How many qubits does it take to break RSA-2048?

State as of: September 2, 2026. The short answer is that there is no fixed answer — and that fact is the story. Every few years someone publishes a better engineering blueprint for the machine that would run Shor's algorithm against a 2048-bit RSA key, and every blueprint needs fewer qubits than the last. The machine itself still does not exist, at any of the estimated sizes. This post reads the curve: what each estimate actually says, what is doing the cutting, what has actually been measured on hardware, and why a machine that does not exist already sets real deadlines.

What does Shor's algorithm actually require?

In the textbook accounting, Shor's algorithm on a 2048-bit modulus needs on the order of a few thousand logical qubits — the famous "4,099 qubits" figure comes from a 2n+3 logical-qubit circuit layout, and it is the most misread number in quantum computing (PostQuantum's explainer on the myth is linked below). Logical qubits are not the qubits vendors announce. A logical qubit is an error-corrected abstraction built out of many noisy physical qubits, and the physical-to-logical exchange rate — hundreds to thousands of physical qubits per logical one, plus magic-state factories to feed the arithmetic — is where the real cost lives. Every serious estimate below is denominated in noisy physical qubits, assumptions declared. That is the honest unit.

What does the estimate curve look like?

Four data points, each from a published engineering blueprint, each carrying its own assumptions:

Declared arithmetic on cited figures (division, nothing more): 2019→2025 is a ~20× cut in six years; 2025→2026 is another ~10× in nine months, if the preprint holds; end to end, the 2012-era figure to the 2026 figure is a drop of roughly four orders of magnitude — ~10,000× — in fourteen years. And note the trade printed in the same rows: as the qubit counts fell, the runtimes grew, from 8 hours to under a week to about a month. These blueprints are not strictly comparable point for point — different codes, different decoders, different compilation — which is exactly why each row carries its assumptions.

What is doing the cutting — physics or paper?

Paper. No new physics arrived between 2019 and 2026; the hardware assumptions in Gidney's 2025 blueprint are essentially the 2019 ones (0.1% gate error, 1 µs surface-code cycle, nearest-neighbor grid). The 20× came from three algorithmic ingredients the paper names: approximate residue arithmetic (from Chevignard, Fouque & Schrottenloher, 2024), yoked surface codes for idle logical storage, and magic state cultivation — together cutting Toffoli counts over 100× versus the 2024 arithmetic they build on.

The February 2026 preprint cuts differently: it swaps the surface code for quantum LDPC codes, claiming under 100,000 physical qubits at 10⁻³ error and a month of runtime. Read it with the credibility checklist: it is a resource estimate from numerical simulation and theoretical compilation, not an experiment; it is not peer-reviewed; and the sharpest caveat on record comes from Gidney himself, who noted the architecture "assumes the same decoder reaction time but has a much harder decoding problem" (via Aaronson's blog, February 2026). Aaronson adds that LDPC codes are harder to engineer than the surface code, especially for superconducting hardware, because of their wildly nonlocal measurements. None of this is an accusation — every one of these papers states its own assumptions in print, and the authors of the preprint say themselves that the results are simulations. The compression into "RSA nearly broken" happens downstream, in headlines.

What has actually been measured on hardware?

Here the numbers are small and stubborn. The honest record for Shor's algorithm on real quantum hardware is factoring integers no larger than 35 — and even for 15, 21 and 35, the survey of record notes the compiled circuits might not have been found without knowing the answer first. The same survey's footnote about larger claims is the most clarifying sentence in the genre: many rely on "a certain kind of oversimplification that makes them equivalent to coin flipping" (Willsch et al., arXiv:2410.14397, 2024).

Against the estimate curve, the measured world looks like this: the largest announced superconducting chip is 1,121 physical qubits (IBM Condor, December 2023 — context in the logical-qubit post); the best published logical-qubit demonstrations run from one high-quality logical qubit to a few dozen, not the thousands Shor needs; and the number of RSA keys of any commercially used size ever broken by a quantum computer is zero. Even the friendliest published blueprint asks for ~90× more physical qubits than the largest chip ever announced — with error correction running flawlessly across all of them for a month. That machine does not exist, and no vendor roadmap has yet landed a delivery date on time or late, because none has come due.

Why does a machine that does not exist set real deadlines?

Two reasons, neither of which requires believing any roadmap. First, encrypted traffic can be harvested now and decrypted later — the "harvest now, decrypt later" exposure means data with a long confidentiality lifetime is already racing the curve, as the PQC standards clock post lays out. Second, the regulator moved before the machine: NIST IR 8547 — still an initial public draft from November 2024 as of mid-2026, but treated as the planning baseline — schedules 112-bit-security algorithms like RSA-2048 to be deprecated after 2030 and disallowed after 2035. Those dates were drafted when the public requirement stood at 20 million qubits; the requirement has since fallen 20× in print and possibly 200× counting the preprint. A defender's deadline arithmetic only gets tighter when the attacker's bill of materials shrinks on paper faster than hardware grows in metal.

What this post does not claim: that RSA-2048 will fall by any particular date, that the curve must continue, or that any vendor's machine will arrive on schedule. Rosetta Q has no measurements in this class — our sealed runs are small optimization and quantum-walk experiments, nowhere near cryptography — and we claim none.

What we know / what we don't know

We know: the published physical-qubit estimates fell ~1B → 20M → <1M → <100K (preprint) between the 2012 era and February 2026, each under its own stated assumptions; the drop came from algorithms and codes, not new physics; the honest hardware factoring record is N ≤ 35; no RSA key has ever been broken by a quantum computer; NIST's draft timeline says deprecate after 2030, disallow after 2035.

We don't know: whether the Iceberg preprint survives peer review and, above all, whether its much harder LDPC decoding problem can be solved at real-time reaction speeds — the caveat its own field put on record; whether the curve keeps falling, plateaus, or hits a floor — there is no theorem in either direction; whether any hardware roadmap lands its dates — the track record is not bad, it is empty; and whether states or well-funded private labs hold better estimates than the public ones — unknowable by construction, which is itself a reason defenders plan against the public curve rather than behind it.

Rosetta Q publishes verdicts with reproducible raw data. This is educational content, not a product claim.