Most of what keeps you safe online is protected by a single kind of lock. It is a math problem that is easy to do one way but very hard to reverse. That lock protects websites, banking, software updates and digital signatures, RSA-2048 is one of its best-known forms. Bitcoin uses a related lock, built on elliptic curves, to prove that you own your coins.

But in 1994, mathematician Peter Shor showed that a sufficiently large quantum computer could break both. The algorithm is more than thirty years old, but nobody has built the machine yet.

Shor’s algorithm remains the defining benchmark in fault-tolerant quantum computing.

Today, we are publishing our latest resource estimate for running it on Alice & Bob’s cat-qubit architecture: about 23 000 physical qubits and about three days to break RSA-2048.[1]

Today, we are publishing our latest resource estimate for running it on Alice & Bob’s cat-qubit architecture: about 23 000 physical qubits and about three days to break RSA-2048.[1]

To our knowledge, no published architecture is smaller at this runtime, which puts us at the frontier of size and speed together.

A benchmark beyond cryptography

Shor’s algorithm is the iconic benchmark. It is a clearly defined math problem with an answer anyone can check.

But getting there is hard. You need a machine capable of running billions of operations, executed over hours to days. Physical qubits are far too error-prone to sustain that on their own, so the computation must be protected by quantum error correction from start to finish. That is exactly what we will need for the first useful applications in chemistry and materials science. Estimating the resources that Shor’s algorithm needs goes beyond encryption, telling us how far we are from the finish line.

The road gets shorter from both ends

When you look at the last seven years, since 2019, the resource estimates for Shor’s algorithm show an exponential trend. In 2019, Craig Gidney from Google Quantum AI and Martin Ekerå put breaking RSA-2048 at roughly 20 million physical qubits.[2] In 2025, Gidney brought it below one million.[3] Our own cat-qubit estimates have followed the same path since 2023: roughly 350 000 for RSA-2048 in 2023,[4] just under 100 000 in 2024,[5] and now around 23 000.[1]

Two trends are at play. On the one hand, there is the algorithm, the fact that mathematicians are able to come up with more efficient steps to compute the answer, and compilation, how efficiently a given computer can implement such steps.

On the other hand, we cannot do this without a machine actually being built: the talent, chip fabrication, quantum error correction. In the last few years overall qubit counts in labs and actual QPUs have been growing in size, along with improvements on logical performance, like Google’s Willow chip, with a logical qubit below threshold,[6] and Quantinuum’s several encoded qubits beyond break-even after post-selection.[7]

Small is not enough. Fast is not enough.

So how do you actually read one of these estimates? You look at two numbers, not one. The first is the qubit count, which determines how big the machine is, along with everything around it: cryogenics, wiring, control electronics, cost, and whether it will actually fit into a computing facility. The other is runtime, which tells you whether the result is still useful when it arrives. You can trade one for the other, but push too far either way and you end up with a machine that is too big to build, or too slow to matter.

Our figure, and a full blueprint of the machine

Accounting for both qubits and runtime, our balanced configuration is, to our knowledge, the best estimate published: about 23 000 cat qubits and about three days for RSA-2048. The same design can trade one for the other, using fewer qubits for more time, or finishing in about an hour if you spread the work across ten machines. The same approach covers the elliptic curve behind Bitcoin’s signatures and a smaller benchmark that could be run sooner. The full trade-offs are in the table below.

This work is very far from a back-of-the-envelope calculation. We compiled the complete algorithm down to the floor plan of the physical cat qubits, and the layout of the machine we would build to run it.

Before, quantum hardware had been developed in a general direction. Now, we are designing specific machines for specific computations, and resource estimates must reflect that. You can see the hardware assumptions behind these numbers in the paper.

What to do now?

The first machines could be built in a matter of years, transitions take time, so it is important that institutions begin that work now. We do not want to see today’s locks fail before they have been replaced, so we urge everyone to migrate, and to take it seriously.

Post-quantum standards already exist, but they have not been tested nearly enough, and there are not enough people working on them. We urge the community to invest more, both in migrating fast and in making sure these algorithms are resilient. We are open to collaborating with people doing that work.

The quantum race will not be won by qubit count alone. It will depend on what we can compute, how quickly we can compute it, and how big of a machine we need to get there.

That is exactly the frontier we are pushing.

References

  • [1] Pappalardo A., Goudarzi D., Hertz V., Jacinto H., Kroell L., Schrottenloher A., Shanahan P., Gouzien É., de La Vieuville R. and Londe V., Cryptology ePrint Archive, 2026/2665 (2026) Shor’s algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days. https://eprint.iacr.org/2026/2665
  • [4] Gouzien É., Ruiz D., Le RĂ©gent F.-M., Guillaud J. and Sangouard N., Phys. Rev. Lett. 131, 040602 (2023) Performance analysis of a repetition cat code architecture: computing 256-bit elliptic curve logarithm in 9 hours with 126 133 cat qubits. https://doi.org/10.1103/PhysRevLett.131.040602
  • [5] Ruiz D., Guillaud J., Leverrier A., Mirrahimi M. and Vuillot C., arXiv:2401.09541 (2024) LDPC-cat codes for low-overhead quantum computing in 2D. https://arxiv.org/abs/2401.09541