When will quantum computers be able to break RSA-2048?
As of March 2026, no quantum computer can break RSA-2048, and the gap is about 3.5 orders of magnitude in qubit count (best device: 1,180 physical qubits; required: roughly 3.8 million under optimistic assumptions). Extrapolating the historic record-qubit-count trends log-linearly, the earliest platform crosses the requirement around 2041, an extrapolation of 3/7/5-point record series, not a prediction, and it assumes error rates, error correction, and runtime all cooperate.
How to read this number honestly
The extrapolation is a log-linear fit of record physical-qubit counts per platform, extended to the computed fault-tolerant footprint for RSA-2048 (3.8 million physical qubits under the optimistic logical-error fit; the conservative fit is larger). Everything that could break it is visible: record series have few points, records are single devices (not products), the footprint assumes the optimistic end of a 13-268x (d=7 to d=25) model spread, and sustained wall-clock runs of 132.9 days at 1 µs cycle time with real-time decoding have never been demonstrated.
Per-platform extrapolated crossing years: Neutral Atom ~2043, Superconducting ~2041, Trapped-Ion ~2062. These numbers update automatically as new records land in the dataset.
What would change the answer
Cheaper factoring circuits (the logical requirement has fallen before), better codes (the qLDPC overhead is already ~10.7× below the surface code), or a step-change in scaling (modular architectures) would pull the date in. Slower-than-trend scaling, correlated noise at scale, or decoder bottlenecks would push it out. This page states the trend; it does not bet on it.
Compute it yourself
Every number on this page is computed from the same open model that powers the interactive calculator and the MCP server for AI assistants.
GET https://www.quantum-expectations.com/api/fit-historic-series?seriesType=qubit-count&hardwareType=Superconducting&targetValue=3831596