New calculation: quantum computer needs far fewer qubits to break internet encryption

A large part of the internet is secured with encryption that relies on calculations that are practically impossible for ordinary computers. With RSA, the task is to find the two prime numbers that make up a very large number. An ordinary computer would need billions of years for that. In principle, a quantum computer can do it much faster, using a method called Shor's algorithm. The question is: how big does such a quantum computer have to be?

Researchers at the Paris quantum company Alice & Bob have made a new estimate. According to their calculation, a quantum computer with 22,593 qubits is enough to break a 2048-bit RSA key, the common length, in about 3.14 days. Qubits are the calculating units of a quantum computer. The team put the work online on 28 October 2026 at the Cryptology ePrint Archive, a place where research on encryption is shared. Other researchers have not yet reviewed it.

From 20 million to 23,000

The estimate fits a clear trend. In 2019, Google researchers still counted on about 20 million qubits for the same job. In 2025, Google brought this under one million. According to Alice & Bob, the new estimate is about 40 times lower than Google's from 2025. The drop comes mainly from researchers finding smarter ways to deal with the calculation errors of qubits.

The company also calculates other set-ups. Ten linked machines with about 611,000 qubits in total would break RSA-2048 in about 1.25 hours. And with at most 30,000 qubits, the encryption that bitcoin uses to prove who owns coins could be broken in about an hour. That is longer than the ten minutes in which a bitcoin payment is recorded. According to Alice & Bob, payments that are in transit at that moment therefore stay out of reach.

Why so few qubits?

Qubits make many errors. That is why many extra qubits are normally needed to correct those errors. Alice & Bob works with so-called cat qubits: superconducting circuits that hold particles of light. According to the company, these are naturally well protected against one kind of error, in which a 0 turns into a 1 by accident or the other way round. This means fewer extra qubits are needed.

The calculation does assume that such an error does not happen for about a hundred years. In the lab, Alice & Bob reached an average of 44 minutes, according to ScienceAlert. If the researchers calculate with about one hour, about 45,000 qubits are needed instead of 23,000.

The machines still have to be built

A quantum computer of this size does not exist yet. Quantum experts Christian Andersen and Eliška Greplova of the Delft research institute QuTech wrote earlier this year about similar estimates by other teams that all of them assume machines that do not exist yet. For quantum chips, the challenge is to go from a few hundred qubits to many more. For systems that use single atoms as qubits, the main issues are speed, stability and control. Alice & Bob expects that better machines and lower requirements will meet each other in the early 2030s.

That is why governments, banks and technology companies are already working on quantum-safe encryption: new calculation methods that even a quantum computer cannot get through. Experts advise making that switch now, so that security is in order before such machines exist.

What does this mean for the road to the singularity?

The threshold for a truly useful quantum computer is lower than was thought a few years ago: not millions, but tens of thousands of qubits. This is mainly thanks to better error correction, a technique that is also needed for all other uses of quantum computers, such as calculating new medicines and materials. Every step down in the required size brings those uses closer. At the same time, it gives the world a clear task: to renew the encryption of the internet in time, so that we can use the benefits of quantum computers safely later on.

What is the technological singularity? Read the explanation →