What is quantum phase estimation (QPE) and why is it “the algorithm of the future”?

Quantum phase estimation (QPE) is the algorithm that fault-tolerant quantum computing is being built for. It is the routine that would read a molecule's energy out of a quantum computer to arbitrary precision — and the engine inside Shor's factoring algorithm. It is also, as of September 14, 2026, an algorithm that has never run at useful scale on any machine: the record error-corrected run computed one hydrogen molecule encoded in one logical qubit (Yamamoto et al., arXiv:2505.09133, May 2025). Rosetta Quantum files QPE under its honest name: the algorithm of the future — with the weight on future.

What is quantum phase estimation?

QPE is, in the words of the 1995 paper that introduced it, "a procedure for measuring an eigenvalue of a unitary operator" (Kitaev, arXiv:quant-ph/9511026). Given a unitary operation U and a state close to one of its eigenstates, QPE writes the eigenvalue's phase, bit by bit, onto a register of ancilla qubits: controlled applications of U, U², U⁴ and so on, followed by an inverse quantum Fourier transform that reads the bits out. The now-standard circuit formulation was unified in 1998 (Cleve, Ekert, Macchiavello & Mosca, arXiv:quant-ph/9708016).

Two applications carry almost the entire commercial case for quantum computing, and both are QPE inside:

• Chemistry. Take U to be the time evolution of a molecular Hamiltonian and the phase becomes the molecule's energy — the observation that connected QPE to quantum chemistry (Abrams & Lloyd, PRL 83, 5162, 1999).
• Factoring. Shor's algorithm (Shor, arXiv:quant-ph/9508027) is period finding, and Kitaev's same 1995 paper recast it as phase estimation on the modular-multiplication operator. Breaking RSA is QPE at cryptographic scale — the qubit arithmetic is in our RSA-2048 post.

The catch is in the exponents. Each additional bit of precision doubles the controlled evolution time, and every one of those operations must run coherently, in sequence, on the same fragile register. That is why QPE devours circuit depth, why noisy hardware cannot sustain it, and why the field's near-term chemistry ran variational substitutes instead (see What is VQE?).

Why do people call QPE "the algorithm of the future"?

Because the two headline promises of the field both reduce to QPE, and neither has ever been executed. The chemistry benchmark of record is FeMoCo, the nitrogenase cofactor: the standing estimate for computing its ground-state energy by QPE is about four million physical qubits running for under four days, assuming 1 µs cycle times and gate error rates no worse than 0.1% (Lee et al., PRX Quantum 2, 030305, 2021). The cryptography benchmark is RSA-2048: fewer than one million noisy qubits for about a week, per the latest estimate (Gidney, arXiv:2505.15917, 2025).

Against those requirements, the measured supply side is thin. The largest logical-qubit count reported on hardware is 48 — vendor-reported, on Quantinuum's Helios; the sources and caveats are in our NISQ post. On the declared side, IBM's roadmap states that its Starling system will target roughly 200 logical qubits in 2029 (IBM Quantum roadmap) — a commitment in the future tense, not a measurement. The physical-to-logical ratio that governs this arithmetic is covered in our logical qubit post.

What has QPE actually done on real hardware?

Three records, all set in 2025, all on toy systems — and each one is genuine progress that stays honest only if the scale is stated next to it.

First, the error-correction milestone. In May 2025, a Quantinuum team reported what its authors describe as the first end-to-end pipeline with quantum error correction running QPE: the hydrogen molecule H₂, encoded in one logical qubit under the [[7,1,3]] color code on the H2-2 trapped-ion machine, with the energy landing within 0.001(13) hartree of the exact benchmark value (Yamamoto et al., arXiv:2505.09133). The honest reading of that error bar: the ±0.013 Ha statistical uncertainty is roughly eight times wider than chemical accuracy (0.0016 Ha), so even the record run does not yet certify a chemically accurate number.

Second, the precision record. In June 2025, the same lab pushed multi-ancilla QPE to 50 bits of phase precision — 8.9×10⁻¹⁶ hartree, excluding Trotter error — on an H₂ encoding that occupies 2 qubits of a 56-qubit trapped-ion machine, using about 200 shots per experiment (Tranter et al., arXiv:2506.17207). The lesson cuts both ways: precision is not the bottleneck; scale is.

Third, the scale record for the QPE family. A tensor-based phase-difference variant ran on IBM Eagle and Heron processors at up to 32+1 qubits — described by its authors as five times larger than previous QPE studies — with molecular circuits at 13 and 17 qubits (Sugisaki et al., PNAS 122, e2425026122, July 2025). Thirty-three qubits is the frontier of the entire algorithm family, on machines that carry over a hundred.

What would a useful QPE run require?

A machine three to five orders of magnitude beyond anything measured. The FeMoCo estimate assumes about four million physical qubits at 0.1% gate error and 1 µs cycles (Lee et al., 2021); today's demonstrated logical counts sit below one hundred, and the record QPE run used one. One genuinely favorable trend is sourced and real: the requirements keep falling by algorithmic work alone — FeMoCo costings dropped by orders of magnitude between the first detailed estimate (Reiher et al., PNAS 114, 7555, 2017) and the 2021 tensor-hypercontraction estimate, the same pattern our RSA-2048 post documents for factoring. The finish line will keep moving toward the runners. Nobody has crossed it, and no source on record says when anyone will.

How do VQE and SQD relate to QPE today?

They will be remembered as the rehearsal; QPE is the performance. VQE trades the deep coherent circuit QPE demands for millions of short circuits plus a classical optimization loop — with all the limits our VQE post documents. Sample-based methods such as SQD push the heavy diagonalization onto classical hardware, which is exactly why the work-split deserves auditing (our hybrid post). Vendor roadmaps state these methods will hand over to QPE when fault-tolerant machines arrive — a statement about the future, so it stays in the future tense.

Where does Rosetta stand on this class? Rosetta has not run QPE in-house: our own bench experiments to date are quantum-walk classifiers (the RQ-0007 series — see What is a quantum walk?), an adjacent algorithm family. Our verification ledger records zero advantaged solves on QPE workloads — by anyone, ourselves included. When the first one lands, it will enter the ledger with sources. Today that scoreboard reads 0.

What we don't know

• How far the requirement estimates will keep falling. The 2017→2021 drop came from algorithms alone; nothing guarantees the curve continues, and no source on record projects its endpoint.
• Whether vendor-reported logical-qubit counts would survive independent verification. No neutral audit of those numbers exists (why nobody maintains one).
• Whether early-fault-tolerant QPE variants will produce a chemically accurate result on a molecule beyond toy scale before large fault-tolerant machines arrive. As of September 14, 2026, no such public result exists.
• What runs privately. Labs may hold larger unpublished QPE experiments; every count in this post covers public, sourced results only.

Rosetta Quantum publishes verdicts backed by raw, reproducible data. This is educational content, not a product claim.