How many qubits are needed to break RSA-2048?
As of March 2026, factoring RSA-2048 with Shor's algorithm needs 1,399 logical qubits running 6.5×10⁹ Toffoli Gates (Gidney 2025). With surface-code error correction at a physical error rate of 0.001, that translates to roughly 3.8 million physical qubits (optimistic fit, distance 29) to 5.6 million (conservative fit, distance 35). The largest disclosed quantum computer has 1,180 physical qubits (neutral atom, October 2023), a gap of about 3.5 orders of magnitude.
How this is computed
The logical resource count (1,399 logical qubits, 6.5×10⁹ Toffoli Gates) comes from Gidney's "How to factor 2048 bit RSA integers with less than a million noisy qubits" (arXiv:2505.15917). The physical footprint is derived from the Litinski lattice-surgery cost model (arXiv:1808.02892): magic-state distillation factory selection, tile layout, and the code distance required to keep the total logical error under budget, treating each Toffoli gate as 4 T gates (the optimistic bound).
Results are reported under two published logical-error calibrations because they disagree by 13-268x (d=7 to d=25), the spread is genuine model uncertainty, not a rounding choice. Estimated wall-clock time at a 1 µs cycle: 132.9 days (optimistic) to 160.4 days (conservative).
What this means in practice
The best disclosed device is about 3.5 orders of magnitude short of the physical-qubit requirement. Error rates are closer to ready than scale: the best two-qubit error rate on record is 0.0003 (Trapped-Ion, July 2024), already below the surface-code threshold. The bottleneck is qubit count, not fidelity.
Compute it yourself
Every number on this page is computed from the same open model that powers the interactive calculator and the MCP server for AI assistants.
GET https://www.quantum-expectations.com/api/fault-tolerant-resources?numLogicalQubits=1399&tCount=2.6e10&qubitErrorRate=0.001