't fall behind, and a defect rate that doesn't grow as the system grows. Each component has been validated separately, at small scale. They have not yet been put together.

What this means

A cryptographically relevant quantum computer arrives when error correction works at scale, when T gates become cheap and when the machine can keep running for days. Each of these problems has a proof of principle today, and none has been demonstrated at scale.

How long it will take, nobody can say precisely. What can be said is that both curves in the chart were moving slowly five years ago and are visibly moving now.

Meanwhile, an uncomfortable asymmetry remains. TLS sessions negotiated today contain, in the clear for anyone who stores them, exactly the key-exchange part that Shor's algorithm solves. The machine that will open them doesn't need to exist now. It only needs to exist one day.