A cryptographically relevant quantum computer, or CRQC, is a machine powerful enough to run Shor’s algorithm at the scale needed to break the public-key cryptography that secures almost all digital communication. No such machine exists in 2026, and the largest quantum computers are still many generations short of one. Yet the prospect already drives a global migration to post-quantum cryptography, because data stolen today can be decrypted once a CRQC arrives. This guide explains what a cryptographically relevant quantum computer requires, which companies are closest, what the experts expect, and how to prepare.
1. No CRQC exists yet. Breaking RSA-2048 needs thousands of error-corrected logical qubits running deep circuits, and the best machines today field only dozens of logical qubits. The gap is large.
2. The bar keeps moving. Better algorithms have cut the estimated physical-qubit cost of breaking RSA-2048 from around 20 million to under a million, so the threshold is getting easier to reach even before hardware catches up.
3. The mid-2030s is the consensus window. Most surveyed experts put a meaningful probability on a cryptographically relevant quantum computer appearing within a decade, with the heaviest weight around 2030 to 2035.
4. Harvest now, decrypt later is the live threat. Adversaries can store encrypted data today and decrypt it once a CRQC exists, which puts long-lived secrets at risk right now.
5. The fix is already standardised. The United States finalised post-quantum cryptography standards in 2024, and the migration to them is the practical defence against the quantum threat.
6. Watch logical qubits, not physical ones. Roadmaps from IBM, Google, Quantinuum, IonQ and PsiQuantum should be judged on error-corrected logical qubits, the real measure of progress toward a CRQC.
What is a cryptographically relevant quantum computer?
A cryptographically relevant quantum computer is defined by capability rather than size, meaning a machine that can actually break the encryption protecting today’s data. The specific danger is Shor’s algorithm, which lets a large enough quantum computer factor the huge numbers behind RSA and solve the discrete-logarithm problem behind elliptic-curve cryptography. Those two problems underpin the public-key systems used for secure web traffic, software updates, payments and digital signatures.
Symmetric encryption such as AES is far less exposed, because the best quantum attack only effectively halves its key length, so AES-256 stays secure. The threat is concentrated in public-key cryptography, where a working CRQC would be catastrophic rather than merely inconvenient. That asymmetry is why the global response focuses on replacing public-key algorithms rather than abandoning encryption altogether.
How many qubits does it take to break encryption?
The honest answer is that the requirement is large and falling, because it depends on both the target algorithm and the efficiency of the error correction wrapped around the qubits. The headline figure most often cited is for RSA-2048, the workhorse of internet security, and the estimates have dropped sharply as researchers improve the underlying methods. The table below summarises the rough scale of the problem for the main public-key targets.
| Encryption target | Logical qubits (approx.) | Physical qubits (approx.) | Status today |
|---|---|---|---|
| RSA-2048 | ~4,000 | under 1 million (down from ~20 million) | far out of reach |
| ECC-256 | ~2,300 | hundreds of thousands | far out of reach |
| RSA-3072 | ~6,000 | over 1 million | far out of reach |
| AES-256 (symmetric) | not broken | not broken | quantum-safe |
Two points matter more than the exact numbers in that table. First, the gap between thousands of logical qubits and the dozens that exist today is enormous, since each logical qubit may consume a thousand or more physical qubits once error correction is included. Second, the physical-qubit estimate for breaking RSA-2048 has fallen by more than an order of magnitude in a few years, so a CRQC is becoming easier to build even while it stays out of reach.
How close are the companies?
No company has a CRQC, and none claims one, so the useful question is whose roadmap reaches the required scale first. The assessments below judge the leading hardware makers on their largest current systems and their stated targets for error-corrected logical qubits. Every verdict is the same today, but the timelines and the credibility behind them differ.
What the assessments show
The pattern across every platform is identical, with strong progress on physical qubits and early logical-qubit demonstrations but nothing within several generations of code-breaking. Trapped-ion makers lead on quality while neutral-atom and superconducting makers lead on raw count, and photonics bets on jumping straight to scale. The race to a CRQC is therefore a race to thousands of stable logical qubits, not to headline physical-qubit records.
Expert timelines and the Mosca survey
Because no machine is close, timelines come from expert judgement rather than measurement, and the most cited source is the annual survey of researchers run through the Global Risk Institute by the cryptographer Michele Mosca. Those surveys consistently show most experts assigning a meaningful probability to a CRQC within a decade, with the heaviest weight falling between 2030 and 2035. A minority sees it sooner and a minority sees it much later or never.
The spread matters as much as the central estimate, since security planning has to account for the earlier, less likely scenarios rather than the comfortable median. Mosca frames the risk through a simple inequality, comparing how long your data must stay secret and how long migration takes against the time until a CRQC exists. When the first two added together exceed the third, you are already exposed, which is why many organisations treat the threat as present rather than future.
Harvest now, decrypt later
The most immediate danger from a future CRQC is not a sudden break but a slow one that has arguably already begun, known as harvest now, decrypt later. Adversaries can capture and store encrypted traffic and files today, holding them until a CRQC can decrypt the public-key material that protected them. Anything with a long secrecy requirement, from state secrets and health records to intellectual property, is therefore at risk now.
This is what turns a distant hardware milestone into a current security problem for governments and enterprises. The data being stolen in 2026 does not need a quantum computer to be useful in 2035, only patience. That logic is the strongest argument for migrating to quantum-safe cryptography well before any CRQC appears.
How to prepare with post-quantum cryptography
The practical defence is post-quantum cryptography, a set of new algorithms designed to resist both classical and quantum attack, which the United States standardised in 2024. The National Institute of Standards and Technology published the first standards as FIPS 203 for key exchange, FIPS 204 and FIPS 205 for digital signatures, giving organisations approved replacements for vulnerable algorithms. Migration involves finding where public-key cryptography is used, prioritising long-lived secrets and upgrading systems to the new standards.
Most large organisations are now building a cryptographic inventory and a phased migration plan rather than waiting for a CRQC to arrive. Our guide to the top post-quantum cryptography companies covers the vendors helping with that transition, and our explainer on what quantum supremacy means sets the milestones in context. The official national strategy that tracks the cryptographically relevant quantum computer threat coordinates the United States response.
When the CRQC threat matters for you
Long-lived secrets and regulated data
If your organisation holds data that must stay confidential for years or decades, the CRQC threat is a present concern rather than a future one. Government, defence, finance and healthcare all handle secrets whose shelf life exceeds the most pessimistic CRQC timelines, which puts them squarely inside Mosca’s inequality. These sectors are leading the migration to post-quantum cryptography for exactly that reason.
Vendors, infrastructure and signatures
Anyone who ships software, runs infrastructure or relies on digital signatures should also be planning, because public-key cryptography is embedded everywhere from device firmware to certificate authorities. Replacing it is a multi-year engineering effort that cannot start the day a CRQC is announced. Beginning the inventory now is the only way to be ready in time.
Post-quantum cryptography companies
US quantum companies
What is quantum supremacy?
Error-corrected quantum computers
Global quantum companies
Frequently asked questions
What is a cryptographically relevant quantum computer?
A cryptographically relevant quantum computer, or CRQC, is a quantum computer powerful enough to break the public-key cryptography that secures digital communication, mainly RSA and elliptic-curve cryptography. It does this by running Shor’s algorithm at a scale that needs thousands of error-corrected logical qubits. No such machine exists in 2026, and the largest quantum computers today have only dozens of logical qubits, so a CRQC remains several hardware generations away.
How many qubits are needed to break RSA-2048?
Breaking RSA-2048 requires roughly four thousand error-corrected logical qubits, which translates into a much larger number of physical qubits once error correction is included. Early estimates put the physical-qubit cost around 20 million, but improved algorithms have since lowered it to under one million for a run lasting days. Either way the requirement is far beyond today’s machines, which field only a handful of logical qubits.
When will a cryptographically relevant quantum computer exist?
Nobody knows, but the consensus among surveyed experts places a meaningful probability within a decade, with the heaviest weight between 2030 and 2035. The annual Global Risk Institute survey run by cryptographer Michele Mosca consistently shows this range, while a minority of experts expect it sooner and others much later. Because security planning must account for the earlier scenarios, many organisations treat the threat as effectively present.
Does a CRQC break all encryption?
No, the threat is concentrated in public-key cryptography rather than all encryption. A CRQC would break RSA and elliptic-curve cryptography through Shor’s algorithm, undermining secure web connections, signatures and key exchange. Symmetric encryption such as AES is far more resistant, because the best quantum attack only effectively halves the key length, so AES-256 remains secure against a CRQC.
What is harvest now, decrypt later?
Harvest now, decrypt later is an attack in which adversaries capture and store encrypted data today, intending to decrypt it once a CRQC becomes available. It turns a future hardware milestone into a present risk, because any secret that must stay confidential for years could already be sitting in an attacker’s archive. This is the main reason organisations are migrating to post-quantum cryptography before a CRQC exists.
Which company is closest to building a CRQC?
No company is close, and none claims a CRQC, so the comparison is about roadmaps rather than working machines. IBM, Google, Quantinuum, IonQ and PsiQuantum all target error-corrected systems over the next several years, with IBM’s published roadmap and PsiQuantum’s million-qubit photonic plan among the most specific. All of them are still many generations short of the thousands of logical qubits that code-breaking requires.
What is post-quantum cryptography?
Post-quantum cryptography is a family of encryption and signature algorithms designed to resist attack by both classical and quantum computers, including a future CRQC. The United States National Institute of Standards and Technology standardised the first of these in 2024 as FIPS 203 for key exchange and FIPS 204 and 205 for digital signatures. Migrating systems to these standards is the practical defence against the quantum threat to public-key cryptography.
How should organisations prepare for the quantum threat?
The recommended approach is to build a cryptographic inventory, identify where vulnerable public-key cryptography is used, prioritise data with long secrecy requirements and migrate to the new post-quantum standards in phases. Mosca’s inequality offers a simple test, comparing how long your data must stay secret plus how long migration takes against the time until a CRQC exists. If the first two exceed the third, you are already exposed and should begin migrating now.
