What is a cryptographically relevant quantum computer?
A cryptographically relevant quantum computer, or CRQC, is a quantum computer large and reliable enough to break the public-key cryptography in use today, such as 2048-bit RSA and the elliptic-curve methods behind most secure connections. No such machine exists today. The term exists so that people can talk precisely about the threat without implying that every quantum computer is one.
What makes a quantum computer "cryptographically relevant"?
Running Shor's algorithm against real key sizes needs billions of reliable operations. Physical qubits make errors, at rates that vary by hardware platform and by operation; on today's best machines it's roughly one mistake every few hundred to few thousand operations. So a CRQC has to use error correction: many fragile physical qubits working together as one reliable logical qubit.
- Enough logical qubits. Published attack designs for 2048-bit RSA use over a thousand logical qubits. Other designs, and future improvements, may need more or fewer.
- Low enough error rates. The physical qubits must be good enough for error correction to work at all.
- Enough time. The calculation runs for hours or days, so the machine must stay stable that long.
One published model, Google researcher Craig Gidney's 2025 estimate, puts breaking 2048-bit RSA at under a million noisy physical qubits running for less than a week, under specific assumptions about error rates and hardware speed. It's a useful benchmark, not a fixed threshold or a prediction of when such hardware will exist. Today's largest machines have hundreds to low thousands of physical qubits.
CRQC versus the quantum computers in the news
| Today's machines | A CRQC | |
|---|---|---|
| Qubits | Hundreds to low thousands of physical qubits | Under a million noisy physical qubits in one 2025 estimate; depends on assumptions |
| Error correction | Early demonstrations of logical qubits | Over a thousand logical qubits in published designs |
| Threat to RSA and ECC | None | Breaks them |
Why the term matters for banks
Precise language keeps planning calm. A bank doesn't need to react to every quantum headline, because most announcements are about physical qubit counts or narrow experiments. What it needs is a plan that assumes a CRQC could exist within the lifetime of today's sensitive data. The day one first exists is often called Q-day.
Watch logical qubits, error rates and resource estimates, not raw qubit counts. Those are the numbers that move the CRQC timeline.
Common confusions
- "A 1,000-qubit chip is a quarter of the way there." No. A thousand physical qubits is a long way from a thousand logical ones.
- "A CRQC breaks all encryption." It breaks public-key methods like RSA and elliptic curve. AES with 256-bit keys and modern hashes remain strong.
- "Someone must know the date." No one does. Expert estimates range widely.
Sources and further reading
Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- PreprintHow to factor 2048 bit RSA integers with less than a million noisy qubitsCraig Gidney, 2025
- Peer-reviewed paperHow to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubitsCraig Gidney and Martin Ekerå, Quantum, 2021
- Peer-reviewed paperQuantum Computing in the NISQ era and beyondJohn Preskill, Quantum, 2018
- ExperimentQuantum error correction below the surface code thresholdGoogle Quantum AI and collaborators, Nature, 2024