Gidney (2025), surface code at 0.1% gate error. Newer 2026 preprints claim about 100,000 (qLDPC codes) and, for 256-bit elliptic curves, about 26,000 (neutral atoms).
Breaking RSA or elliptic-curve cryptography requires a fault-tolerant quantum computer running Shor's algorithm. How large that machine must be is not a fixed number: it depends on algorithms, error-correcting codes and hardware assumptions, and every few years a new paper cuts the estimate. This tracker collects the published estimates in one place, with the assumptions behind each figure and a link to its source, and is updated whenever a significant new estimate or hardware milestone appears.
Estimates Over Time
Only estimates that state a physical-qubit count are plotted. Runtimes and hardware assumptions differ between rows; see the tables below before comparing two figures.
RSA-2048 Estimates
| Year | Authors | Physical qubits | Logical qubits | Runtime | Assumptions | Status |
|---|---|---|---|---|---|---|
| 2012 | Fowler, Mariantoni, Martinis & ClelandPhys. Rev. A 86, 032324. Estimated for a 2,000-bit number, at an error rate about one-tenth of the surface-code threshold and a 100 ns measurement cycle. | ≈ 1 billion | ≈ 4,000 | ≈ 1 day (26.7 hours) | Surface code, superconducting | Peer-reviewedSource · primary source |
| 2019 | Gidney & EkeråPublished in Quantum 5, 433 (2021). For years the reference planning figure. | 20 million | — | 8 hours | Surface code, 0.1% gate error, 1 µs cycle | Peer-reviewedSource · primary source |
| 2025 | GidneyAbout 6.5 billion Toffoli gates. Savings from approximate residue arithmetic, yoked surface codes and magic state cultivation. | ≈ 898,000 (under 1 million) | ≈ 1,537 | < 1 week (≈ 5 days) | Surface code, same assumptions as 2019 | PreprintSource · primary source |
| 2026 | Webster et al. (Iceberg Quantum)Requires qubit connectivity beyond nearest neighbours, which planar surface-code layouts avoid. | < 100,000 | — | ≈ 1 month | Quantum LDPC codes, 0.1% error, 1 µs cycle | PreprintSource · primary source |
| 2026 | Cain et al. (Oratomic, Caltech, UC Berkeley)Most parallel configuration, which the authors call preliminary. | ≈ 102,000 (fastest configuration) | — | ≈ 97 days; years with ≈ 11,000–13,000 qubits | Reconfigurable neutral atoms, qLDPC codes, 1 ms cycle | PreprintSource · primary source |
256-bit Elliptic-Curve Estimates
Elliptic curves such as X25519, P-256 and Bitcoin's secp256k1 protect most TLS key exchanges, signatures and cryptocurrencies. At comparable classical security they need fewer qubits to attack than RSA. Several papers report only logical qubits, the error-corrected qubits an algorithm uses; turning those into physical qubits depends on the hardware.
| Year | Authors | Physical qubits | Logical qubits | Runtime | Assumptions | Status |
|---|---|---|---|---|---|---|
| 2017 | Roetteler, Naehrig, Svore & LauterASIACRYPT 2017. First detailed circuit costing for elliptic-curve discrete logarithms; showed ECC needs fewer qubits than RSA at comparable security. | — | 2,330 (P-256) | — | Logical circuit (≈ 1.3 × 10¹¹ Toffoli, upper bound) | Peer-reviewedSource · primary source |
| 2020 | Häner, Jaques, Naehrig, Roetteler & SoekenPQCrypto 2020. The 2,124 figure is the baseline cited by later work. | — | 2,124 (P-256) | — | Logical circuit | Peer-reviewedSource · secondary report |
| 2022 | Webber, Elfving, Weidt & HensingerAVS Quantum Science 4, 013801 (2022). Estimates for Bitcoin's secp256k1 curve. | 13 million (1 day); 317 million (1 hour) | 2,871 | 1 day | Surface code, 0.1% error, 1 µs cycle | Peer-reviewedSource · primary source |
| 2026 | Chevignard, Fouque & SchrottenloherEUROCRYPT 2026. Halves the logical-qubit count at the cost of a much higher gate count. | — | 1,193 (P-256) | — | Logical circuit, far more gates | Peer-reviewedSource · primary source |
| 2026 | Babbush et al. (Google Quantum AI)70–90 million Toffoli gates. Attack circuits withheld; claims backed by a zero-knowledge proof. | < 500,000 | < 1,200 to < 1,450 | Minutes | Surface code, 0.1% error, planar connectivity | PreprintSource · primary source |
| 2026 | Cain et al. (Oratomic, Caltech, UC Berkeley)P-256. Uses Google's 2026 circuit compilations. The abstract says “a few days”; the main text gives 10 days. As few as about 10,000 atoms with much longer runtimes. | 26,000 | — | ≈ 10 days | Reconfigurable neutral atoms, 1 ms cycle | PreprintSource · primary source |
Hardware Milestones
Estimates describe machines that do not exist yet. These experiments show how far real hardware has come.
- Dec 2024Google Willow: error correction below threshold. A 105-qubit superconducting chip showed logical errors falling as the surface code grows, the precondition for every estimate above. Source
- Sep 2025Caltech: 6,100-atom qubit array. The largest neutral-atom qubit array reported at the time (Nature 647, 60–67), though not yet used for computation at that scale. Source
- Oct 2026Google Willow: magic state cultivation. First hardware demonstration of the magic-state protocol assumed in Gidney's 2025 RSA estimate: 40× lower error than injection, fidelity 0.9999. Source
📏 How to Read These Numbers
Physical vs. logical qubits. A logical qubit is built from many noisy physical qubits through
error correction. Physical counts are what hardware roadmaps report.
Assumptions matter. Most superconducting estimates assume a 0.1% gate error rate and a 1 µs
error-correction cycle. Neutral-atom estimates assume cycles about a thousand times slower (around 1 ms),
so their runtimes are far longer; their lower qubit counts come from high-rate codes and the long-range
connectivity of movable atoms.
Preprints are not yet reviewed. Several of the newest figures are preprints and are marked as
such.
An estimate is not a date. No published machine is close to these sizes at the required error
rates. For planning, the trend matters more than any single figure: estimates have fallen by about four orders
of magnitude since 2012, while data encrypted today can be stored and decrypted later.
What's New
- Tracker launched with 11 published estimates for RSA-2048 and 256-bit elliptic curves (2012–2026) and three hardware milestones, including Google's October 2026 magic-state cultivation result.
Methodology
We include peer-reviewed papers and widely discussed preprints that give an end-to-end resource estimate for Shor's algorithm against RSA-2048 or a 256-bit elliptic curve. Each figure is taken from the paper's abstract or main text where we could read it; entries marked "secondary report" rely on reputable coverage of the paper and will be upgraded when the primary text is checked. Corrections are welcome via the contact form below.
Download the Data
- 📄 qubit-estimates.csv: every estimate with assumptions, status and source (CC BY 4.0).
How to Cite This Tracker
APA: PostQuantumSecurity.org. (2026–). How many qubits does it take to break RSA and ECC? [Live tracker]. https://www.postquantumsecurity.org/trackers/qubit-estimates.html
Please include the "Last updated" date shown at the top of the page.