How many qubits does it take to break RSA-2048?

The shrinking resource estimate

One reason for urgency: the theoretical resources required to break RSA-2048 using Shor's algorithm have fallen sharply as researchers refine the underlying circuits — well before any hardware capable of running them exists.

1. 1996

   ~10,241 qubits — Beckman, Chari, Devabhaktuni & Preskill

2. 2003

   ~4,099 qubits — Beauregard's 2n+3 circuit

3. 2014

   ~18,434 qubits — Pavlidis & Gizopoulos (lower circuit depth, more qubits)

4. 2021

   ~20,000 logical qubits — Gidney & Ekerå; ~20M physical qubits, 8-hour runtime

5. 2024

   ~1,730 logical qubits — Chevignard et al.; roughly 0.85 × modulus size

6. 2025

   <1M physical qubits — Gidney (Google); improved qubit storage & state preparation

Every one of these remains far beyond current hardware, which tops out around a few thousand noisy physical qubits with no full error correction. The trend, not the current feasibility, is what has driven NIST and national security agencies to act now: cryptographic migrations of this scale take five to fifteen years to complete, so waiting for the hardware to arrive would already be too late.