Tofte Ventures

← All notes

What a Quantum Computer Actually Does to Your Passwords, Messages and Bitcoin

The sentence I hear most about quantum computing is that a quantum computer will be able to decrypt everything instantly. It is a confident, well formed answer, and it is wrong in two separate ways. That is the shape of most of what this blog is about, so I priced it the way we price everything else here: a small, tested module in the engine behind this site, with every published estimate written down next to where it came from and checked against arithmetic from its own paper.

The short version: a quantum computer is faster at breaking some encryption, not instant at breaking all of it, and the parts that matter to you are already being replaced.

Two algorithms, two different jobs

There are two quantum algorithms that matter for cryptography, and they do completely different things.

Shor's algorithm breaks public-key cryptography. That is RSA and elliptic curves: the maths that lets two strangers agree a secret over the internet, that signs website certificates, that makes a passkey work, and that controls every Bitcoin and Ethereum address. Classically these problems take longer than the age of the universe. Shor turns them into a long but finite computation.

Grover's algorithm searches for a key by brute force in the square root of the usual number of steps. That halves a key's strength in bits, and no more. It applies to AES, the cipher that actually encrypts your disk and the data inside a connection once the key has been agreed.

"Decrypt everything" merges the two, and "instantly" is wrong for both.

Both are simple enough to run small, so the engine does. Here is Shor factoring 55, simulated exactly. The trick is that factoring hides a rhythm. Take 2, 4, 8, 16 and so on, keep only the remainder after dividing by 55, and the sequence repeats every 20 steps. A quantum computer can't list that sequence any faster than you can, but it can make every step of it interfere at once, and the interference piles up at 20 evenly spaced outcomes. Read one, simplify a fraction, and out comes the 20. The rest is Euclid: 2¹⁰ leaves 34 after dividing by 55, and 33 and 35 share the factors 11 and 5 with 55.

A figure titled Shor's algorithm, simulated: factoring 55. The top panel plots 2 to the power x modulo 55 for x from 0 to 60 as glowing dots, a jagged pattern that repeats exactly every 20 steps, with dashed lines at x equals 20 and 40. The middle panel shows what the quantum Fourier transform reads out over 4,096 outcomes: 20 bright, evenly spaced spikes, 204.8 outcomes apart, and nothing in between. The bottom lines read: an outcome near 1,843; 1,843 over 4,096 is nearly 9/20, so the rhythm is 20; 2 to the 10 modulo 55 is 34, and the greatest common divisor of 33 and 55 is 11, and of 35 and 55 is 5; 55 equals 5 times 11.

At real sizes the idea is the same and the length is not. For 55 the rhythm is 20 steps long. For a real key it is a number hundreds of digits long, and building the interference takes billions of operations that each have to finish before the next one starts.

Shor is fast, not instant

The best published estimates are all for the same kind of machine: superconducting qubits with errors corrected by a surface code, at 0.1 percent error per operation and a one-microsecond cycle.

  • RSA-2048: 8 hours on 20 million qubits (Gidney and Ekerå, 2019), or under a week on under a million qubits (Gidney, 2025). Fewer qubits, longer run.
  • A 256-bit elliptic curve, the kind under Bitcoin, Ethereum and most web key exchange: 1,200 to 1,450 error-corrected qubits and 70 to 90 million Toffoli gates, under 500,000 physical qubits, and about 9 minutes per key from a primed state (Google Quantum AI, with Dan Boneh and Justin Drake, March 2026).

I can't verify those papers from here, so the engine checks them against their own arithmetic. Gidney and Ekerå publish formulas for their circuit. Run them for a 2,048-bit key and the part that has to happen one step after another, each step waiting ten microseconds for the control system, comes to 5.95 hours, just under the paper's 8. Run the 2026 curve estimate's gates one at a time at the same rate and a full run is 12 to 15 minutes, the same order as the paper's 9 from a primed state. Nothing is instant because the computation is serial: each layer has to wait for the one before it.

A dot plot titled Faster, not instant, showing the time to break one key on a log scale from a second to beyond 10 to the 20 years. For a 256-bit elliptic curve, one ordinary processor core needs about 9.6 times 10 to the 21 years, and the 2026 quantum estimate is about 9 minutes on under 500,000 qubits. For RSA-2048, a core needs about 6.3 times 10 to the 14 years, and the quantum estimates are 8 hours on 20 million qubits from 2019 and under a week on under a million from 2025. For AES-128, a core needs about 5.4 times 10 to the 21 years, and Grover needs 1.1 billion years on one machine, or 10 to the 18 machines to do it in a year. AES-256 is off the right edge either way, at about 2 times 10 to the 28 years with Grover. Orange marks Shor, which breaks the key; blue marks Grover, which halves it.

So "instant" is wrong, but "fast" is fair for elliptic curves. Nine minutes a key is a real threat. It is also nine minutes for one key on one very large machine, which means the first targets are keys worth a machine's time: government secrets, long-lived certificates, and very large crypto wallets. It is not everyone's data at once.

The machine does not exist yet

The largest machines today have about a thousand physical qubits. Atom Computing's has 1,180, IBM's Condor 1,121, and Google's Willow 105. Caltech has trapped 6,100 atoms in one array, but that array isn't yet running error-corrected circuits. The most error-corrected qubits anyone has shown is 96, by QuEra, from 448 atoms.

The curve estimate needs about 424 times the largest machine's physical qubits and 12.5 times the most error-corrected qubits anyone has shown. And the count is the easy part. Every one of those qubits has to run at 0.1 percent error, with a one-microsecond cycle, decoded in real time. Google's Willow showed the error correction working, for a single qubit of memory, in 2024.

Two log-scale bar charts titled The machine those estimates need does not exist yet. On the left, physical qubits: Google Willow 105, IBM Condor 1,121, Atom Computing 1,180 (the most in one machine), and a Caltech atom array of 6,100 atoms that is not yet running circuits, against what the estimates need: under 500,000 for a 256-bit curve in 2026, under 1,000,000 for RSA-2048 in 2025, and 20,000,000 for RSA-2048 in 2019. On the right, error-corrected qubits: QuEra's 96 from 448 atoms, against 1,200 to 1,450 for the curve and 6,189 for RSA-2048 by the 2019 formulas. The note says the curve estimate wants 424 times the largest machine's qubits and 12.5 times the most error-corrected qubits shown, and that every one has to run at 0.1 percent error with a 1 microsecond cycle, decoded in real time.

Nobody knows when that machine will exist, and the engine refuses to guess: the year is an input to everything below, never an output. The estimates have been falling fast, though. What is known is the trend: the qubit count for RSA-2048 dropped twentyfold between 2019 and 2025, and the curve estimate dropped by about as much again this year.

Grover barely matters

This is the part that gets overstated most. Grover takes a 128-bit key down to 64 bits of work, which sounds alarming, because 64 bits is breakable classically.

It isn't, for two reasons the engine computes. First, each Grover step has to run the whole cipher forward and back as a quantum circuit. AES-128 is 120 layers of the slow kind of gate, so a step is at least 240 of them, each waiting ten microseconds: 2.4 milliseconds a step, and 1.1 billion years for one machine. Second, Grover barely parallelises. Split the search over P machines and each finishes only √P times sooner, because each searches a smaller space at the square root of the cost. Doing AES-128 in a year takes about 10¹⁸ machines. Even if a whole step took a single microsecond, it would take 200 billion.

The engine checks that square-root rule against a simulated quantum register, flipping and reflecting a real state vector for up to 16,384 keys. Here it is on 256. Each step nudges probability toward the right key, and after 12 steps it is right 99.99 percent of the time. Keep going and the search rotates straight past the answer: by step 25 it is almost gone, and it comes back at step 37. It is a search you have to stop at the right moment, and that moment is about three quarters of the square root of the number of keys.

A figure titled Grover's search, simulated. Fifty-one stacked rows, one per step from step 0 at the back to step 50 at the front, each a line across 256 keys. One key's needle rises out of the flat rows, peaking at step 12 at 99.99 percent, labelled the right key almost every time; it falls to 0.23 percent at step 25, labelled run it too long and it is gone, and rises again to 99.95 percent at step 37, labelled and back again. The other 255 keys fade from 1 in 256 toward nothing as the right one rises. Heights are probability, on a linear scale, from a real 256-amplitude state vector.

And AES-256, which is what disk encryption mostly uses, keeps 128 bits after halving.

What it means for your things

The risk isn't speed. It's time. Two things make a future machine dangerous today.

Harvest now, decrypt later. Encrypted traffic recorded today can be decrypted whenever the machine arrives. If something has to stay secret for longer than it will take that machine to exist, it is already exposed. That is Mosca's inequality, and it is the whole calculation: years it must stay secret, plus years to switch, compared with years until the machine.

Keys that are already public. A Bitcoin address that has ever spent, or was reused, or uses Taproot, has its public key on the chain permanently. About 6 to 7 million bitcoin sit in addresses like that, 2.3 million of them dormant, and those can be emptied whenever the machine exists. An address you have never spent from only shows a hash of its key, so there is nothing for Shor to work on. Spending from it reveals the key and starts a race against the next block. Blocks come at random every 10 minutes on average, so a 9-minute break wins before the next block 41 percent of the time. That is the Google paper's own number, and the engine gets it independently, from nothing but the randomness of block times.

Here is the full list. Pick how long something has to stay secret and the year you think the machine arrives, and see what changes.

Open in Tofte Simulators

The good news is that the fix for the most important row is already running. NIST standardised post-quantum algorithms in August 2024. Chrome, Edge and Firefox now use a hybrid of the old key exchange and the new one by default, and by April 2026 more than half of the human web traffic reaching Cloudflare was protected that way. Signal and iMessage added post-quantum key agreement in 2023 and 2024. Most people are already using post-quantum encryption and have never noticed.

The rest of the list is mostly reassuring. Passwords are limited by how guessable they are, not by the computer. An authenticator app's six digits expire in thirty seconds and keep 80 bits of secret. ResetKit's codes sit in the same place. Passkeys use elliptic curves, so they will need replacing. But an attacker needs both the site's copy of your public key and a machine that doesn't exist, and a passkey is far better than a password today.

What to actually do

  • Keep your browser, phone and messaging apps updated. That is how the post-quantum switch reaches you, and it is most of the work.
  • Use a password manager, and passkeys or an authenticator app, exactly as before. Quantum computing changes nothing about this advice.
  • If you hold crypto, don't reuse addresses, and move long-term holdings off any address whose public key is already on the chain. That is the one consumer asset with a real quantum exposure and no update that fixes it for you. The wallet tracker only reads addresses, and reading is all it will ever do.
  • Ignore anything sold to you as "quantum-proof". The new algorithms rest on the hardness of lattice and hash problems. That is a well studied conjecture, not a proof, and no honest vendor promises more than that.

The list is short, and that is the point. The panic is mostly aimed at the wrong half of the cryptography.

What is computed and what is transcribed

The engine computes Grover's success against a simulated register, the square root of the machines, the serial floors from Gidney and Ekerå's formulas, the block race, a classical collision search against 3,000 simulated runs, and the number field sieve scaled from RSA-250's 2,700 core-years. That last one is an extrapolation over 1,200 bits and good to an order of magnitude at best.

The papers' estimates, the hardware counts, the rollout figures and the bitcoin totals are transcribed from summaries, because this network can search for those papers but can't open them. Each is marked unverified in the engine with its source, and none is used without the arithmetic check above where one exists. When a quantum computer arrives is not in there at all, because nobody knows.