Discuss an engagement
MenuClose

When could a quantum computer break encryption?

Not today. Here is what the published designs need, how fast the estimates are falling, what governments assume and which headlines did not hold up. Reviewed October 30, 2026.

The short answer.

No one can name the year. The evidence supports three statements: no such machine exists in public view, the gap is still large, and it is closing from both ends.

Today
No quantum computer in public view can break RSA or elliptic-curve cryptography. The largest error-corrected demonstrations hold dozens of logical qubits: Quantinuum reported 48 from 98 physical qubits.1
What it would take
Designs published since 2025 need about 1,200 to 1,600 logical qubits running for minutes to weeks, built from roughly 20,000 to one million physical qubits depending on the hardware.2,3,4
Direction
The estimates keep falling. RSA-2048 needed about 20 million physical qubits in a 2019 design and under one million in 2025. A 2026 preprint claims under 100,000 on hardware not yet built at scale.2,5,6
Expert opinion
In the Global Risk Institute’s 2025 survey of 26 experts, the estimated chance of a cryptographically relevant quantum computer within 10 years ranged from 28% to 49%. These are opinions from a small panel.7
Deadlines
Governments set dates without waiting for one. The US requires its most sensitive federal systems to move by 2030 and 2031, NIST deprecates RSA and elliptic curves after 2030, and Google set 2029 for its own migration.8,9,10

What the published designs need.

None has run. Fewer qubits usually means a slower machine: superconducting designs finish in minutes to days, atom and ion designs in days to weeks.

Resource estimates for breaking RSA-2048 and 256-bit elliptic curves
Year Target Physical qubits Time Assumptions Review
2019 RSA-2048Gidney and Ekerå About 20 million About 8 hours Superconducting surface code; 0.1% gate error; 1 µs cycle5 Peer reviewed
2025 RSA-2048Gidney Under 1 million Under a week Same error rate and cycle time as 2019; about 1,400 logical qubits2 Preprint
2026 RSA-2048Webster and others Under 100,000 About a month Quantum LDPC codes with long-range connectivity not yet built at scale6 Preprint
2026 secp256k1, the curve behind BitcoinBabbush, Gidney and others (Google) Under 500,000 18 to 23 minutes Superconducting; at most about 1,450 logical qubits; circuits withheld, counts backed by a zero-knowledge proof3 Peer reviewed
2026 P-256Cain and others About 26,000 atoms A few days Neutral atoms with high-rate codes; RSA-2048 10 to 100 times longer11 Preprint
2026 secp256k1Häner and others 19,397 ions About 26 days Trapped ions; about 1,450 logical qubits; 63% success per run4 Preprint

Harvest now, decrypt later.

Recording encrypted data today to decrypt it once a quantum computer exists. It is the reason governments give for starting now.

What governments assert
Executive Order 14412 says ongoing cyber activity “presents the risk of adversaries collecting United States information now, and decrypting it later once large-scale quantum computers are operational.” NIST calls the threat model “one of the main reasons why the transition to post-quantum cryptography is urgent.”8,9
What is documented
We found no government advisory, court filing or incident report that attributes a specific campaign to collection for later quantum decryption, as of October 28, 2026. Such collection would be hard to see, so the absence of cases is weak evidence either way. US law does let intelligence agencies keep incidentally collected communications beyond five years when they are “enciphered”.12
What is exposed
Confidentiality. Data that must stay secret for years is at risk now if it crosses networks protected only by classical key exchange. OMB tells agencies to put first the systems holding data “expected to remain mission-sensitive in 2030”. Signatures are different: forging one needs a quantum computer at the time of the attack.13
How we write about it
Governments assess that adversaries may be collecting now. We do not write that attackers are doing it, because the public record does not show it.

Headlines that did not hold up.

Each claim read against the paper or announcement behind it.

Chinese researchers broke RSA with a D-Wave quantum annealer.
The work factored a 22-bit number. RSA keys in common use today are 2,048 or 4,096 bits.14
Google’s Willow chip broke, or nearly broke, encryption.
The December 2024 announcement claimed error correction below threshold and a sampling benchmark. It made no cryptographic claim.15
Quantum Echoes means encryption is next.
The October 2025 speedup was for a physics simulation task on 65 qubits, unrelated to code-breaking.16
Quantum computers have started breaking Bitcoin keys.
The largest public attack, which won a 1 bitcoin prize in April 2026, recovered a 15-bit key. Bitcoin keys are 256 bits.17
Bitcoin can be broken in nine minutes.
An estimate for a machine of under 500,000 qubits that does not exist, starting from a precomputed state.3
Quantum factoring records show steady progress toward breaking RSA.
Two researchers reproduced the published records with an 8-bit home computer from 1981, an abacus and a dog. Every record used specially chosen numbers, work done beforehand on an ordinary computer, or both.18

Sources.

Primary sources unless marked. Each shows the date we last opened it and confirmed what we cite.

  1. 1
    Quantinuum Inc. prospectus, Form 424B4, SEC EDGAR, June 3, 2026 Checked October 28, 2026.
  2. 2
    How to factor 2048 bit RSA integers with less than a million noisy qubits, Gidney, preprint, May 2025 Checked October 28, 2026.
  3. 3
    Elliptic-curve resource estimate for secp256k1, Babbush, Zalcman, Gidney and others, PRX Quantum, August 21, 2026 Checked October 28, 2026.
  4. 4
    Computing 256-bit elliptic-curve logarithms on trapped ions, Häner and others, preprint, September 2026 Checked October 28, 2026.
  5. 5
    How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits, Gidney and Ekerå, Quantum, 2021 Checked October 28, 2026.
  6. 6
    The Pinnacle architecture, Webster and others, preprint, February 2026 Checked October 28, 2026.
  7. 7
    Quantum Threat Timeline Report 2025, Global Risk Institute and evolutionQ, March 2026 Checked October 28, 2026.
  8. 8
    Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026 Checked October 29, 2026.
  9. 9
    NIST IR 8547, Transition to Post-Quantum Cryptography Standards, final, October 27, 2026 Checked October 30, 2026.
  10. 10
    Quantum frontiers may be closer than they appear, Google, March 2026 Checked October 28, 2026.
  11. 11
    Shor’s algorithm on neutral atoms, Cain, Xu, King and others, preprint, March 2026 Checked October 28, 2026.
  12. 12
    50 U.S.C. § 1813, retention of incidentally acquired communications Checked October 29, 2026.
  13. 13
    OMB Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography, June 24, 2026 Checked October 28, 2026.
  14. 14
    Experts slam Chinese research on quantum encryption attack, TechTarget Checked October 28, 2026. Secondary copy; the primary source could not be reached.
  15. 15
    Meet Willow, our state-of-the-art quantum chip, Google, December 9, 2024 Checked October 28, 2026.
  16. 16
    A verifiable quantum advantage, Google Research, October 22, 2025 Checked October 28, 2026.
  17. 17
    Researcher wins 1 bitcoin bounty for largest quantum attack on underlying tech, CoinDesk, April 24, 2026 Checked October 28, 2026. Secondary copy; the primary source could not be reached.
  18. 18
    Replication of quantum factorisation records with an 8-bit home computer, an abacus, and a dog, Gutmann and Neuhaus, 2025 Checked October 28, 2026.

Discuss an engagement privately.

Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.

Email engage@bendings.com What happens next