How we calculate the quantum threat timeline and project when cryptographic systems become vulnerable.
Projection Calculator
For simplicity, we assume sufficient breakage when a quantum computer:
The error rate determines how many physical qubits are needed to implement a logical qubit. We use the surface code for our estimates, which was first discussed in a paper by Gidney and Ekerå [1], who estimated that over 20 million physical qubits would be required for the 14,238 logical qubits needed to factor RSA2048 using the best known algorithm for breaking RSA at the time.
We base our logical qubit estimates on more recent work. We use the algorithms by Chevignard, Fouque, and Schrottenloher [2] for RSA, and Hyeonhak and Hong [3] for ECC. These give us the following logical qubit estimates:
These estimates are from the papers, which base their logical qubit estimates on the number of quantum gates. Each gate is implemented with a specific number of logical qubits.
We assume that the number of physical qubits required to implement a logical qubit will be similar to that defined by the surface code quantum error correction method. This is based on the fact that the surface code is the most promising quantum error correction method. You can determine the surface code by setting the physical error rate (p), or the logical error rate (L) and related parameters above. The formula for the relationship between the parameters is provided by [1].
Most quantum computers have reported physical error rates around 10⁻³. Some claim error rates as low as 10⁻⁵. While the common understanding is that error rates get worse as more qubits are added, notably Willow and RIKEN both make claims of error rates shrinking as qubits are added. So we assume in most presets that the error rate will be 10⁻³ or better moving forward.
Like Moore's Law for classical computers, quantum computers appear to be following an exponential growth curve. We model this using exponential regression:
Q(t) = α × eβt
Where Q is physical qubits, t is time in months, and α, β are fitted parameters
By fitting this model to historical data, we can project future qubit counts with reasonable confidence. The exponential trend has held remarkably well since 2017.
Here's the catch: quantum computers are incredibly noisy. Individual qubits lose their quantum state (decohere) within microseconds, and quantum operations have error rates around 0.1-1%. To run complex algorithms like Shor's, we need much better reliability.
The solution is quantum error correction, specifically surface codes. The idea is to spread one "logical" qubit across many physical qubits, so errors can be detected and corrected.
The downside? You need a lot of physical qubits per logical qubit:
Physical Qubits = 2 × (d + 1)2
Where d is the "code distance" (typically 15 for breaking crypto)
With a code distance of 15, you need 512 physical qubits per logical qubit. This massive overhead is why we're not yet in danger—but it also means the threat arrives suddenly once we cross the threshold.
Based on published research on running Shor's algorithm with error correction:
| Cryptosystem | Logical Qubits | Physical Qubits (d=15) | What It Protects |
|---|---|---|---|
| ECC-256 | 1,673 | ~856,000 | Bitcoin, Ethereum, most crypto |
| RSA-2048 | 2,314 | ~1,184,000 | Banking, websites, email |
| RSA-4096 | 3,971 | ~3,033,000 | Government, high security |
Putting it all together:
tdoom = ln(target / α) / β
Where target = 1,673 × 512 = 856,576 physical qubits
(for ECC-256, the cryptography used by most cryptocurrencies)
This model makes several assumptions:
The clock should be viewed as a best estimate given current trends, not a precise prediction. The actual date could be earlier (breakthrough in hardware) or later (technical obstacles).
The good news: post-quantum cryptography already exists. NIST has standardized several quantum-resistant algorithms (CRYSTALS-Kyber, CRYSTALS-Dilithium, SPHINCS+) that can protect against quantum attacks.
The challenge is migration. Billions of devices, websites, and cryptocurrency wallets need to upgrade before the quantum threat materializes. That's why tracking the timeline matters.