How Many Qubits To Break RSA-2048? A Dated History Of Estimates

The size of the quantum computer needed to break RSA has been estimated very differently over the past fourteen years. Each answer is a resource estimate: a detailed blueprint for running Shor’s algorithm on a hypothetical machine with stated error rates and speeds. None describes hardware that exists. Together they show a clear downward trend.

This article lists the main published estimates for RSA-2048 in date order, with the assumptions that make each one comparable or not. It is current as of October 2026; the field moves quickly, so check the dates. Background on logical and physical qubits is in Inside Shor’s Algorithm.

The Estimates In Order

2012. In an introduction to surface code quantum computing, Fowler, Mariantoni, Martinis and Cleland estimated that factoring a 2000-bit number would take about a billion physical qubits running for about a day, at a physical error rate of 0.1 percent. Most of those qubits were needed to prepare the special states that power the expensive gates.¹

2019. Gidney and Ekerå estimated that RSA-2048 could be factored in about eight hours with 20 million noisy qubits. They assumed a planar grid of superconducting qubits with nearest-neighbour connections, a 0.1 percent gate error and a one microsecond surface code cycle.²

2025. Gidney cut the qubit count about twentyfold, to under one million noisy qubits, at the cost of a longer run of under a week. He kept the 2019 assumptions: 0.1 percent gate error, a one microsecond cycle and a 10 microsecond control system reaction time.³ The savings came from an approximate form of modular arithmetic, denser storage of idle qubits using yoked surface codes, and a cheaper way to prepare magic states, the special resource states that the expensive gates consume. The paper’s cost table gives 1,399 logical qubits and about 6.5 billion Toffoli gates; counting idle working patches, the physical layout holds fewer than 1,600 logical qubits.³

2026, quantum LDPC codes. Webster and colleagues’ Pinnacle architecture, first posted in February 2026 and revised in May, estimates RSA-2048 can be factored with fewer than 100,000 physical qubits in an expected runtime of about one month, under the same error, cycle and reaction time assumptions. Adding qubits shortens the run: the same paper puts a one-week factoring at about 139,000 physical qubits.⁴ The design uses quantum low-density parity-check (qLDPC) codes, which pack many logical qubits into one code block. The price is that qubits must interact beyond their nearest neighbours, though only over a bounded distance.⁴

2026, neutral atoms. Cain and colleagues, including John Preskill, estimated that an architecture based on reconfigurable neutral atoms could run Shor’s algorithm at cryptographically relevant scale with as few as 10,000 atomic qubits. With 26,000 atoms they put elliptic curve P-256 at a few days, and RSA-2048 at one to two orders of magnitude longer. The authors state that substantial engineering challenges remain.⁵

Reading Estimates Carefully

Estimates are only comparable when their assumptions match, and several numbers trade against each other.

Qubits versus time. The 2025 estimate uses about twenty times fewer qubits than 2019 but runs for days instead of hours. For an attacker decrypting a stored archive, a week per key is no obstacle. For forging a signature during a live transaction it might be.

Logical qubits versus gate count. A Toffoli gate is a three-qubit operation, and it dominates the cost of these circuits, so papers report how many are needed. The 2019 method used roughly 3 billion of them with a little over three logical qubits for every bit of the modulus. A 2024 method by Chevignard, Fouque and Schrottenloher brought the logical qubits down to about half a qubit per bit, but its gate count climbed to around 2 trillion, as Gidney’s 2025 paper points out before landing between the two.³ When a headline quotes a small logical qubit count, check the gate count too, because the gates decide how long the attack runs.

Error rate, speed and connectivity. All the superconducting estimates assume a 0.1 percent physical error rate across a very large device. The qLDPC estimate also assumes interactions between qubits that are not direct neighbours. Neutral atom machines can physically rearrange their qubits, and their estimates come out at fewer qubits but longer runtimes.⁵ Google researchers group neutral atoms and trapped ions as slow-clock architectures, in contrast with fast-clock superconducting and photonic designs.⁶

What The Trend Means For Planning

Two lessons follow. First, the target keeps moving closer through better algorithms and error correction, independent of how fast hardware grows. A plan that assumed the 2019 figure of 20 million qubits already looks optimistic. Second, every estimate depends on stated assumptions about hardware that has not been built, so a single number should never be quoted without its date and conditions.

For key exchange, the trend strengthens the case for acting on harvest now, decrypt later exposure. For elliptic curve cryptography the picture is starker, because recent estimates suggest it is cheaper to break than RSA. That is covered in Elliptic Curves Fall First.