Future 4 November 2026 6 MIN READ
What Quantum Computers Can and Cannot Do
Qubits, errors, advantage claims and the threat to encryption, with every result labelled as demonstrated, claimed by a company or projected.
THE SHORT ANSWER
Quantum computers use qubits whose behaviour can speed up a few specific tasks, such as simulating molecules or breaking public-key encryption. Errors are the main obstacle. Error correction is advancing, but machines big enough to break RSA do not exist, and the migration to new standards has already begun.
On this page
Bits, qubits and a common misunderstanding
A qubit can be in a superposition of its two states, but when you measure it you get a single definite answer. NIST is careful about this point: superposition is not “trying every answer at once” when the result is read out. Entangled qubits have correlated results: measure one and the result of the other is fixed.
A quantum computer is useful only for tasks where an algorithm can turn those effects into a correct answer with high probability. That list is shorter than the headlines suggest.
The real problem is errors
Even the best quantum hardware fails about once every thousand operations, according to Google. A normal chip fails far less often than that. So most of the engineering effort goes into error correction: many noisy physical qubits are grouped into one more reliable logical qubit. It only works if the physical error rate is below a threshold, and below it, logical errors fall exponentially as you add qubits.
In December 2024, Google’s Willow chip gave the first clear demonstration of that scaling on superconducting hardware. Each step up in the size of the error-correcting code, from 3×3 to 5×5 to 7×7, roughly halved the error rate. The largest logical memory outlived its best single physical qubit by a factor of 2.4. There are two important limits. It was a memory, not a logical computation, and Google found rare correlated errors, about one an hour, that capped performance and whose origin was not understood at publication.
Since then, results have kept coming, mostly from the companies themselves. Treat each for what it is.
- Demonstrated and peer-reviewed. Google reported in 2026 that a technique called magic state cultivation, needed for universal fault-tolerant computing, cut errors roughly 40-fold on Willow. A Harvard-led team used arrays of up to 448 neutral atoms to demonstrate key elements of a fault-tolerant design, including below-threshold performance in a short circuit. Quantinuum’s Helios, a 98-qubit trapped-ion machine, has measured an average two-qubit infidelity of 7.9 in 10,000 in a peer-reviewed paper.
- Company claims. In October 2026 Quantinuum reported logical fidelity of 99.9995%, five errors per million operations, with each step up in code size cutting logical errors by a factor of 12. That comes from a press release. The same company’s benchmark with 48 to 94 “logical qubits” uses error-detecting codes with discarded runs, which is not the same as full error correction.
- Roadmaps. IBM plans a modular, error-corrected machine called Starling, with 200 qubits running 100 million gates, for clients in 2029, and a larger one, Blue Jay, from 2033. A roadmap is a promise, not a measurement.
“Logical qubit” is used loosely, so ask what was shown: a memory, a detection code or a computation.
“Quantum advantage” claims, read carefully
Sampling tasks are designed to be hard for classical computers. Google says Willow ran such a benchmark in under five minutes, a task it estimates would take the Frontier supercomputer 10²⁵ years. That is a contrived task with a classical-cost estimate. In October 2025 Google also reported a verifiable “Quantum Echoes” experiment on 103 qubits that took about two hours; Google estimates a classical supercomputer would take about 13,000 times longer. Google’s own account says the link to the application, molecular structure, was not beyond classical computing in that experiment.
Advantage claims also get challenged. IBM and the University of Chicago announced a sampling advantage on 30 July 2026. Within about two weeks, other researchers reported computing all 2,051 published output amplitudes classically in 37.3 minutes on 32 nodes of 8 GPUs, undercutting the “beyond practical reach” framing. There is a caveat: they computed amplitudes for known outputs, which is not identical to generating samples. The numbers in IBM’s press release also differ from the abstract of the latest version of its paper.
As of December 2024, the physicist John Preskill saw no commercially valuable application on today’s noisy machines that had shown an advantage over the best classical methods, and no persuasive argument that such applications exist without error correction. Scott Aaronson’s short list of likely uses is simulating quantum physics and chemistry, breaking public-key cryptography with Shor’s algorithm, and perhaps a modest optimisation speed-up, which is the least certain of the three.
What it would take to break today’s encryption
The estimates for breaking RSA-2048 have shrunk, and they all assume hardware that does not exist yet.
- 2012: about a billion physical qubits (Google’s summary).
- 2019: 20 million noisy qubits and about 8 hours, by Craig Gidney and Martin Ekerå.
- 2025: under one million noisy qubits and under a week, by Gidney. The assumptions are a 0.1% gate error rate and fast control, the same as in 2019, so the saving comes from better algorithms, not better machines.
For comparison, Google’s own summary says the machines with relevant error rates have around 100 to 1,000 qubits. Newer preprints go lower still: Iceberg Quantum claims fewer than 100,000 qubits using different codes, a claim Aaronson called plausible but unverified, because the codes need connections that are hard to build. In March 2026, a Google estimate put 256-bit elliptic-curve cryptography within reach of fewer than half a million physical qubits, in minutes. Elliptic-curve keys are shorter than RSA keys, so they are expected to fall first.
The Global Risk Institute’s 2025 survey of 26 experts gives a 28–49% chance of a cryptographically relevant quantum computer within 10 years, and 51–70% within 15.
The defence already exists
The urgent threat is “harvest now, decrypt later”: record encrypted traffic today, decrypt it when a capable machine exists. NIST approved three post-quantum standards on 13 August 2024: FIPS 203 (ML-KEM, for key exchange), FIPS 204 (ML-DSA, for signatures) and FIPS 205 (SLH-DSA, hash-based signatures). In March 2025 it selected HQC as a backup based on different mathematics.
The timetable is public. NIST’s final report in October 2026 says quantum-vulnerable public-key algorithms such as RSA and elliptic curves are deprecated after 2030 and disallowed after 2035, with earlier deadlines for the most sensitive US government systems. Symmetric algorithms such as AES are not expected to be replaced. Google has set 2029 as the target for its own migration, starting with signatures.
What to watch next
- Logical operations: error-corrected computation, not just memory, and at scale.
- Independent replication: advantage claims that survive a classical rebuttal.
- Logical error rates over time: the numbers that matter are per operation, and published openly.
- Your own migration: draw up an inventory of where RSA and elliptic-curve cryptography are used.
Our take: real physics, early engineering. Quantum computers are making measurable progress on errors, which is the hard part. They are not close to breaking today’s encryption, but the defence takes years to deploy, which is why the standards already exist and the migration should start now.
Questions and answers
Can a quantum computer break encryption today?
No. The best published estimate, by Craig Gidney in 2025, needs under one million noisy qubits for RSA-2048, while the machines with relevant error rates have around 100 to 1,000 qubits.
What is a logical qubit?
A more reliable qubit made by grouping many physical qubits with error correction. The term is used loosely, so check whether a result is a memory, an error-detecting code or a real computation.
What is post-quantum cryptography?
Public-key algorithms believed to resist quantum computers. NIST approved the first three standards, FIPS 203, 204 and 205, on 13 August 2024, and its 2026 report deprecates RSA and elliptic curves after 2030.
Is quantum advantage real?
On contrived sampling tasks, companies claim it, and classical computing has challenged some of those claims. A commercially useful advantage has not been shown, according to expert assessments like John Preskill's.
Do you agree?
Take it to Chevlume: write your view, add your sources and let others answer. The closed alpha is by invitation.
Keep reading
Knight Capital: 45 Minutes, $460 Million
A forgotten code path on one of eight servers cost a trading firm $460 million in 45 minutes. What the SEC found about deployment and controls.
FUTURE / DISCOVERYBelgium 2003: The 4,096 Extra Votes
One candidate, 4,096 phantom votes and a bit flip. What the official report concluded, and what later retellings added about cosmic rays.
BIOTECH / DISCOVERYTherac-25: When Software Was the Only Safety Net
Six overdoses between 1985 and 1987 from a radiation machine whose safety rested on software. What the Leveson and Turner investigation found.
Sources
- Quantum Computing Explained · NIST · Accessed
- Entanglement for quantum computing explainer · NIST · Accessed
- Making quantum error correction work · Google Research · Accessed
- Quantum error correction below the surface code threshold · Nature (Google Quantum AI) · Accessed
- Meet Willow, our state-of-the-art quantum chip · Google (blog.google) · Accessed
- A verifiable quantum advantage · Google Research · Accessed
- Bringing the magic: Google breaks open a bottleneck in quantum computing · Google (blog.google) · Accessed
- Quantinuum Breaks Error-Correction World Record by 10x, Validating Its Leading Path to Fault-Tolerant Quantum Computing by 2029 · Quantinuum (press release) · Accessed
- A 98-qubit trapped-ion quantum computer with all-to-all connectivity · Nature (Quantinuum) · Accessed
- Computing with many encoded logical qubits beyond break-even · arXiv (Quantinuum) · Accessed
- Quantum 2030 - IBM Technology Atlas · IBM · Accessed
- IBM and The University of Chicago Demonstrate Quantum Advantage, Establishing Trusted Quantum Computation on Logical Circuits · IBM Newsroom · Accessed
- Classical Simulation and Design Frontiers for IBM's Doped Clifford Sampling Experiment · arXiv · Accessed
- A fault-tolerant neutral-atom architecture for universal quantum computation · Nature · Accessed
- Beyond NISQ: The Megaquop Machine · ACM Transactions on Quantum Computing (J. Preskill, Caltech) · Accessed
- Quantum Machine Learning Algorithms: Read the Fine Print · S. Aaronson (author site, PDF) · Accessed
- How to factor 2048 bit RSA integers with less than a million noisy qubits · arXiv (Google Quantum AI) · Accessed
- How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits · Quantum (journal) (C. Gidney, M. Ekera) · Accessed
- Tracking the Cost of Quantum Factoring · Google (blog.google) · Accessed
- Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations · arXiv (Google Quantum AI, Stanford, Ethereum Foundation) · Accessed
- The Pinnacle Architecture: Reducing the cost of breaking RSA-2048 to 100 000 physical qubits using quantum LDPC codes · arXiv (Iceberg Quantum) · Accessed
- On reducing the cost of breaking RSA-2048 to 100,000 physical qubits · Shtetl-Optimized (S. Aaronson) · Accessed
- Executive Summary: Quantum Threat Timeline Report 2025 · Global Risk Institute / evolutionQ · Accessed
- Announcing Approval of Three Federal Information Processing Standards (FIPS) for Post-Quantum Cryptography · NIST · Accessed
- NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption · NIST · Accessed
- Transition to Post-Quantum Cryptography Standards (NIST IR 8547) · NIST · Accessed
- Quantum frontiers may be closer than they appear · Google (blog.google) · Accessed
Published
Discuss on X