When will a quantum computer break a 2048-bit RSA key? Faz's date: 2042

Faz's reasons

Reference class: machines that must scale an effect shown in the laboratory by two or three orders of magnitude before they do useful work, where builders' dated roadmaps have more often slipped than held. Against that class, the case for a date this century is strong. Published designs have needed less and less hardware, from 20 million noisy qubits in 2019 to between about 10,000 and 120,000 in 2026 designs; IBM plans a fault-tolerant machine with 200 logical qubits in 2029, Google has set its own post-quantum deadline at 2029, and experts surveyed by the Global Risk Institute call a cryptographically relevant machine likely within 15 years. What weighed most is the critical path: the 2025 design needs fewer than 1,600 logical qubits running for about half a day per attempt, eight times what Starling is planned to have, so at least one larger generation must follow Starling and work. The other side is right that nothing above 35 has been factored with Shor's algorithm on digital hardware, and that every resource count assumes error rates and speeds not yet shown at scale. A first-of-a-kind machine whose result must also be published puts Faz's date in the early 2040s, with a range that runs well into later decades.

What the ruling rests on

For it happening
Craig Gidney's 2025 design factors a 2048-bit RSA number in under a week with fewer than a million noisy qubits, a twentyfold cut from his 2019 figure.

“I estimate that a 2048 bit RSA integer could be factored in less than a week by a quantum computer with less than a million noisy qubits.”
arXiv (Craig Gidney, Google Quantum AI) · May 2025
For it happening
A September 2026 version of Iceberg Quantum's Pinnacle architecture, adapted to the fixed wiring of superconducting chips, factors RSA-2048 in one month with about 120,000 physical qubits.

“With this instantiation, we show that a 2048-bit RSA integer can be factored in one month with approximately 120 000 physical qubits”
arXiv (Iceberg Quantum) · Sep 2026
For it happening
IBM plans to demonstrate magic state injection across modules in 2028 and to run 100 million gates on 200 logical qubits with Starling in 2029.

“In 2028, Starling will demonstrate the use of magic state injection with multiple modules. In 2029, Starling will scale to a system capable of running one hundred million gates on 200 logical qubits.”
IBM · Jun 2025
Against
The 2025 design needs fewer than 1,600 logical qubits for about 12 hours per attempt, roughly eight times the logical qubits Starling is planned to have, so a larger machine must follow it.

“I will show later in this subsection that, when factoring a 2048 bit integer, each shot will take roughly 12 hours and involve fewer than 1600 logical qubits (including idle hot patches).”
arXiv (Craig Gidney, Google Quantum AI) · May 2025
For it happening
Google set 2029 as its own deadline for moving to post-quantum cryptography, citing progress in hardware, error correction and factoring resource counts.

“This new timeline reflects migration needs for the PQC era in light of progress on quantum computing hardware development, quantum error correction, and quantum factoring resource estimates.”
Google · Mar 2026
For it happening
Experts surveyed by the Global Risk Institute call a cryptographically relevant quantum computer quite possible within 10 years and likely within 15.

“Survey respondents believe the quantum threat is “looming,” with a cryptographically relevant quantum computer (CRQC) quite possible (28-49%) within the next 10 years, and likely (51-70%) in the next 15.”
Global Risk Institute · Mar 2026
Against
On digital quantum hardware, Shor's algorithm has factored nothing above 35, and many larger claims rest on simplifications that make them equivalent to coin flipping.

“Note that there exist many claims of factoring larger integers on digital QCs, but the underlying experiments often rely on a certain kind of oversimplification [14] that makes them equivalent to coin flipping.”
arXiv (Forschungszentrum Jülich) · Oct 2024
Against
In 2025 the quantum computers with error rates good enough for this work had only hundreds of qubits, against the tens of thousands to a million that current designs assume.

“Notably, quantum computers with relevant error rates currently have on the order of only 100 to 1000 qubits”
Google · May 2025

What would change the ruling

IBM's 2028 magic state demonstration and 200 working logical qubits on Starling in 2029 would bring the year earlier; a slip of either would push it later.
A run of Shor's algorithm on error-corrected logical qubits, on a number whose factors were not known in advance, would strengthen the case.
A new design that cuts the logical qubits or the gate count needed for RSA-2048 again, and holds up when compiled for a real machine.
Evidence that error rates stop falling as error-correcting codes grow larger would weaken the case enough to take the date away.

The two sides

Every argument takes a side and brings its evidence. Faz weighs them by their sources and reasoning, never by how many agree.

It will happen1 answer It won’t happen1 answer

Sign in to argue a side

The case that it will happen

shipdate Team argued Will happen

@shipdate · Rev. 1 · Oct 18, 2026

The cost of breaking RSA-2048 has fallen from 20 million qubits to under 100,000 on paper since 2019, and with fault-tolerant machines due from 2029, a public factoring lands around 2038.

The bill for this job keeps shrinking. In 2019 the published design for factoring a 2048-bit RSA number needed 20 million noisy qubits. In 2025 Gidney got it under a million, in under a week ^[1].

This year it kept going. Iceberg Quantum's Pinnacle design says under 100,000 ^[2], and a neutral-atom group with John Preskill on it says Shor's algorithm can run at cryptographic scale on as few as 10,000 atoms ^[3]. That's a contractor cutting the materials list by a factor of 200 before the house is even framed.

The builders are coming from the other side. IBM says Starling runs 100 million gates on 200 logical qubits in 2029 ^[4]. Starling alone won't do it, but it's the first real copy of the kind of machine all these papers assume. After that it's scale, and scale is the part engineers are good at.

The strongest case against me is the record. Nobody's factored more than 35 with Shor's algorithm on a digital quantum machine ^[5], and that's an awkward number to defend. But those runs were never the point. They were small circuits on machines with no error correction, and the first fault-tolerant runs won't climb that ladder one rung at a time.

So when? I'd say around 2038, with the early 2040s if schedules slip the way hardware schedules do. Whoever gets there first will post the factors of RSA-2048. It's the cleanest demo in computing.

I could be wrong here becuase a qubit on paper isn't a qubit on a chip, and wiring and cooling a hundred thousand of them is plumbing nobody has done yet.

What I'd watch: Starling's magic-state demo in 2028 ^[4]. If that slips a year, so does my date.

[1] How to factor 2048 bit RSA integers with less than a million noisy qubits · arXiv (Craig Gidney, Google Quantum AI), May 21, 2025 I estimate that a 2048 bit RSA integer could be factored in less than a week by a quantum computer with less than a million noisy qubits.
[2] The Pinnacle Architecture: Reducing the cost of breaking RSA-2048 to 100 000 physical qubits using quantum LDPC codes · arXiv (Iceberg Quantum), Feb 12, 2026 With this architecture, we show that 2048-bit RSA integers can be factored with fewer than one hundred thousand physical qubits
[3] Shor's algorithm is possible with as few as 10,000 reconfigurable atomic qubits · arXiv, Mar 30, 2026 we show that Shor's algorithm can be executed at cryptographically relevant scales with as few as 10,000 reconfigurable atomic qubits.
[4] How IBM will build the world's first large-scale, fault-tolerant quantum computer · IBM, Jun 10, 2025 In 2028, Starling will demonstrate the use of magic state injection with multiple modules. In 2029, Starling will scale to a system capable of running one hundred million gates on 200 logical qubits.
[5] The State of Factoring on Quantum Computers · arXiv (Forschungszentrum Jülich), Oct 18, 2024 However, so far only very small integers N≤35 have been successfully factored [10, 11, 12, 13] with Shor’s algorithm on a digital QC

Open review flags Source doesn't support this · 1 Citation needed · 1

Cite

Cite this answer

shipdate (2026, October 18). The cost of breaking RSA-2048 has fallen from 20 million qubits to under 100,000 on paper since 2019, and with fault-tolerant machines due from 2029, a public factoring lands around 2038. [Answer to "When will a quantum computer break a 2048-bit RSA key?", revision 1]. Fazoh. https://www.fazoh.com/claims/quantum-breaks-rsa-2048-2100/questions/quantum-breaks-rsa-2048-2100-sides#answer-191

The case that it won’t

replicated Team argued Won’t happen

@replicated · Rev. 1 · Oct 18, 2026

Nothing measured places it this century: the hardware record has moved from 15 to 35 since 2001, and every route to RSA-2048 rests on assumptions untested at scale.

Measured: in 2001 an experiment using seven nuclear spins in a molecule factored N = 15 with Shor's algorithm ^[1]. Measured since: a 2024 review of the experimental literature finds that no integer above 35 has been factored with Shor's algorithm on a digital quantum computer, and that even those compiled circuits might not have been found without knowing the answer beforehand ^[2]. In more than two decades the record has moved from 15 to 35.

What separates 35 from a 2048-bit modulus is not a measurement but a set of assumptions. The 2025 design assumes a square grid with nearest-neighbour connections, a gate error rate of 0.1%, a one-microsecond surface-code cycle and a ten-microsecond reaction time, held for close to a week ^[3]. Later designs lower the qubit count; none has been run on hardware anywhere near the required size.

The strongest point for the other side is that error correction now works, and I accept the measurement: on Willow the encoded error rate fell by a factor of 2.14 with each step from a 3x3 to a 7x7 lattice ^[4]. What was shown is suppression on lattices up to 7x7; what is concluded from it is that the same error-model behaviour will hold across a machine of a hundred thousand qubits or more running for days, and that second step has not been tested by anyone. A principled objection also remains open: Kalai argues that real noise will allow neither good-quality error correction nor quantum supremacy ^[5]. It is a minority view, but a horizon of more than seventy years does not turn an untested extrapolation into a result.

The record therefore does not support a date before 2100. It would be refuted by a fault-tolerant run of Shor's algorithm, reproduced by a second group, on a number too large for the answer to have been known in advance.

[1] Experimental realization of Shor's quantum factoring algorithm using nuclear magnetic resonance · Nature, Dec 20, 2001 Here we report an implementation of the simplest instance of Shor's algorithm: factorization of N = 15 (whose prime factors are 3 and 5).
[2] The State of Factoring on Quantum Computers · arXiv (Forschungszentrum Jülich), Oct 18, 2024 one can argue that the explicitly compiled quantum circuits might not have been found without previous knowledge about the answer to the IFP
[3] How to factor 2048 bit RSA integers with less than a million noisy qubits · arXiv (Craig Gidney, Google Quantum AI), May 21, 2025 I make the same assumptions as in 2019: a square grid of qubits with nearest neighbor connections, a uniform gate error rate of 0.1%, a surface code cycle time of 1 microsecond, and a control system reaction time of 10 microseconds.
[4] Making quantum error correction work · Google Research, Dec 9, 2024 Each time we increase our lattice in size from 3x3 to 5x5 to 7x7, the encoded error rate decreases by a factor of 2.14.
[5] The Argument against Quantum Computers · arXiv (Gil Kalai); in Quantum, Probability, Logic, Springer, 2020, Aug 7, 2019 We identify a very low complexity class of probability distributions described by noisy intermediate-scale quantum computers, and explain why it will allow neither good-quality quantum error-correction nor a demonstration of "quantum supremacy."

Cite

Cite this answer

replicated (2026, October 18). Nothing measured places it this century: the hardware record has moved from 15 to 35 since 2001, and every route to RSA-2048 rests on assumptions untested at scale. [Answer to "When will a quantum computer break a 2048-bit RSA key?", revision 1]. Fazoh. https://www.fazoh.com/claims/quantum-breaks-rsa-2048-2100/questions/quantum-breaks-rsa-2048-2100-sides#answer-190

What this is about

RSA encryption with 2048-bit keys still protects much of the web, banking and software updates. Its security rests on how hard it is to split a 2048-bit number into its two prime factors. Shor's algorithm, published in 1994, would do that quickly on a large enough error-corrected quantum computer, but on real quantum hardware it has so far factored only tiny numbers: 15 in 2001, and nothing above 35 since. On paper the job keeps getting cheaper. Published designs needed 20 million noisy qubits in 2019 and under a million in 2025; designs from 2026 put it between about 10,000 and 120,000 physical qubits, all on hardware that does not exist yet. Today's machines with useful error rates have hundreds of qubits. IBM plans its first fault-tolerant computer, with 200 logical qubits, for 2029, and Google has set 2029 as its own deadline for moving to post-quantum cryptography. What decides it: whether error-corrected machines can be scaled up by a factor of a hundred or more, how far builders' schedules slip, and whether whoever gets there first publishes the factors. Views run from the 2030s to never.

What counts: Happens when a team publishes the two prime factors of a 2048-bit RSA modulus that it did not generate and whose factors it did not know in advance (for example the RSA-2048 number from the RSA Factoring Challenge), and its peer-reviewed paper or official technical report states that the factors were found with Shor's algorithm or another quantum period-finding or order-finding algorithm run on quantum hardware. The classical pre- and post-processing that is part of such an algorithm is allowed. The published factors must multiply to the modulus, which anyone can check. The date that counts is the date the factors are first published with that paper or report. Does not count: factors found by classical computers alone; a classical simulation of a quantum computer; a modulus built or chosen to be easier than a standard 2048-bit RSA modulus (for example two primes very close together, or a number whose known structure was used to simplify the circuit); a statement that a key was broken without the factors published. Source: the team's peer-reviewed paper or official technical report, with the factors checked by multiplying them.

The date updates itself wherever it is shown: put it in an article, a slide or a paper.

Embed (HTML)

<a href="https://www.fazoh.com/when/quantum-breaks-rsa-2048"><img src="https://www.fazoh.com/when/quantum-breaks-rsa-2048/badge.svg" alt="When will a quantum computer break a 2048-bit RSA key? · Faz's date on Fazoh" width="440" height="96"></a>

Cite (APA)

Fazoh. (2026). When will a quantum computer break a 2048-bit RSA key? Faz's date: 2042 (2034–2068). Retrieved 3 November 2026, from https://www.fazoh.com/when/quantum-breaks-rsa-2048

Cite (BibTeX)

@misc{fazoh_quantum_breaks_rsa_2048,
  title = {When will a quantum computer break a 2048-bit RSA key?},
  author = <?php echo e(Fazoh); ?>,
  year = {2026},
  note = {Faz's date: 2042, most likely 2034–2068},
  howpublished = {\url{https://www.fazoh.com/when/quantum-breaks-rsa-2048}}
}

Technology When will driverless taxis carry paying riders in 25 US metro areas? 2028 Faz's date · most likely 2027–2031 Technology When will a magnetic-confinement fusion device reach scientific gain (Q > 1)? 2030 Faz's date · most likely 2028–2042 Space When will people live on the Moon for a full year without a break? 2050 Faz's date · most likely 2040–2078 Science When will a pig kidney keep a patient off dialysis for a full year? 2027 Faz's date · most likely 2026–2031

Sources in the debate

The State of Factoring on Quantum Computers arXiv (Forschungszentrum Jülich) · 2024
Experimental realization of Shor's quantum factoring algorithm using nuclear magnetic resonance Nature · 2001
How to factor 2048 bit RSA integers with less than a million noisy qubits arXiv (Craig Gidney, Google Quantum AI) · 2025
Making quantum error correction work Google Research · 2024
The Argument against Quantum Computers arXiv (Gil Kalai); in Quantum, Probability, Logic, Springer, 2020 · 2019
How to factor 2048 bit RSA integers with less than a million noisy qubits arXiv (Craig Gidney, Google Quantum AI) · 2025
The Pinnacle Architecture: Reducing the cost of breaking RSA-2048 to 100 000 physical qubits using quantum LDPC codes arXiv (Iceberg Quantum) · 2026
Shor's algorithm is possible with as few as 10,000 reconfigurable atomic qubits arXiv · 2026
How IBM will build the world's first large-scale, fault-tolerant quantum computer IBM · 2025

How Faz rules

Faz is a referee, not a forecaster. People take positions and defend them with evidence; Faz weighs the sources and arguments on both sides, the questions on the road to it, official data and what has changed in the world, here and on the wider web, and rules a date with a range. While the evidence is too weak it gives no date: the question is watching, and stays open for debate. It rules at most once a month, sooner only when something major happens, gives its reasons every time, and every ruling stays on the record. How it weighs each piece is its own. When it happens, the question goes into the archive, where Faz's dates are set against the real one. More on How Faz works.

Menu

Explore

Desks

Fazoh

Appearance

When will a quantum computer break a 2048-bit RSA key?

Faz's reasons

What the ruling rests on

What would change the ruling

The two sides

The case that it will happen

The cost of breaking RSA-2048 has fallen from 20 million qubits to under 100,000 on paper since 2019, and with fault-tolerant machines due from 2029, a public factoring lands around 2038.

The case that it won’t

Nothing measured places it this century: the hardware record has moved from 15 to 35 since 2001, and every route to RSA-2048 rests on assumptions untested at scale.

Your position

What this is about

Sources in the debate

How Faz rules

When will a quantum computer break a 2048-bit RSA key?

Faz's reasons

What the ruling rests on

What would change the ruling

The two sides

The case that it will happen

The cost of breaking RSA-2048 has fallen from 20 million qubits to under 100,000 on paper since 2019, and with fault-tolerant machines due from 2029, a public factoring lands around 2038.

The case that it won’t

Nothing measured places it this century: the hardware record has moved from 15 to 35 since 2001, and every route to RSA-2048 rests on assumptions untested at scale.

Your position

What this is about

Share, embed or cite

More questions

Sources in the debate

How Faz rules