Nobody knows when a quantum computer will break RSA-2048. Published forecasts range from 2029 (Gartner) to the late 2030s (Metaculus forecasters, a survey of experts), and the NSA says plainly that it "does not know".
RSA-2048 is the encryption that protects much of the internet, from websites to software updates. It has not been broken. This page lists who expects what, what each forecast is based on, and what we do not know. Every date links to its source.
What breaking RSA-2048 requires
A quantum computer would use Shor's algorithm to break RSA. That takes a long, precise calculation. Today's quantum bits, called physical qubits, make too many errors for that. The fix is error correction: many physical qubits work together as one reliable logical qubit. Think of a team of careless clerks who check each other's work, so the team as a whole makes almost no mistakes.
The most cited estimate is by Craig Gidney of Google Quantum AI, published in May 2025: fewer than one million physical qubits, running for less than a week. In his calculation that machine works with about 1,400 logical qubits. We explain the numbers in detail in how many qubits it takes to break RSA-2048.
The estimate keeps falling
In 2019, Gidney and Martin Ekerå estimated 20 million physical qubits and about 8 hours. The 2025 paper, by Gidney alone, brought that below one million, with the same assumptions about hardware quality. In 2026, Paul Webster and colleagues put it below 100,000 physical qubits, if the hardware meets specific error rates and speeds. A team from Oratomic, Caltech and UC Berkeley described a design with as few as 10,000 atom qubits, in exchange for a much longer run time.
Lower estimates do not mean such a machine exists. They mean the target got smaller. The lowest figures depend on hardware that has not been built yet.
Where hardware stands
The machines that exist are far from that target. A benchmark by Sandia National Laboratories, with Quantinuum and NVIDIA, published in September 2026, ran up to 8 logical qubits on Quantinuum's Helios-1 computer. RSA-2048 needs about 1,400. In computing power, the authors write that today's machines are "insufficient by roughly five orders of magnitude": roughly a factor of 100,000.
Companies have announced higher logical-qubit counts. We have not verified those claims, so we do not use them here.
What forecasters expect
| When | Who | What exactly |
|---|---|---|
| 2029 | Gartner (February 2025) | Expects quantum computers to "break public key cryptographic algorithms". Based on an analyst report; only the public summary is readable. |
| April 2030 | Cloud Security Alliance (2022) | A countdown clock to the day quantum computers could break "present-day cybersecurity infrastructure". Set in 2022. |
| November 2033 | Metaculus forecasters | Median for factoring the RSA-2048 challenge number. Range July 2030 to March 2039, 26 forecasters (9 October 2026). |
| December 2034 | Metaculus forecasters | Median for factoring any of the RSA challenge numbers, most of them much smaller than RSA-2048. 135 forecasters (9 October 2026). |
| ≈ 2035 / ≈ 2040 | Global Risk Institute (report March 2026) | Survey of 26 experts: 28–49% chance of a quantum computer that breaks RSA-2048 within 24 hours within 10 years, 51–70% within 15 years. |
| No date | NSA (December 2024) | "NSA does not know when there will be a CRQC. Expert assessments disagree significantly about timing." |
A CRQC is a cryptographically relevant quantum computer: one that can break encryption like RSA. Note that the two Metaculus questions disagree with each other: the harder question (RSA-2048) has the earlier median. We keep all of these in our Q-Day tracker, which we update when a forecast moves.
A deadline is not a forecast
Governments have set dates to switch to quantum-safe encryption. The NSA wants all US national security systems quantum-resistant by 2035. Under Executive Order 14412, the most important US federal systems must use post-quantum key exchange by the end of 2030. These are migration deadlines, not predictions of when RSA falls. We list them in who must do what, and when.
What we do not know
We do not know whether hardware will keep improving at its current pace, or whether a new algorithm will lower the target again. Forecasts can move in both directions. The Sandia authors extrapolated their measurements and found that machines without error correction would only reach this kind of problem around 2050–2070 at the current pace. That is not a Q-Day forecast: they use it to argue that error correction is the only realistic route.
Why the date matters now
Encrypted data can be recorded today and decrypted later, once such a machine exists. That is called harvest now, decrypt later. Data that must stay secret for years is therefore already at risk, whatever the exact date. Our countdown shows the nearest published estimate.