Key takeaways
- 1No quantum computer today can break RSA or elliptic-curve cryptography at real key sizes.
- 2The estimated size of the machine needed has fallen roughly two hundredfold in seven years, from about 20 million noisy qubits in 2019 to proposals near 100,000 in 2026.
- 3Hardware roadmaps from IBM, Google and others aim at fault-tolerant machines around the end of this decade. Planning should assume the 2030s, not the 2040s.
Where the hardware is
Today's machines have from around a hundred to a few thousand physical qubits, and the hard problem is errors, not count. Recent milestones are about error correction: Google's Willow chip (December 2024) showed logical error rates falling as more qubits were added, and IBM's roadmap targets a fault-tolerant machine, Starling, with around 200 logical qubits by 2029. Quantinuum, IonQ, neutral-atom companies and others publish similar roadmaps.
How the estimates have moved
Breaking RSA-2048 needs a few thousand error-corrected logical qubits running for hours to days. How many physical qubits that takes depends on error rates and architecture, and the estimates keep falling.
- 2019: Gidney and Ekerå estimate about 20 million noisy qubits running for about eight hours.
- 2025: Gidney revises this to under one million noisy qubits running for under a week.
- 2026: preprints propose architectures needing around 100,000 physical qubits, trading qubits for longer run times. These are not yet peer reviewed.
- Elliptic-curve cryptography (ECDSA, ECDH) is generally estimated to need fewer resources than RSA at comparable security, so it should not be treated as the safer classical option.
Why the date matters less than you think
Nobody can give you Q-Day. What you can know is how long your data must stay secret and how long your migration will take. If those add up to more than about ten years, you are already inside the window for harvest-now, decrypt-later attacks, whichever forecast proves right.
There is also an asymmetry: if you migrate early and the machine is late, you have spent money on better cryptography you needed anyway. If you migrate late and the machine is early, the data is gone.
Sources
- Gidney and Ekerå (2019): How to factor 2048-bit RSA integers in 8 hours (opens in a new tab)
- Gidney (2025): How to factor 2048-bit RSA integers with less than a million noisy qubits (opens in a new tab)
- Global Risk Institute: Quantum threat timeline report (opens in a new tab)
- IBM: Quantum roadmap (opens in a new tab)
General information, not legal or regulatory advice. Standards and deadlines move; check the primary source before relying on a date.