Secure

Secure

Is your encryption ready for a quantum computer? Live tools, no sign-up.

Quick CheckIs this endpoint quantum-safe?One paste, one answer.

Why the timing matters

Estimates in this field can move by orders of magnitude in a few years. The clearest case, with every number sourced to a primary paper: how many physical qubits it would take to steal one Bitcoin key inside the ten-minute window before your transaction confirms.

2022 estimate Webber et al. 1.9 billion 2026 estimate Babbush et al. under 500 thousand IBM Condor, 2023 largest superconducting chip 1,121 Google Willow, 2024 runs below threshold 105 10² 10⁴ 10⁶ 10⁸ physical qubits (logarithmic: each tick to the right is 100×)

← swipe the diagram to see all of it →

The same attack got 3,800× cheaper in four years. Webber et al. (AVS Quantum Science, 2022) costed the racing attack at 1.9 billion physical qubits. In March 2026 Babbush, Zalcman, Gidney et al. (Google Quantum AI, the Ethereum Foundation and Stanford; arXiv:2603.28846) re-costed it at under half a million, partly because the first half of Shor’s algorithm can be precomputed before your transaction appears. Against IBM’s 1,121-qubit Condor that is at most 2.6 orders of magnitude away, not the 6.2 of 2022; against Google’s 105-qubit Willow, the only machine here that runs error correction below threshold, it is at most 3.7. The axis is logarithmic, so the short yellow bars are much further from the others than they look. The full numbers, with caveats ▸
Cain et al., 2026 as few as, slower 10,000 Cain et al., 2026 for P-256, in days 26,000 Caltech array, 2025 trapped, not computing 6,100 10² 10⁴ 10⁶ 10⁸ physical qubits (logarithmic: each tick to the right is 100×)

← swipe the diagram to see all of it →

A slower machine needs far fewer qubits, but it cannot race your transaction. Cain et al. (arXiv:2603.28627) count reconfigurable neutral atoms, whose cycles take milliseconds, not microseconds: as few as 10,000 atoms can run Shor’s algorithm, and 26,000 could solve a P-256 discrete logarithm in a few days. Days is fine for a key that sits exposed on the chain, and useless against the ten-minute confirmation window. The largest array on record holds 6,100 trapped atoms, only 4.3× short of the higher figure, but trapping atoms is not computing with them: the paper reports computation on arrays of hundreds.

Learn the ideas

How does cryptography work, before and after Shor?Ten topics, every number checked What does Shor take, and what does it leave?Three locks fall, two only dent

Live tools

Quick CheckOne paste, one answer The Size CliffWhat post-quantum actually costs in bytes The InventoryRead your own certificates and keys The ProofRun ML-KEM and ML-DSA yourself

The argument

Can quantum break Bitcoin?The numbers, not the panic Isn't QKD the actual fix?Short answer: not for this Is it too late to start?Mosca's inequality, with your numbers

Play the threat

Can you order the migration?Q-Day Command: what goes first, before the date What is the lattice problem?Lattice Heist: the idea under ML-KEM What does Shor's algorithm leave to do?Shor's Clockwork: the classical finish
About How we check AI use Corrections Privacy Terms