Quantum Computing Timeline: When Will RSA Break?

When will a quantum computer actually break RSA-2048? The honest answer is: nobody knows for certain — but the estimates are converging, and the planning horizon is clear enough to act now.

What "Breaking RSA" Requires

To break RSA-2048 with Shor's algorithm, you need a cryptographically relevant quantum computer (CRQC): a fault-tolerant quantum machine with thousands to millions of stable, error-corrected logical qubits. Today's quantum computers have noisy physical qubits in the hundreds, far short of what is needed.

The Estimates

• Conservative / industry mainstream: 2030-2035 for a CRQC capable of breaking RSA-2048.
• Aggressive: some researchers suggest late 2020s under optimistic scaling.
• Skeptical: a minority argue 2040+ or that engineering obstacles may delay it indefinitely.

Most serious forecasts — from NIST, the US National Academies, the Global Risk Institute, and major consultancies — cluster around 2030-2035.

Why the Uncertainty

• Error correction overhead: each reliable logical qubit may require hundreds to thousands of physical qubits. Scaling physical qubits is necessary but not sufficient.
• Decoherence and noise: qubits lose their state quickly; keeping them stable long enough to run Shor's algorithm is hard.
• Engineering, not just physics: control electronics, cryogenics, calibration and software must all scale.
• Secret progress: some state quantum programs are classified; public milestones may understate capability.

Why You Should Not Wait for Certainty

The arrival date matters less than two other numbers:

1. How long must your data stay confidential? If the answer is 20-30 years, a 2035 quantum computer threatens data encrypted today.
2. How long will migration take? Large organisations need 5-10 years to migrate cryptography across their estate.

If migration takes 8 years and a CRQC arrives in 2033, you must start by 2025. Many organisations are already behind.

The Mosca Framework

Michele Mosca's classic framing: if X = years data must stay secure, Y = years to migrate, and Z = years until a quantum computer, then you are at risk when X + Y > Z. For most long-lived data, this inequality is already true.

What This Means for Planning

• Treat the quantum arrival date as uncertain but within a decade.
• Plan for the conservative case (2030), not the hopeful one.
• Start migration now so you finish before the earliest plausible arrival.
• Protect long-lived data with quantum-resistant encryption immediately.

Bottom Line

No one can give you an exact date. But the convergence of expert estimates, the long migration timelines, and the long confidentiality requirements of real data all point the same way: act as if a quantum computer could arrive within the next decade. If you wait until you are certain, it will be too late for the data that matters most.