A quantum computer is a machine that works with the strange rules that tiny things like atoms follow. An ordinary computer stores everything as bits, and every bit is either a 0 or a 1. A quantum computer uses qubits instead, and a qubit can be a blend of 0 and 1 at the same time, right up until you measure it.
The most important thing to know
A quantum computer is not a faster laptop.
It will not make videos load quicker, or games run better, or homework get done faster. For almost everything you do on a computer, a quantum machine would be worse than an ordinary one, and much more expensive.
What a quantum computer might be very good at is a small handful of specific problems. The best example is working out how molecules behave, which matters for designing medicines and batteries. Molecules follow quantum rules, so a quantum computer is speaking the same language as the thing it is studying.
That narrowness is the whole story. Quantum computers are not better computers. They are different computers, good at different things.
Colder than outer space
Here is something surprising. The most common kind of quantum chip has to be kept at about one hundredth of a degree above absolute zero, which is the coldest anything can possibly get.
Empty space, far from any star, is about 2.7 degrees above absolute zero. So these machines are hundreds of times colder than deep space. The coldest natural place astronomers have found, a cloud of gas called the Boomerang Nebula, is still far warmer than a quantum chip.
The reason is that qubits are fragile. A tiny bit of warmth, a passing vibration, or a stray particle will scramble a qubit and wipe out the information inside it. Cold means still, and still is what qubits need.
Key facts about quantum computers
Ordinary computers use bits, which are 0 or 1. Quantum computers use qubits, which can be a blend of both.
A qubit stops being a blend the moment you measure it, and gives you one plain answer.
The idea came from several physicists around 1980: Paul Benioff, Yuri Manin, and then Richard Feynman in 1982.
Many quantum chips run at about 10 to 15 thousandths of a degree above absolute zero, far colder than space.
The famous gold chandelier is the refrigerator, not the computer. The chip is a tiny square at the bottom.
Qubits make mistakes constantly, and fixing those errors is the hardest problem in the field.
Many physical qubits have to work together to make one reliable qubit.
In 1994, Peter Shor showed a quantum computer could break some codes that protect the internet.
No quantum computer is anywhere near big enough to do that yet.
New codes designed to resist quantum computers were published in 2024.
Why qubits are so hard to work with
Imagine trying to balance a pencil on its point. It is possible for a moment, but the smallest breath of air knocks it over.
A qubit is a bit like that. It holds its special blended state only briefly, sometimes for less than a thousandth of a second, and then the outside world disturbs it and the information is gone. Scientists call this decoherence.
This creates a race. The whole calculation has to finish before the qubits fall apart. It also means quantum computers make mistakes far more often than ordinary computers, which almost never flip a bit by accident.
The fix is clever and expensive: use lots of unreliable qubits together to build one reliable one. That is why a machine might have hundreds of qubits but only a few that can really be trusted.
Common myths about quantum computers
Myth: A quantum computer tries every possible answer at once and picks the right one.
This is the most popular explanation and it is not right. You only ever get one answer when you measure. The trick is to set things up beforehand so the wrong answers cancel each other out, like waves meeting and flattening.
Myth: Quantum computers will replace laptops and phones.
They need room-sized refrigerators and are useless for ordinary tasks. Nobody expects one on your desk.
Myth: Quantum computers have already broken internet security.
Not close. It would take hundreds of thousands or millions of qubits, and the largest machines anyone can actually run programs on have a little over a thousand.
Myth: Quantum computers already do useful things ordinary computers cannot.
They have won at a few tasks chosen because they suit quantum hardware. In October 2025, Google said its Willow chip produced the first such result that other scientists can check for themselves, and physicists are still testing that claim. Even so, no quantum computer has taken over a job that people actually need done.
Frequently asked questions about quantum computers
What is a qubit?
The quantum version of a bit. Before you measure it, it can be a blend of 0 and 1. After you measure it, it is just one of them.
Why do quantum computers need to be so cold?
Heat jiggles things, and jiggling destroys the fragile quantum state. Cold keeps everything still enough for the qubits to survive.
Who thought of quantum computers?
Several physicists, at almost the same time. Paul Benioff described a computer built out of quantum parts in 1980, and Yuri Manin suggested that same year that a quantum machine could handle problems ordinary computers cannot. Richard Feynman made the argument famous in 1982, after pointing out that ordinary computers are hopeless at simulating quantum things.
What will quantum computers be good for?
Most likely simulating molecules and materials, which could help design medicines and better batteries.
Can I buy one?
Some companies let you send programs to their quantum computers over the internet. You cannot own one, and there is nothing useful you could do with it yet anyway.
Are quantum computers dangerous?
Not physically. The concern is that a large one could break some of the codes protecting information online, which is why new codes are already being introduced.
A quantum computer performs calculations using the rules of quantum mechanics, the physics that governs atoms and particles. Instead of bits that are either 0 or 1, it uses qubits, which before measurement exist in a combination of both. The idea took shape around 1980, when Paul Benioff described a computer built from quantum parts and Yuri Manin argued that a quantum machine could handle problems a classical one cannot. Richard Feynman’s 1982 paper made the case widely known. The first small working machines appeared in the late 1990s. Useful ones still do not exist.
Why Feynman made the case
Feynman was not thinking about faster computers. He was frustrated by a specific problem: ordinary computers are terrible at simulating quantum systems.
The reason is brutal arithmetic. Describing a quantum system means tracking possibilities that roughly double with every particle you add. Twenty particles is manageable. Around fifty, the largest supercomputers on Earth are at their limit, and every particle after that doubles the job again. This is not a matter of needing more memory; the requirement grows faster than any machine can grow.
Feynman’s suggestion was to stop fighting it. If a quantum system is hard to simulate on a classical machine, build a machine that is itself quantum. It would represent the problem naturally rather than trying to encode it.
That original motivation, simulating chemistry and materials, is still the application most experts consider the strongest.
The two ingredients
Superposition means a qubit holds a combination of 0 and 1 before it is measured. Measuring forces it to become one or the other, and which one you get is a matter of probability set by the state it was in.
Entanglement links qubits so they share a single combined state rather than having separate ones. Measure one entangled qubit and you immediately know something about its partner, however far away it is. This does not allow faster-than-light messages, because each individual result looks random, and comparing them requires an ordinary message traveling at normal speed.
Together these let a quantum computer work with relationships between qubits rather than with each one separately. Neither ingredient explains the advantage on its own, though. A third one, interference, is what turns those relationships into an answer you can read out.
The part almost every explanation gets wrong
You will often read that a quantum computer tries every possible answer at once and picks the right one. That description is memorable and wrong in a way that matters.
When you measure, you get exactly one answer, chosen probabilistically. Simply holding many possibilities gets you a random result, which is useless.
What actually happens is interference. Quantum states behave like waves, and waves can add together or cancel out. A quantum algorithm is carefully arranged so that the paths leading to wrong answers cancel each other, while the paths leading to right answers reinforce. When you finally measure, the right answer is overwhelmingly likely.
This is why designing quantum algorithms is so hard. The Quantum Algorithm Zoo, a catalog kept by physicist Stephen Jordan, lists more than seventy of them, but only a handful deliver the dramatic speedups people picture. You need a problem with mathematical structure you can turn into interference.
Key facts about quantum computers
Proposed around 1980 by Paul Benioff and Yuri Manin, then argued for by Richard Feynman in 1982; first small working machines in the late 1990s.
A qubit holds a superposition of 0 and 1 until measured, then gives one answer.
Entanglement links qubits into a shared state but cannot send information faster than light.
Peter Shor showed in 1994 that a quantum computer could factor large numbers quickly, threatening internet encryption.
Lov Grover showed in 1996 how to search an unstructured list in roughly the square root of the usual number of steps. Later work proved no quantum algorithm can beat that.
Qubits lose their state through decoherence, often within a fraction of a second.
Many physical qubits combine into one reliable logical qubit through error correction.
In December 2024 Google’s Willow chip showed that adding qubits could reduce errors rather than increase them.
Breaking RSA-2048 encryption is estimated to need under a million qubits; today’s machines have hundreds to low thousands.
New encryption standards resistant to quantum attack were published in August 2024.
The encryption question, in proportion
Much of the security on the internet relies on a simple asymmetry: multiplying two large prime numbers is easy, but taking the result and recovering the original primes is extremely hard for a classical computer.
Shor’s algorithm makes that hard direction easy for a quantum computer. That single result reshaped the field’s funding. Three years after its publication, the Army Research Office and the National Security Agency jointly called for proposals to demonstrate physical implementations of quantum computers, and government money has followed the field ever since.
Two things keep this in proportion. First, no existing machine is remotely close. Estimates for breaking a standard encryption key have fallen from about 20 million qubits in 2019 to under a million in 2025, but current machines have hundreds to low thousands. Second, the world is already responding: in August 2024, after an eight-year competition, the United States published three new encryption standards built on math problems no known quantum algorithm can solve quickly.
There is a genuine urgency, though, and it is subtle. An adversary can record encrypted data today and store it until a suitable machine exists. Anything that must stay secret for decades is already exposed by waiting, which is why the switch is being pushed now.
Common myths about quantum computers
Myth: They try all answers at once.
Measurement gives one answer. The mechanism is interference, not parallel search.
Myth: More qubits always means a better computer.
Physical qubit counts are misleading. Error correction consumes hundreds of physical qubits per reliable logical one, so a machine with a thousand qubits may have only a handful of usable ones.
Myth: Quantum computers will speed up everything.
For problems with no structure to exploit, a square-root improvement is the proven ceiling. Dramatic speedups require special mathematical structure that most problems lack.
Myth: Entanglement allows faster-than-light communication.
Each measurement result looks random on its own. Extracting meaning requires comparing notes over an ordinary channel.
Frequently asked questions about quantum computers
What is superposition?
A qubit being in a combination of 0 and 1 before measurement. Measuring collapses it to one value.
Does entanglement break the speed of light rule?
No. The correlation is instant, but no usable information travels, because individual outcomes are random until compared.
What is Shor’s algorithm?
A method from 1994 for factoring large numbers on a quantum computer far faster than any known classical approach, which threatens current public-key encryption.
Why does decoherence matter?
It sets a deadline. The calculation must finish before the environment disturbs the qubits and destroys the quantum state.
How many qubits would break encryption?
Recent estimates say under a million physical qubits. Today’s machines have hundreds to low thousands, so the gap is enormous.
Should I worry about my messages?
Not today. Everyday encryption is safe against current machines, and stronger standards are already being rolled out.
A quantum computer performs computation using quantum states as its basic unit of information, exploiting superposition, entanglement, and interference to solve a narrow class of problems faster than any known classical method. The concept took shape around 1980, when Paul Benioff introduced a quantum mechanical model of a Turing machine and Yuri Manin argued that quantum automata could reach behavior a classical simulation cannot follow. Richard Feynman’s 1982 paper, which observed that classical simulation of quantum systems scales exponentially with system size, gave the idea its widest audience. Four decades later, machines exist with hundreds to low thousands of physical qubits. Google announced the first verifiable quantum advantage in October 2025, but no machine has yet solved a practically useful problem better than a classical computer.
Interference, not parallelism
The standard popular account, that a quantum computer evaluates every possibility simultaneously and returns the right one, is wrong in a way that obscures why the field is difficult.
Measurement yields exactly one outcome, drawn probabilistically from the state. A superposition over a large space, measured naively, gives a random answer of no more value than a guess. Holding many possibilities is not the resource.
The resource is interference. Quantum amplitudes are complex numbers that add and cancel like waves, and a quantum algorithm arranges for computational paths leading to wrong answers to cancel destructively while paths to correct answers reinforce. Only then does measurement return something useful.
This reframing explains the field’s central frustration. Designing such cancellation requires exploitable mathematical structure, and only a handful of problems are known to have it. Where structure is absent, the advantage is small or nonexistent, which is a proven fact rather than a temporary limitation.
Two algorithms that define the boundaries
Shor’s algorithm, published in 1994, factors integers in polynomial time by reducing factoring to a period-finding problem and extracting the period with a quantum Fourier transform. Its speedup over the best known classical method, the general number field sieve, is superpolynomial rather than exponential, because the sieve itself runs in sub-exponential time. Because public-key cryptography rests on factoring and discrete logarithms being hard, this single result reshaped the field’s funding.
Grover’s algorithm, from 1996, searches an unstructured space in roughly the square root of the number of items. A million-item search takes about a thousand steps rather than a million. This is genuinely useful and unspectacular, and a matching lower bound proves no quantum algorithm can do better on unstructured search.
The pair mark the boundaries. Where a problem has structure, as periodicity does for factoring, superpolynomial speedups are possible. Where it does not, quadratic is the ceiling, and squaring an exponential is still exponential. Quantum computers do not make hard problems easy in general.
Why errors dominate everything
Qubits decohere through interaction with their environment, often within microseconds to milliseconds for superconducting designs. Every calculation is a race against that clock.
Classical error correction is unavailable, because the no-cloning theorem forbids copying an unknown quantum state. The classical trick of storing three copies and taking a majority vote simply cannot be done.
Quantum codes work differently. They spread one logical qubit’s information across many entangled physical qubits, then measure ancillary qubits that reveal whether an error occurred and where, without ever measuring the encoded value itself. The information leaks out about the error, not about the data.
The overhead is the problem. Protecting one reliable logical qubit takes hundreds or thousands of physical qubits depending on hardware quality, which makes headline qubit counts misleading. A machine advertising a thousand physical qubits may support only a handful of usable logical ones.
Key facts
Proposed by Benioff and Manin in 1980 and argued for by Feynman in 1982; Shor’s factoring algorithm 1994; Grover’s search algorithm 1996.
Measurement returns one outcome; interference, not parallel evaluation, produces the advantage.
Grover’s quadratic speedup is provably optimal for unstructured search.
The no-cloning theorem rules out classical-style redundancy, requiring a different approach to error correction.
Superconducting qubits operate near 10 to 15 millikelvin, far colder than deep space at 2.7 kelvin.
Trapped ions hold coherence far longer but operate far more slowly; neither approach has clearly won.
Google’s Willow chip demonstrated below-threshold error correction with 105 qubits in December 2024.
Estimates for breaking RSA-2048 fell from about 20 million noisy qubits in 2019 to under a million in 2025.
NIST published three post-quantum encryption standards in August 2024 after an eight-year competition.
Google announced the first verifiable quantum advantage in October 2025; no machine has yet beaten classical methods on a practically useful problem.
The threshold, and why 2024 mattered
Quantum error correction has a peculiar property. Adding more physical qubits to a code both increases protection and increases the number of things that can go wrong.
Above a certain physical error rate, the second effect wins: scaling up makes the logical qubit worse. Below that threshold, the first wins, and logical error falls exponentially as the code grows. The threshold theorem establishes that arbitrarily long computations become possible below it, which is what makes large quantum computers theoretically achievable rather than merely desirable.
Getting below it experimentally took decades. In December 2024, Google reported that its 105-qubit Willow processor achieved this, with logical error rates falling by roughly half for each two-step increase in code distance, and a distance-7 logical qubit outliving its best physical qubit by about a factor of 2.4.
The result is a milestone in principle and not a useful machine. It was a memory demonstration, showing an encoded qubit holding its state, rather than a computation. What it establishes is that the scaling path is open.
The claims that got walked back
In 2019 Google announced that its 53-qubit Sycamore processor had completed a random circuit sampling task in about 200 seconds that would take a leading supercomputer roughly 10,000 years. IBM responded within days that a better classical approach using disk storage could finish in about two and a half days, cutting the claimed gap by six orders of magnitude.
This pattern has recurred. Quantum advantage is announced, classical algorithm researchers examine the specific task, and improved simulation methods narrow or close the gap. Noise in the quantum device often helps them, since it reduces the entanglement a classical simulation has to track.
Two things are worth holding at once. The tasks chosen are artificial, selected because they suit quantum hardware and have decent hardness arguments, not because anyone wants the answers. And a gap can close completely: in 2024 Google’s own team estimated that improved tensor-network methods would let the Frontier supercomputer reproduce the 2019 Sycamore task in about six seconds. Later experiments have proven harder to match classically, but no advantage claim should be read as settled.
Competing hardware, none of it settled
There is no agreed answer to what a qubit should physically be, and the leading candidates trade against each other rather than ranking cleanly.
Superconducting circuits, used by Google and IBM, are tiny resonant circuits behaving as artificial atoms. Gates take tens of nanoseconds, which is fast, and the chips are made with adapted semiconductor fabrication, which suits scaling. The costs are coherence times measured in microseconds to milliseconds and dilution refrigerators operating near 10 millikelvin.
Trapped ions hold individual charged atoms in electromagnetic fields and manipulate them with lasers. Coherence lasts seconds or longer and gate fidelities have generally led the field, but operations take microseconds, making them far slower. Any ion can interact with any other, which suits error-correcting codes that superconducting chips cannot easily implement.
Neutral atoms held in optical tweezers offer flexible geometry and have scaled to large arrays quickly. Photonic approaches integrate with optical fiber and can keep much of their optical hardware at room temperature, but they still need a cryostat for their superconducting photon detectors. PsiQuantum runs its nanowire detectors near 2 kelvin, and Xanadu’s photon-number-resolving sensors sit at 12 millikelvin, comparable to a superconducting qubit chip. The price is the difficulty of making photons interact at all.
The metric that matters is not coherence time alone but how many operations fit inside it. A slow qubit with long coherence and a fast qubit with short coherence can land in a similar place, which is roughly what has happened between ions and superconductors.
Common misconceptions
“It tries everything at once.” Measurement yields one outcome. Interference is the mechanism.
“More qubits is straightforwardly better.” Error correction overhead means physical counts translate poorly into usable capacity.
“Quantum computers will break all encryption.” Symmetric ciphers face only a quadratic speedup that doubling key length offsets. Public-key systems based on factoring are the real exposure.
“Nothing has been done about the encryption risk.” Three post-quantum standards were finalized in August 2024 and migration is underway.
“Quantum computers are useful now.” No demonstration has solved a practically valuable problem better than classical methods.
Frequently asked questions
What actually gives a quantum computer its advantage?
Interference between computational paths, arranged so wrong answers cancel. This requires exploitable structure in the problem, which most problems lack.
Why can’t quantum error correction just copy data?
The no-cloning theorem forbids copying unknown quantum states. Codes instead spread information across entangled qubits and measure error syndromes.
What did the Willow result show?
That increasing code size reduced logical error rate exponentially, meaning the system operated below the error correction threshold. It was a memory experiment, not a computation.
How close is the encryption threat?
Estimates require under a million physical qubits; machines have hundreds to low thousands. The nearer-term concern is data recorded now and decrypted later.
Which qubit technology will win?
Unresolved. Superconducting circuits lead on speed and manufacturability, trapped ions on coherence and fidelity, with neutral atoms and photonics also in contention.
What is the most likely first useful application?
Simulating quantum chemistry and materials, which was Feynman’s original motivation and remains the strongest theoretical case.
Quantum computation is best understood as amplitude engineering. A quantum state assigns complex amplitudes across a basis, unitary evolution redistributes them, and measurement returns a basis state with probability given by the squared magnitude of its amplitude. Every quantum speedup is an instance of arranging destructive interference on undesired outcomes, and the scarcity of known speedups follows directly: the problem must possess structure that permits such arrangement.
Where speedups come from, and where they provably do not
Shor’s algorithm reduces factoring to order finding, then applies quantum phase estimation. Periodic structure in modular exponentiation produces amplitude concentration at rational multiples of the frequency under the quantum Fourier transform, which classical methods have no efficient analogue for. Notably, the Fourier transform is cheap; modular exponentiation dominates the gate count and therefore the resource estimates.
Grover’s algorithm applies to the structureless case, rotating the state vector toward the marked item through repeated reflection. Its quadratic improvement is accompanied by a matching lower bound, which makes it one of the more informative results in the field: for problems with no exploitable structure, the ceiling is proven and modest. Squaring an exponential leaves an exponential, so NP-complete problems are not rendered tractable.
Between these lies the interesting territory. Hidden subgroup problems generalize Shor’s structure and cover discrete logarithms. Quantum simulation exploits the natural correspondence between the machine and the simulated system. Beyond those families, claimed advantages have proven fragile, and the dequantization results are the cautionary case: several proposed quantum machine learning speedups were matched by classical algorithms operating under comparable sampling assumptions, which showed the advantage lived in the assumed data access model rather than in quantum mechanics.
Fault tolerance is the dominant engineering cost
No-cloning forbids classical redundancy, so quantum codes encode logical information nonlocally across entangled physical qubits and extract error syndromes via ancillas. The measurement reveals which error occurred without revealing the encoded state, which is the precise property that makes correction compatible with superposition.
The surface code dominates superconducting roadmaps for a geometric reason rather than an information-theoretic one: its stabilizers are local on a two-dimensional lattice, matching planar fabrication where long-range coupling is difficult. It pays for that convenience with overhead scaling as the square of code distance, and buys a comparatively forgiving threshold near one percent.
Two consequences deserve emphasis. First, corrections are typically not applied physically. Pauli errors are tracked in a software frame and commuted through the circuit, avoiding additional operations that would introduce their own errors. Second, syndrome extraction is itself faulty, so decoding operates on many rounds of noisy syndrome data, and decoder latency becomes a real-time constraint: the decoder must keep pace with the syndrome cycle or the backlog grows without bound.
The gate set problem
Clifford gates are comparatively cheap in the surface code, but not because the code implements them transversally. The S gate is not transversal there; it is reached by state injection or by braiding twist defects. Cliffords are cheap because they map Pauli operators to Pauli operators, so they can be commuted to the end of the circuit and absorbed into the final measurements, turning single-qubit measurements into Pauli product measurements and leaving classical bookkeeping in place of physical gates. The logical CNOTs that do have to run on the lattice are performed by lattice surgery or braiding, since a transversal version would break the two-dimensional nearest-neighbor layout the code was chosen for. Clifford circuits alone, however, are efficiently simulable classically by the Gottesman-Knill theorem, so a Clifford-only machine offers no advantage whatever.
Universality requires a non-Clifford gate, conventionally the T gate, and the standard route is magic state distillation: prepare many noisy copies of a resource state, consume them in a purification circuit, and yield fewer higher-fidelity states. The procedure is expensive enough to shape the floorplan of a fault-tolerant machine, but the widespread claim that distillation dominates the resource cost is regime-dependent rather than general. Litinski’s surface-code compilation puts the factories at 6.7 percent of tiles at a physical error rate of 10⁻⁴ and 21 percent at 10⁻³, and the published factoring and quantum-chemistry estimates fall in a comparable band running up to roughly a quarter of the machine. The fraction approaches the whole machine only in time-optimal regimes, where magic state throughput rather than data storage sets the size.
This is why T-count, rather than total gate count, is the figure of merit in fault-tolerant resource estimation, and why algorithmic work aimed at reducing T-count has moved resource estimates as much as hardware progress has.
Reading the 2024 error correction result correctly
Google’s Willow experiment demonstrated below-threshold operation: scaling a surface code from distance 3 to 5 to 7 suppressed logical error rate by roughly a factor of two per two-step increase, with the distance-7 logical qubit exceeding its best physical qubit’s lifetime by about 2.4 times.
What that establishes is that the scaling direction is favorable, which had not previously been shown experimentally at this scale. What it does not establish is fault-tolerant computation. It was a quantum memory demonstration, holding a logical state rather than performing logical operations, and logical gate implementations at useful fidelity remain ahead.
The distinction matters for interpreting timelines. Memory below threshold is necessary but far from sufficient, and the remaining gap between 105 physical qubits and the hundreds of thousands implied by resource estimates is the substance of the engineering problem.
Resource estimates move without hardware
The estimate for factoring RSA-2048 fell from roughly 20 million noisy qubits over eight hours in the 2019 Gidney and Ekera analysis to under a million over several days in a 2025 analysis, entirely through algorithmic and compilation improvement: better arithmetic circuits, refined approximation handling, and more efficient qubit storage schemes.
Two lessons follow. Planning cannot assume a static target, since the requirement has moved by more than an order of magnitude without any experimental advance. And the direction of revision has been consistently downward, which is relevant to anyone estimating when cryptographically relevant machines arrive.
The asymmetry in cryptographic exposure is worth stating precisely. Grover gives a quadratic improvement against symmetric primitives, offset by doubling key length at negligible cost. Shor breaks factoring and discrete-logarithm public-key systems structurally, with no parameter adjustment available. This is why the NIST process concentrated on key encapsulation and signatures, and why the standards finalized in August 2024 rest on lattice problems with a hash-based scheme included as a structurally independent hedge.
The NISQ question
Preskill’s 2018 framing describes the current regime: devices with enough qubits to be classically difficult to simulate but without error correction, so circuit depth is bounded by decoherence.
The open question is whether anything of value can be extracted from that regime. Variational approaches were the main hope, using shallow parameterized circuits with classical optimization, but they encounter barren plateaus where gradients vanish exponentially with system size, and their advantage over classical heuristics has not been established on problems anyone cares about.
The honest position is that the NISQ era may prove to be a period of instrument development rather than a source of applications, with practical value waiting on fault tolerance. That is not a prediction of failure; it is a statement about which milestone determines usefulness.
Architecture constrains code choice
Hardware connectivity and code selection are not independent decisions, and treating them separately produces misleading comparisons between platforms.
Superconducting processors are planar with nearest-neighbor coupling, which forces geometrically local codes and effectively selects the surface code family with its quadratic overhead. Trapped-ion and neutral-atom systems provide all-to-all or reconfigurable connectivity, which admits quantum low-density parity-check codes offering substantially better encoding rates. A platform with slower gates but access to a higher-rate code may reach a given logical qubit count with far fewer physical qubits, so headline comparisons of raw qubit counts across modalities carry little information.
Connectivity also determines the cost of routing. On a planar lattice, entangling distant logical qubits requires either lattice surgery or a chain of swap operations, each consuming time and introducing error. Architectures with long-range coupling avoid that overhead entirely, and its absence from most published resource estimates is one reason those estimates should be read as platform-specific rather than universal.
Verification and the trust problem
A difficulty peculiar to this field is that the results hardest to obtain classically are also hardest to verify classically.
Random circuit sampling illustrates it directly. The claim is that classical simulation is infeasible, and verification requires exactly that simulation, so confidence rests on statistical tests over partial simulation and on cross-entropy benchmarking whose interpretation has itself been contested. As systems scale, verification degrades faster than the claim strengthens.
For structured problems the situation is better. Factoring is trivially verifiable by multiplication, which is why Shor’s algorithm would be self-certifying if run at scale. Quantum simulation results can sometimes be checked against experiment or against limiting cases with known solutions. Interactive proof protocols allowing a classical verifier to check a quantum computation exist in theory but remain far from practical implementation.
The practical consequence is that near-term advantage claims should be assessed on the verification method as much as on the headline speedup, and that problems with efficiently checkable answers deserve more weight in application roadmaps than their raw difficulty alone would suggest.
Key facts
Speedups arise from amplitude interference, requiring exploitable problem structure.
Grover’s quadratic speedup is provably optimal for unstructured search.
Surface code overhead scales with the square of code distance; its threshold is near one percent.
Pauli corrections are typically tracked in software rather than physically applied.
Decoder latency is a real-time constraint, since syndrome data arrives continuously.
Clifford-only circuits are classically simulable; universality requires a non-Clifford resource, most often supplied by magic state distillation.
Distillation factories take a minority of physical qubits in factoring and chemistry estimates, from single-digit percentages up to roughly a quarter.
Willow demonstrated below-threshold memory at distance 7, not fault-tolerant computation.
RSA-2048 estimates fell from 20 million to under a million qubits between 2019 and 2025 through algorithms alone.
Common misconceptions at expert level
“Quantum parallelism is the resource.” Superposition without engineered interference yields random measurement outcomes. Interference is the mechanism.
“Below threshold means fault tolerant.” It means scaling improves logical error rate. Logical operations, magic states, and decoder throughput remain separate problems.
“Physical qubit count measures capability.” Usable logical capacity depends on error rates and code overhead, often differing by two to three orders of magnitude.
“Quantum machine learning inherits quantum speedups generally.” Dequantization showed several proposed advantages resided in data access assumptions rather than quantum mechanics.
“Noise makes classical simulation harder.” Noise generally reduces entanglement and makes classical simulation easier, which is why several advantage claims were narrowed by noise-aware classical algorithms.
Frequently asked questions
Why does modular exponentiation dominate Shor’s cost?
The quantum Fourier transform is comparatively cheap in gate count. Reversible modular arithmetic over thousands of bits requires the bulk of the circuit.
Why is T-count the key metric in fault-tolerant estimation?
Clifford gates are relatively cheap in the surface code, while each non-Clifford gate consumes distilled magic states produced by resource-intensive factories.
What is a barren plateau?
A regime where the gradient of a variational objective vanishes exponentially with qubit count, making training infeasible regardless of classical optimizer quality.
Why does decoder latency matter?
Syndrome data arrives every cycle and decoding must keep pace. A decoder slower than the syndrome rate accumulates an unbounded backlog and the correction fails.
Does below-threshold operation imply a timeline?
It establishes that scaling helps. Translating that into useful computation requires logical gates, distillation, and orders of magnitude more qubits.
Why did resource estimates fall so sharply?
Improved arithmetic circuits, approximation handling, and storage schemes. The reduction came from analysis rather than hardware.
