Table of Contents
- The Number That Gets Reported
- Why Qubits Are So Fragile
- Error Correction Cannot Copy
- The Overhead Problem
- What Threshold Means
- Where the Hardware Approaches Differ
- What Quantum Computers Would Actually Be Good At
- Why Cryptography Migration Cannot Wait
- Common Misconceptions
- Conclusion
- Frequently Asked Questions
Key takeaway: A useful quantum computation needs error-corrected logical qubits, and each logical qubit currently requires hundreds to thousands of physical ones. Raw qubit count without error correction is not the metric that determines capability.
The Number That Gets Reported
Announcements describe qubit counts. A processor with a hundred qubits, then a thousand, with the implication of steady progress toward usefulness.
The number is real and it is not the constraint. A thousand physical qubits that lose their state within microseconds cannot run an algorithm requiring millions of sequential operations. Capability depends on qubits that stay coherent long enough and operate accurately enough to complete a computation, and those are different properties from how many exist.
The metrics that actually determine what a machine can do:
Coherence time. How long a qubit maintains its quantum state before environmental interaction destroys it. Measured in microseconds to milliseconds depending on the technology.
Gate fidelity. The accuracy of each operation. Current best figures are around 99.9 percent for two-qubit gates, which sounds excellent and is not — an algorithm with ten thousand gates accumulates substantial error at that rate.
Connectivity. Which qubits can interact directly. Limited connectivity means additional operations to move information, each adding error.
Logical qubit count. How many error-corrected qubits the machine provides. This is the number that matters and it is currently very small.
The gap between physical and logical qubit counts is the entire story of quantum computing’s timeline, and it is why a machine with a thousand physical qubits may provide only a handful of logical ones.
Why Qubits Are So Fragile
The fragility follows from what makes quantum computation powerful, which means it cannot simply be engineered away.
A classical bit is a robust macroscopic state — a voltage level, a magnetic domain. Distinguishing zero from one has enormous margin, which is why classical computers are reliable.
A qubit holds a superposition, which is a delicate relationship between two states including their relative phase. Any interaction with the environment that reveals information about that state collapses it. This is decoherence, and the environment includes stray electromagnetic fields, thermal vibrations, cosmic rays, and the measurement apparatus itself.
The consequence is that quantum states must be isolated extremely well while remaining controllable — a direct tension, because control requires interaction and interaction causes decoherence.
The error types that arise are more varied than in classical computing. Bit-flip errors, where the state inverts. Phase-flip errors, where the relative phase changes, which has no classical analogue. Leakage, where the qubit exits the computational states entirely. Crosstalk, where operating on one qubit disturbs its neighbours. And correlated errors, where a single event affects many qubits simultaneously — cosmic ray strikes have been observed doing this.
That final category is particularly troublesome, because error correction schemes generally assume errors are independent. Correlated errors violate the assumption the correction depends on.
Error Correction Cannot Copy
Classical error correction is straightforward in principle: store several copies, compare them, take the majority. Quantum mechanics prohibits this.
The no-cloning theorem establishes that an unknown quantum state cannot be copied. This is not an engineering limitation but a consequence of the mathematics — copying would permit determining the state, which would collapse it.
Worse, measurement destroys superposition. Checking whether a qubit has an error, by measuring it, destroys the state you were protecting.
Quantum error correction resolves this with a genuinely clever construction. The logical state is spread across many physical qubits in an entangled pattern. Additional qubits are then measured — but they are measured in a way that reveals whether an error occurred without revealing the logical state itself. These syndrome measurements detect the error’s signature while leaving the protected information untouched.
The surface code is the most studied implementation. Physical qubits are arranged in a two-dimensional lattice; alternating qubits store data and perform syndrome measurement. The pattern of syndrome results identifies where an error occurred, and a classical decoder determines the correction.
The properties that make it attractive: it requires only nearest-neighbour interactions, which suits planar hardware, and its threshold is relatively forgiving compared to alternatives. The cost is the overhead, which is the subject of the next section.
The Overhead Problem
Here is the number that determines the timeline.
Under the surface code, protecting one logical qubit requires a lattice of physical qubits, and the lattice must be larger for lower logical error rates. The relationship depends on the physical error rate — better hardware needs less overhead.
Illustrative figures for the scale involved:
| Physical error rate | Physical qubits per logical qubit | Notes |
|---|---|---|
| 10⁻³ | ~1,000–10,000 | Near current best |
| 10⁻⁴ | ~100–1,000 | Requires significant improvement |
| 10⁻⁵ | ~50–100 | Substantially beyond current capability |
Now apply this to a useful computation. Estimates for factoring a cryptographically relevant number suggest thousands of logical qubits are needed. At a thousand physical qubits per logical qubit, that is millions of physical qubits.
Current systems have hundreds to low thousands of physical qubits.
The gap is several orders of magnitude, which is why credible timelines for cryptographically relevant quantum computing extend well beyond the near term. The gap closes from both directions — better physical error rates reduce the overhead multiplier, and larger systems provide more physical qubits — and the required improvement in both remains substantial.
Progress on error correction has been genuine and notable: demonstrations where increasing the code size actually decreased the logical error rate, which is the essential proof that the approach works. That is a meaningful milestone and it is a long way from a machine that runs useful error-corrected algorithms.
What Threshold Means
A concept worth understanding because it explains why error rate improvements matter more than qubit count.
Error correction adds qubits and operations, and those operations can themselves fail. If the physical error rate is too high, adding error correction makes things worse — the correction machinery introduces more errors than it fixes.
Below a critical physical error rate, called the threshold, the relationship inverts: adding more physical qubits per logical qubit reduces the logical error rate. Above it, no amount of overhead helps.
The threshold value depends on the code and the error model, and for the surface code it is roughly in the region of one percent under favourable assumptions.
Current best hardware operates near or below this threshold for some operations, which is why the field considers error correction demonstrated in principle. What remains is doing it at scale, with all operations reliably below threshold, and with the classical decoding fast enough to keep up.
That last requirement is underappreciated. Syndrome measurements arrive continuously and must be decoded in real time — the correction must be determined before the next round of errors accumulates. For a large machine this is a substantial classical computing problem running alongside the quantum one, and decoder latency is an active engineering constraint.
Where the Hardware Approaches Differ
Several physical implementations are being pursued, with genuinely different trade-off profiles.
Superconducting circuits. Fast gate operations, well-developed fabrication borrowing from semiconductor manufacturing, and planar layouts suiting the surface code. Requires millikelvin temperatures, and coherence times are relatively short. Currently the most widely pursued.
Trapped ions. Excellent coherence times and gate fidelities, and all-to-all connectivity within a trap, which reduces the operations needed to move information. Gates are slower, and scaling beyond a single trap requires connecting traps, which is an active challenge.
Neutral atoms. Large arrays are achievable with optical trapping, and connectivity can be reconfigured by moving atoms. A newer approach with rapid recent progress.
Photonic. Room-temperature operation and natural suitability for networking, since photons travel well. Deterministic two-qubit gates are difficult, and the approach frequently relies on measurement-based schemes.
Spin qubits in semiconductors. Potentially manufacturable with existing semiconductor processes, which would help enormously with scaling. Currently behind on fidelity and count.
Topological approaches. Would provide intrinsic error protection from the physics rather than from correction overhead, dramatically reducing the qubit requirement. The underlying physics remains being established.
No approach has demonstrated a clear path to millions of qubits. Each faces a different limiting problem, which is a reasonable argument for pursuing several in parallel rather than converging early.
What Quantum Computers Would Actually Be Good At
The applications where quantum advantage is theoretically established are narrower than general discussion suggests.
Simulating quantum systems. Molecular chemistry, catalysis, and materials properties. This is the most credible and most valuable application, because the problem is natively quantum — classical simulation costs scale exponentially with system size. Drug discovery and battery chemistry are the frequently-cited applications.
Factoring and discrete logarithms. Shor’s algorithm provides exponential speedup, which is what threatens current public-key cryptography. Requires error-corrected machines far beyond current capability.
Unstructured search. Grover’s algorithm gives a quadratic speedup. Useful and less dramatic than exponential, and the overhead may consume the advantage for practical problem sizes.
Certain linear algebra and optimisation problems. Theoretical speedups exist with significant caveats about data loading and output extraction that frequently negate the advantage in practice.
What quantum computers are not expected to accelerate: general-purpose computation, machine learning training in any established way, database queries, or most of what current computers do. The advantage applies to specific problem structures rather than to computation generally.
The data loading problem deserves mention because it undermines many proposed applications. Getting classical data into a quantum state can itself take exponential time, which erases the advantage for problems requiring large classical inputs.
Why Cryptography Migration Cannot Wait
The one area demanding action now, despite the hardware being distant.
The reasoning is a specific threat model: an adversary records encrypted traffic today and decrypts it once quantum computers become capable. For data that must remain confidential for decades — government records, medical information, long-lived commercial secrets — the relevant question is not when quantum computers arrive but how long your data must stay secret.
If your data must remain confidential for twenty years, and cryptographically relevant quantum computing arrives in fifteen, data encrypted today is already exposed.
What is affected: public-key encryption, key exchange, and digital signatures all rely on factoring or discrete logarithm hardness. Symmetric encryption is affected more modestly — Grover’s algorithm halves the effective key length, so doubling key sizes addresses it.
What to do now: inventory where public-key cryptography is used and what data it protects. Adopt standardised post-quantum algorithms, which are now published. Implement hybrid schemes combining classical and post-quantum algorithms, so security holds if either survives. Prioritise long-lived data and long-lived systems — anything with a decade-plus lifetime, particularly embedded devices that cannot easily be updated.
And design for cryptographic agility, meaning the ability to change algorithms without redesigning the system. That property is valuable regardless of quantum computing, since algorithms are periodically deprecated for entirely classical reasons.
Common Misconceptions
“More qubits means more capable.” Without error correction and adequate fidelity, additional physical qubits do not extend what can be computed.
“Quantum computers are faster at everything.” The advantage applies to specific problem structures. Most computation sees no benefit.
“Quantum supremacy means practical usefulness.” Demonstrations of quantum machines outperforming classical simulation on contrived tasks are scientifically meaningful and not commercially useful.
“Encryption is broken now.” Current machines cannot factor cryptographically relevant numbers. The concern is recorded traffic decrypted later, which is why migration matters now.
“Quantum computers will replace classical ones.” They are accelerators for specific problems, requiring substantial classical infrastructure to operate.
“Error correction is a solved problem.” Demonstrated in principle at small scale. Doing it at the scale useful algorithms require is unsolved.
Conclusion
Qubit count is the reported metric and not the limiting one. Capability depends on error-corrected logical qubits, and producing one logical qubit currently requires hundreds to thousands of physical qubits — which means useful computations need millions of physical qubits against current systems providing hundreds.
That gap closes from two directions. Lower physical error rates reduce the overhead multiplier, potentially by an order of magnitude. Larger systems provide more physical qubits. Both are progressing and the required improvement in each remains substantial, which is why credible timelines for cryptographically relevant machines extend well beyond the near term.
The applications where advantage is established are narrower than general discussion suggests, and the most credible one — simulating quantum systems for chemistry and materials — is also the most valuable, because that problem is natively quantum.
And the practical action is cryptographic. Data encrypted today and recorded by an adversary is exposed whenever capable machines arrive, which makes migration a function of how long your data must stay secret rather than of when the hardware appears. Inventory the exposure, adopt the standardised post-quantum algorithms, and build for agility.
Frequently Asked Questions
How many qubits are needed to break current encryption? Estimates suggest thousands of error-corrected logical qubits, which translates to millions of physical qubits at current overhead ratios. Present systems are several orders of magnitude short.
What is the difference between physical and logical qubits? A physical qubit is a hardware element with a high error rate. A logical qubit is an error-corrected abstraction built from many physical qubits, with a much lower error rate. Algorithms require logical qubits.
Why can quantum states not simply be copied for redundancy? The no-cloning theorem prohibits copying an unknown quantum state, and measurement destroys superposition. Quantum error correction detects errors through syndrome measurements that avoid revealing the protected state.
Which hardware approach will win? Unclear. Each faces a different limiting constraint — superconducting circuits on coherence time, trapped ions on gate speed and inter-trap connectivity, photonics on deterministic gates. Parallel pursuit is reasonable given the uncertainty.
Is quantum machine learning promising? Theoretically interesting, practically unclear. Loading classical data into quantum states can itself cost exponential time, which frequently negates the proposed advantage.
When should post-quantum cryptography be adopted? Now, for long-lived data. The threat is recorded traffic decrypted later, so the deciding factor is your data’s required confidentiality lifetime rather than the hardware timeline.
What is the most credible near-term application? Simulating quantum systems — molecular chemistry, catalysis, materials. The problem is natively quantum, classical simulation scales exponentially, and the qubit requirements are lower than for cryptanalysis.
