How Many Qubits Would It Take to Break RSA-2048? A Look at the Numbers

[Cipher31]

This forum takes its name from Q-Day, so it seems right to dig into the single number at the heart of it. How big would a quantum computer need to be to break RSA-2048, the encryption that has protected much of the internet for decades? The answer has changed a lot over the past fifteen years, and the way it has changed tells us a great deal about how quantum computing progresses. The good news is that the same research which brings the threat closer also gives everyone a clearer timetable to prepare

The story starts in 1994, when Peter Shor showed that a quantum computer could factor large numbers exponentially faster than any known classical method. RSA security depends on factoring being hard, so Shor's algorithm turned an abstract idea into a concrete risk. For years, though, nobody knew how practical it would be. Early estimates in the 2010s suggested that breaking RSA-2048 might need around a billion physical qubits once the overhead of error correction was included. Against machines with a handful of qubits, that felt like science fiction

Then the estimates started falling. In 2019, Craig Gidney and Martin Ekerå published a detailed design suggesting about 20 million noisy qubits could factor RSA-2048 in roughly eight hours. That was a fifty fold drop, achieved through smarter arithmetic and better use of error correction rather than any change in hardware. In May 2025, Gidney went further. His paper on arXiv estimated that RSA-2048 could be factored in under a week with fewer than one million noisy qubits

The assumptions behind that latest figure matter. Gidney's design assumes physical qubits with an error rate of around 0.1%, a surface code cycle of about one microsecond and control systems that can react within roughly ten microseconds. It uses newer techniques such as approximate residue arithmetic, more compact ways of storing idle logical qubits and a cheaper method of producing the special magic states that fault tolerant algorithms need. The trade off is time, as the calculation runs for days rather than hours. But a week is nothing when the prize is a key that protects years of secrets

Where does today's hardware stand against that target? The largest machines now have somewhere around a thousand physical qubits, with Atom Computing passing 1,200 and IBM having built chips of a similar size. Error rates on the best systems are approaching or beating the 0.1% level for some operations, but not consistently across large devices. Logical qubits, the error corrected building blocks that algorithms run on, are only just being demonstrated in small numbers. So we are roughly three orders of magnitude short on scale, and still working on reliability

Elliptic curve cryptography, used in Bitcoin and much of modern web security, is an important side note. Estimates suggest it needs fewer logical qubits to break than RSA-2048, which is why some researchers think curves could fall first. That is one reason the cryptocurrency community has become so focused on proposals like BIP 360, which we discussed in our Bitcoin and quantum list. The underlying lesson is the same for both systems. Any encryption based on factoring or discrete logarithms has a clear expiry date, even if nobody knows exactly when it is

It is also worth remembering that the falling estimates are a sign of a healthy field. Every reduction came from people publishing their methods openly, inviting others to check and improve them. That openness is exactly what lets governments and companies plan sensibly. NIST finalised its first post quantum standards in 2024, and the UK's National Cyber Security Centre has set a target of completing migration by 2035. Those dates were chosen with these estimates in mind

There is a lot of room for optimism here. The replacement algorithms, ML-KEM for key exchange and ML-DSA for signatures, already exist and are being rolled out. Major browsers, messaging apps and cloud providers have switched on post quantum key exchange for billions of connections, often without users noticing. Organisations that start their inventories now have years to migrate calmly rather than in a panic. If the estimate keeps falling, the world will not be caught off guard, because the warning has already been given

My own reading is that a machine capable of breaking RSA-2048 is unlikely to exist before the early 2030s, and could easily take longer. But the trend matters more than any single prediction. Each new paper has moved the target closer, and hardware is improving steadily rather than stalling. The sensible response is not fear but preparation, especially for data that needs to stay secret for ten years or more

It also helps to understand why error correction dominates the count. A logical qubit, the reliable unit an algorithm uses, is built from many noisy physical qubits working together to spot and fix errors. In surface code designs, that can mean hundreds or even a thousand physical qubits for every logical one. Shor's algorithm on RSA-2048 needs a few thousand logical qubits plus extra machinery for special operations. So most of the million physical qubits in Gidney's estimate are there to keep the calculation honest, not to do the arithmetic itself

That points to the most promising lever for the future. If physical error rates fall further, each logical qubit needs fewer physical ones, and the total shrinks again. New codes, such as the qLDPC families IBM and others are exploring, could also cut overheads significantly. Better hardware and better theory multiply together. That is why many researchers expect estimates to keep drifting downwards, even if nobody can say exactly where they will settle

So, over to you. How many qubits do you think it will finally take, and when do you expect the first credible attempt? Does the steady fall in estimates make you more worried or more confident that we will be ready in time? And which systems do you think will be hardest to migrate before Q-Day arrives?

How to factor 2048 bit RSA integers with less than a million noisy qubitsarxiv.org

[UniversalBarry38]

The assumptions section deserves more attention than it gets. A 0.1% error rate sounds achievable because some machines already hit it for certain operations, but doing that consistently across a million qubits is a completely different challenge. Reaction times of ten microseconds also require classical control electronics that are fast, reliable and closely integrated

Then there is the sheer engineering of wiring, cooling and housing a million qubits. None of that is impossible, and companies are working on every piece. But each assumption is a small mountain to climb. I think people sometimes read the headline figure and forget how much is packed into it. Still, the progress on each of those mountains has been steady

Control electronics in particular have improved enormously in the last five years. I would not bet against the engineers

[GhostRider]

My guess would be somewhere between 2032 and 2036 for the first credible demonstration on RSA-2048, assuming steady progress. The hardware roadmaps from IBM, Google and others point to fault tolerant machines around the end of this decade, but early ones will be far smaller than a million qubits. Scaling up from there takes time and money

That is roughly in line with the NCSC's 2035 deadline, which feels about right to me. Close enough to take seriously, far enough away to migrate properly if we start now

Guesses like this are always uncertain, of course. That is exactly why the sensible plan is to migrate early and not rely on any single prediction