When will quantum computers be able to break RSA-2048?

The extrapolation is a log-linear fit of record physical-qubit counts per platform, extended to the computed fault-tolerant footprint for RSA-2048 (3.8 million physical qubits under the optimistic logical-error fit; the conservative fit is larger). Everything that could break it is visible: record series have few points, records are single devices (not products), the footprint assumes the optimistic end of a 13-268x (d=7 to d=25) model spread, and sustained wall-clock runs of 132.9 days at 1 µs cycle time with real-time decoding have never been demonstrated.

The single largest thing that could move these dates is the target itself. The footprint above prices magic states from the 2019 Litinski distillation catalog and charges every idle logical qubit a plain surface-code patch. Gidney's own estimate for the same algorithm at the same error rate and cycle time is under 1 million physical qubits, because it stores idle qubits in yoked surface codes and replaces distillation with magic-state cultivation. Against that lower target every crossing year below arrives earlier. This page is deliberately the conservative reading, and a conservative reading of a date is a late one, so do not treat these years as the earliest plausible date.

Per-platform extrapolated crossing years: Neutral Atom ~2043, Superconducting ~2041, Trapped-Ion ~2062. These numbers update automatically as new records land in the dataset.

Cheaper factoring circuits (the logical requirement has fallen before), better codes (the qLDPC overhead is already ~10.7× below the surface code), or a step-change in scaling (modular architectures) would pull the date in. Slower-than-trend scaling, correlated noise at scale, or decoder bottlenecks would push it out. This page states the trend; it does not bet on it.