How close is quantum computing to breaking today's encryption?

Today's security holds because nobody can build a big enough quantum computer. Researchers keep publishing smaller designs. Each dot below is one of those papers, showing how many qubits it says would be needed. Lower means closer. Click a dot to read the paper's own words.

RSA-20481 million→23,000qubits needed, May 2025 to Oct 2026 (97.7% smaller)256-bit elliptic curve126,133→19,397qubits needed, Feb 2023 to Sep 2026 (84.6% smaller)

RSA-2048

Protects secure websites, software updates and older encrypted email.

Set a new recordOther estimatesBest known so far

27 Oct 2026 · arXiv 2610.37839

Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days

23,000 physical qubits

Runs in about 3.1 days.

What the paper says

factoring RSA-2048, the configuration we compile in full, requires about 23 000 cat qubits and 3.14 days.

Read the paper

27 Oct 2026 · arXiv 2610.37839

Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days

611,000 physical qubits

Runs in about 1.25 hours.

What the paper says

Trading space for time, RSA-2048 runs in 1.25 hours on about 611 000 cat qubits.

Read the paper

27 Oct 2026 · arXiv 2610.37839

Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days

45,000 physical qubits

What the paper says

The no-bit-flip requirement (a bit-flip time of about 100 years) can be relaxed to a bit-flip time of about one hour by adding a concatenation layer with a distance-3 bit-flip code, in which case RSA-2048 needs about 45 000 cat qubits.

Read the paper

7 Apr 2026 · arXiv 2604.06319

Heterogeneous architectures enable a 138x reduction in physical qubit requirements for fault-tolerant quantum computing under detailed accounting

381,000 physical qubits

Runs in about 9.2 days.

What the paper says

We then consider the factorization of 2048-bit RSA-integers; using an experimentally demonstrated grid-coupling topology, factoring RSA-2048 requires 381k physical qubits and 9.2 days, which can be reduced to 4.9 days via addition of an algorithm-specific accelerator for the Adder subroutine (requiring 439k qubits).

Read the paper

21 May 2025 · arXiv 2505.15917

How to factor 2048 bit RSA integers with less than a million noisy qubits

1 million physical qubits

Runs in about 7 days.

What the paper says

I estimate that a 2048 bit RSA integer could be factored in less than a week by a quantum computer with less than a million noisy qubits.

Read the paper

256-bit elliptic curve

Signs Bitcoin and Ethereum transactions. Also used by secure web connections, SSH, Signal and WireGuard.

Set a new recordOther estimatesBest known so far

27 Oct 2026 · arXiv 2610.37839

Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days

30,000 physical qubits

Runs in about 1 hour.

What the paper says

Reusing the compiled operations, solving ECDLP on secp256k1 requires at most 30 000 cat qubits and 1 hour

Read the paper

4 Sep 2026 · arXiv 2609.05625

Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits

19,397 physical qubits

Runs in about 25.7 days.

What the paper says

All results and optimizations combined, we conclude that a trapped-ion quantum computer based on our architecture can solve the ECDLP on secp256k1 in approximately 25.7 days using 19,397 physical qubits with an estimated success probability of 63%.

Read the paper

13 Feb 2023 · arXiv 2302.06639

Performance Analysis of a Repetition Cat Code Architecture: Computing 256-bit Elliptic Curve Logarithm in 9 Hours with 126133 Cat Qubits

126,133 physical qubits

Runs in about 9 hours.

What the paper says

Assuming a ratio between single- and two-photon losses of 1e-5 and a cycle time of 500 ns, we show concretely that such an architecture can compute a 256-bit elliptic curve logarithm in 9 h with 126133 cat qubits and on average 19 photons by cat state.

Read the paper

How to read this

Qubit: The basic unit of a quantum computer, like a bit in an ordinary one. Breaking encryption takes many of them working together.
Physical vs. error-corrected: A physical qubit is one real piece of hardware. Error-corrected (logical) qubits are built from many physical ones, so they are not comparable with the charted numbers.
Not a countdown: This shows how big a machine would have to be. It does not yet track how big machines are today, so it cannot say when. Each paper assumes its own kind of hardware, so look at the trend and not at exact comparisons.

Found but not confirmed (2)

These never change the charts. They are listed so nothing is hidden.

Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition would move a date but second model disagrees or failed
Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition would move a date but second model disagrees or failed