Quantum computer

A quantum computer processes information using qubits, quantum bits that exploit superposition, entanglement, and interference to run algorithms no classical computer can execute efficiently. Machines as of early 2026 hold hundreds to roughly a thousand physical qubits, are error prone, and remain orders of magnitude short of the fault-tolerant scale needed to threaten deployed cryptography.

#How quantum computation differs

A classical bit is 0 or 1; a qubit can occupy a superposition of both, and n qubits can represent a superposition over 2^n states. Computation manipulates the amplitudes of those states so that wrong answers interfere destructively and right answers constructively; measurement then returns a classical result. The popular framing that a quantum computer "tries all answers at once" is wrong: reading out a superposition yields one random outcome, so useful algorithms must engineer interference toward the answer. That is only known to work for problems with exploitable structure, such as period finding in Shor's algorithm, or with the bounded quadratic gain of Grover's algorithm.

#Hardware modalities

No winning hardware platform has emerged. The leading approaches trade off speed, fidelity, and scalability.

#Physical versus logical qubits

The central obstacle is noise. The best physical qubits err roughly once per 1000 operations, while running Shor's algorithm at cryptographic scale requires error rates near one in a trillion or better. Quantum error correction bridges the gap by encoding one logical qubit across many physical qubits, detecting and correcting errors faster than they accumulate. This works only when physical error rates are below the code's threshold, and it costs on the order of 1000 physical qubits per logical qubit at cryptographically relevant quality. Headline qubit counts therefore overstate capability by about three orders of magnitude.

#Error correction progress

Error correction crossed a real milestone in December 2024. Google's Willow chip, with 105 superconducting qubits, demonstrated surface code memories at code distances 3, 5, and 7 in which each increase in distance roughly halved the logical error rate, and the encoded qubit outlived the best physical qubit on the chip (Google 2024; Google Quantum AI 2024). This below-threshold scaling is the property fault tolerance depends on, shown at small scale for quantum memory rather than for full computation.

Trapped-ion and neutral-atom groups have likewise demonstrated small numbers of logical qubits performing limited operations with error rates below their physical components. IBM ships 100 to 156 qubit Heron processors, and its published roadmap targets a fault-tolerant system called Starling, projected at roughly 200 logical qubits, around 2029 (IBM roadmap). Roadmaps are targets, not results; every one published so far has slipped or been revised.

#The gap to a cryptographically relevant machine

Current estimates put factoring RSA-2048 at just under 1 million physical qubits running fault-tolerantly for several days (Gidney 2025). Against that requirement, today's machines offer roughly 100 to 1000 physical qubits and, in the best experiments, tens of logical qubits capable of short circuits. Beyond raw counts, a cryptographically relevant machine needs sustained fault-tolerant operation across millions of components, mass production of high-quality magic states for logic gates, control electronics and cryogenics at unprecedented density, and fabrication yield no lab has approached. John Preskill's term NISQ (noisy intermediate-scale quantum) still describes the present era: machines useful for research, with no demonstrated advantage on any commercially or cryptographically meaningful problem (Preskill 2018).

The honest summary runs in both directions. Progress is real: below-threshold error correction was the field's key scientific gate and it has been passed. The remaining distance is also real: scaling from tens of logical qubits to the thousands a cryptanalytic machine needs is an unsolved, decade-scale engineering program with no guaranteed outcome.

#Relation to cryptography

Neither Shor's nor Grover's algorithm runs meaningfully on today's hardware. The case for post-quantum cryptography rests not on current machines but on the combination of steady progress, uncertain timelines (Q-Day), and the harvest now, decrypt later exposure of data recorded before the migration completes.