No one can say when a quantum computer will break RSA-2048, and no published estimate gives a date. What has changed is the size of the machine the estimates call for. In 2019, a widely cited paper estimated that 20 million noisy qubits could factor a 2048-bit RSA integer in eight hours. In 2026, published architectures put the figure below 100,000 qubits on superconducting hardware and close to 10,000 on neutral atoms, with longer runtimes. In the same period, Google, Cloudflare and Microsoft set 2029 as their own target for post-quantum cryptography (PQC), while the main regulatory timelines still run to 2035.
This post sets out the published resource estimates as of October 2026, what each assumes, the vendor and regulatory dates side by side, and how to plan when the two sets of dates disagree.
Published estimates for breaking RSA-2048 and elliptic curves
A resource estimate answers a narrow question: given stated hardware assumptions, how many physical qubits and how much time would a specific attack need? The table lists the main public estimates, as of October 2026. The assumptions column matters as much as the headline number, because the estimates do not all assume the same hardware.
| Published | Authors | Target | Physical qubits | Runtime | Key assumptions |
|---|---|---|---|---|---|
| May 2019 | Gidney and Ekerå (Google, KTH) | RSA-2048 | 20 million | 8 hours | Superconducting-style planar grid, nearest-neighbour connectivity, 0.1% gate error rate, surface code cycle time of 1 microsecond, reaction time of 10 microseconds |
| May 2025 | Gidney (Google Quantum AI) | RSA-2048 | Less than a million | Less than a week | The same hardware assumptions as 2019: square grid, nearest-neighbour connections, 0.1% gate error rate, 1 microsecond cycle, 10 microsecond reaction time |
| February 2026, revised May 2026 | Webster and others (Iceberg Quantum), the Pinnacle Architecture | RSA-2048 | Fewer than 100,000 | About one month | Physical error rate of 10-3, 1 microsecond cycle, 10 microsecond reaction time; quantum LDPC codes, which need quasi-local connections between qubits a bounded distance apart |
| March 2026 | Babbush and others (Google Quantum AI, UC Berkeley, Ethereum Foundation, Stanford) | 256-bit elliptic curve discrete logarithm on secp256k1 | Fewer than half a million | Minutes | Superconducting architecture, physical error rate of 10-3, planar connectivity; circuits verified with a zero-knowledge proof rather than published |
| March 2026 | Cain and others (Oratomic, Caltech) | RSA-2048 and 256-bit elliptic curves | About 10,000 to 26,000 for elliptic curves; 11,000 to 14,000 for RSA-2048, or about 102,000 for a faster parallel design | As few as 10 days for elliptic curves; about 97 days for RSA-2048 with about 102,000 qubits | Reconfigurable neutral-atom qubits, high-rate error-correcting codes, 1 millisecond measurement cycle, physical error rates just below 0.1% |
Three points stand out. First, the trend runs one way: each generation of estimates needs fewer qubits than the last. The 2025 paper reached its lower count while keeping the 2019 hardware assumptions, so the reduction came from better algorithms and error correction, not from assuming better hardware. Second, on comparable hardware assumptions, breaking 256-bit elliptic curves now needs fewer resources than breaking RSA-2048. Google’s March 2026 paper estimates that its circuits “can execute in minutes using fewer than half a million physical qubits”. Third, the lowest qubit counts trade size for time and depend on a particular hardware type. The neutral-atom estimates assume a cycle a thousand times slower than the superconducting ones, which is why their runtimes are measured in days and months.
None of these machines exists. The Oratomic paper notes that recent neutral-atom experiments have shown “trapping arrays with more than 6,000 highly coherent qubits”, and also that “substantial engineering challenges remain”. A resource estimate shows how far away the target is. It does not show when the gap will close. For the mathematics behind the attack, see RSA, ECC and the mathematics quantum computers actually break.
The vendor dates: 2029
- Google, 25 March 2026. Google is “introducing a 2029 timeline to secure the quantum era with post-quantum cryptography (PQC) migration”. It cites progress on quantum hardware, error correction and factoring resource estimates, and says it has “adjusted our threat model to prioritize PQC migration for authentication services”.
- Cloudflare, 7 April 2026. Cloudflare now targets 2029 “to be fully post-quantum (PQ) secure including, crucially, post-quantum authentication”. Its intermediate milestones are stated as “subject to change”. Cloudflare already provides post-quantum encryption for the majority of its products.
- Microsoft, 30 June 2026. Microsoft is “accelerating the Microsoft Quantum Safe Program (QSP) timeline and the goal is to transition products and services to PQC by 2029”. This replaces the plan Microsoft published in August 2025, which aimed “to complete transition of its services and products by 2033” and “to enable early adoption of quantum-safe capabilities by 2029”. Reports that quote 2033 are citing the earlier plan.
All three are commitments about each company’s own products and services. None is a prediction that a quantum computer will exist in 2029. The common thread is authentication. Encryption can be protected in advance against harvest now, decrypt later attacks, but a signature or certificate only needs replacing before a capable machine exists. Upgrading authentication takes longer, and these vendors have brought that work forward.
The regulatory dates: 2030 to 2035
- UK, NCSC (published 20 March 2025). By 2028, define migration goals, carry out a full discovery exercise and build an initial plan. By 2031, carry out the early, highest-priority migration activities. By 2035, complete migration to PQC of all systems, services and products. The detail is in our post on the NCSC’s 2028, 2031 and 2035 milestones.
- EU, Coordinated Implementation Roadmap (version 1.1, June 2025). By 31 December 2026, initial national roadmaps and first steps. By 31 December 2030, the transition for high-risk use cases completed. By 31 December 2035, the transition for medium-risk use cases completed, and for low-risk use cases “as much as feasible”.
- US, NIST IR 8547 (initial public draft, November 2024). Quantum-vulnerable algorithms at the 112-bit security level would be deprecated after 2030, and all quantum-vulnerable algorithms disallowed after 2035. The document is still a draft.
- US, Executive Order 14412 (22 June 2026). Federal high value assets and high impact systems must use PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. Our post on OMB M-26-15 and EO 14412 covers what that means for suppliers.
Why the dates differ, and which one to plan to
The two sets of dates answer different questions. A regulator’s date is a floor: the point by which an organisation is expected to have finished, set for a whole economy that includes slow-moving sectors. A vendor’s date is a statement of what that vendor will deliver in its own products. Neither is a forecast of the year a cryptographically relevant quantum computer appears.
The useful planning question is not “when is Q-Day?” but “how long do we need, and how long must our data stay protected?” Two quantities drive the answer:
- Data shelf life. How long information encrypted today must stay confidential. Information that must stay secret for many years can be collected now and decrypted later, whatever the date of the first capable machine.
- Migration time. How long it takes to find, replace and verify the cryptography in an estate, including the parts that depend on vendors. Cloudflare’s assessment is that migrating authentication “will take on the order of years, not months”.
If shelf life plus migration time reaches past the point where a capable machine might exist, the data or system is already at risk. Michele Mosca made the same argument in 2015: “For systems that aim to provide long-term confidentiality, this migration should happen even sooner.” Applied to the dates above, a sensible position for most organisations is to treat the regulatory dates as the latest acceptable completion dates, and the vendor dates as a signal of where the supply chain is going. Systems with long-lived data or long-lived keys should be planned against the earlier end of the range.
What to do with this now
- Find the long-lived keys first. Cloudflare expects early attackers to go after keys that give lasting access, such as root certificates, API authentication keys and code-signing certificates. Its advice is direct: “Long-term keys should be upgraded first.”
- Classify data by how long it must stay secret. This sets which systems carry harvest now, decrypt later exposure today.
- Ask the vendors that matter. If major platform vendors are moving to 2029, your dependency on them will move too. Ask each critical supplier for its PQC timeline and how it will be delivered.
- Remove what blocks change. Hard-coded algorithms, protocols older than TLS 1.3 and systems that cannot be updated decide how fast a migration can go, whatever the target date.
- Give the board a range, not a date. A board can act on “regulators expect completion by 2035, our major vendors are targeting 2029, and our long-lived data is exposed now”. It cannot act on a single predicted year. Our guide to talking to your board about quantum risk covers the framing.
Where ECEM and Quantum Sentinel fit
Enterprise Cryptographic Exposure Management (ECEM) treats post-quantum readiness as a continuous six-stage lifecycle: Discover, Inventory, Assess, Prioritise, Transition, Monitor. Every step above depends on the first two stages. You cannot rank long-lived keys you have not found, or measure shelf-life exposure for systems you have not mapped.
Quantum Sentinel finds cryptography across networks, certificates and PKI, key managers and HSMs, cloud platforms, databases, source code and endpoints, and records every finding in a living Enterprise CBOM. RSA is scored by key size, hybrid post-quantum key exchange is reported by name, and harvest now, decrypt later exposure is informed by how long the data must stay confidential. Policy is evaluated continuously with drift detection, so the inventory stays current as vendor and regulatory dates move.
Frequently asked questions
When will quantum computers break RSA-2048?
No one knows, and the published research gives resource estimates rather than dates. As of October 2026, estimates for breaking RSA-2048 range from fewer than one million qubits running for under a week to fewer than 100,000 qubits running for about a month on superconducting hardware, and from about 11,000 qubits on neutral-atom hardware with much longer runtimes. No machine of that size exists yet.
How many qubits does it take to break RSA-2048?
It depends on the hardware assumed. Gidney and Ekerå estimated 20 million noisy qubits in 2019. Gidney reduced this to less than a million in 2025 under the same assumptions. Iceberg Quantum’s Pinnacle Architecture estimated fewer than 100,000 in 2026 using quantum LDPC codes, and Oratomic estimated 11,000 to 14,000 reconfigurable neutral-atom qubits, with runtimes far longer than the superconducting estimates.
Why are Google, Cloudflare and Microsoft targeting 2029?
Google set a 2029 timeline in March 2026, citing progress in quantum hardware, error correction and factoring resource estimates. Cloudflare followed in April 2026, and Microsoft accelerated its Quantum Safe Program to a 2029 goal in June 2026. These are targets for their own products and services, with an emphasis on post-quantum authentication. They are not predictions that a quantum computer will exist in 2029.
Is a 2035 deadline too late?
2035 is the completion date set by the NCSC, the EU roadmap and NIST’s draft transition plan, so it is the latest acceptable date rather than a target to aim at. Data that must stay confidential for many years is exposed to harvest now, decrypt later collection today, and migrations take years. Systems with long-lived data or long-lived keys should be planned against earlier dates, such as the 2030 dates for high-risk systems in the EU and US.
Is elliptic curve cryptography safer than RSA against quantum computers?
No. Both are broken by Shor’s algorithm, and on comparable hardware assumptions the 2026 estimates for elliptic curves are lower than those for RSA-2048. Google’s March 2026 paper estimates that a 256-bit elliptic curve discrete logarithm could be solved in minutes with fewer than half a million physical qubits. Both need to be replaced with post-quantum algorithms such as ML-KEM and ML-DSA.
Sources: Gidney and Ekerå, How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits (arXiv, May 2019; Quantum, 2021); Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits (arXiv, May 2025); Webster and others, The Pinnacle Architecture (arXiv, February 2026, revised May 2026); Babbush and others, Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities (arXiv, March 2026); Cain and others, Shor’s algorithm is possible with as few as 10,000 reconfigurable atomic qubits (arXiv, March 2026); Google, Quantum frontiers may be closer than they appear (25 March 2026); Cloudflare, Cloudflare targets 2029 for full post-quantum security (7 April 2026); Microsoft, Accelerating the quantum-safe timeline (30 June 2026) and its August 2025 quantum-safe progress update (20 August 2025); NCSC, Timelines for migration to post-quantum cryptography (20 March 2025); NIS Cooperation Group, A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (June 2025); NIST, IR 8547 initial public draft (November 2024); Mosca, Cybersecurity in an era with quantum computers: will we be ready? (IACR ePrint 2015/1075).
Further reading: harvest now, decrypt later, RSA, ECC and the mathematics quantum computers break, the NCSC’s migration timeline, how to talk to your board about quantum risk and what OMB M-26-15 and EO 14412 mean for suppliers.