A Different Kind of Machine
A classical computer, from a phone to a supercomputer, works with bits. Each bit is definitely 0 or definitely 1, and a processor changes bits with logic gates. A quantum computer works with qubits. A qubit can be in a superposition, a weighted blend of 0 and 1, and a group of qubits can be entangled, which means the group has a definite state while no single qubit has one of its own.
Those properties let a quantum computer hold an enormous number of possibilities in one state. Thirty qubits hold about a billion weights; three hundred hold more than there are atoms in the observable universe. The catch is that reading the state returns one plain binary answer, chosen at random according to the weights. A useful quantum algorithm is a sequence of operations arranged so that, by the time the answer is read, the weight sits on the right one. The walkthrough below shows that arrangement with one qubit, then two.
Three things a quantum computer is not. It is not a faster general-purpose computer: for most everyday work it offers no speedup at all. It does not try every answer in parallel and pick the best one: a measurement reveals one answer, and the algorithm has to earn it through interference. And it is not a stand-alone machine: every quantum processor today runs as a co-processor, with a classical computer preparing the circuit, driving the control electronics and reading the results.
How an Operation Works
Follow one qubit, then two. Each step uses the standard textbook pictures: the sphere that describes a single qubit’s state, and the list of amplitudes that a quantum computer manipulates. The last steps run a complete two-qubit program and show why noise is the hard part.
1. A bit is a switch. A qubit is a direction
A classical bit is a switch with two positions, 0 and 1. A qubit’s state is a direction on a sphere, and any direction is allowed. The two poles are the readouts 0 and 1. Reading a qubit always gives one of them, never anything in between.
Is the sphere real?
The sphere is the standard picture of one qubit’s state, called the Bloch sphere. The physical qubit might be an ion, a superconducting circuit or a photon. Whatever the hardware, its state maps to one point on this sphere, which is why the picture is used for all of them.
2. A gate is a rotation
A quantum operation, or gate, turns the arrow. X rotates it half a turn, so 0 becomes 1: the quantum NOT. H rotates it a quarter turn to the equator, an equal mix of 0 and 1. Gates never read the qubit. They only move the arrow, and every gate can be undone by turning the other way.
Why reversible?
Quantum gates are rotations, and every rotation has an inverse. A circuit run backwards returns the qubit to its starting direction. Measurement is the one operation that cannot be undone, which is why a program measures only at the end.
3. Measurement picks a pole
The arrow’s latitude sets the odds. On the equator the readouts 0 and 1 are equally likely. Measuring forces the arrow to one pole, chosen at random with those odds, and the superposition is gone. Replay this step to roll again; the tally shows the runs so far.
Can the hardware read the direction?
No. A single measurement returns one bit. Learning the direction takes many identically prepared qubits and many measurements, a process called tomography. This is why a quantum computer cannot simply print the billions of amplitudes it is working with.
4. Amplitudes have a sign
Each readout has an amplitude. Squaring it gives the probability, so amplitudes of +0.71 and +0.71 both mean 50%. The Z gate rotates the arrow around the vertical axis and flips the sign of the |1⟩ amplitude. The odds do not change. The sign is invisible to any single measurement.
In general
Amplitudes are complex numbers, and a Z rotation can be any angle, called the phase. The sign flip shown here is the simplest case. Phase is the ingredient that makes the next step possible, and it has no counterpart in a classical bit.
5. Interference: paths add or cancel
Run H twice. The first H splits the amplitude between two branches. The second H splits each branch again, so each readout receives two contributions. For readout 1 they are +0.5 and −0.5 and cancel. For readout 0 they add to 1. Insert a Z between the gates and the outcome flips: readout 1 becomes certain.
Why this is the whole trick
A quantum algorithm is a choreography of rotations that makes the contributions to wrong answers cancel and the contributions to the right answer add. Nothing is tried in parallel and then selected. The computer does not know which answer is right. Interference leaves it standing.
6. Two qubits, one state
Two qubits have four possible readouts, so the state holds four amplitudes. H on qubit A spreads the state over 00 and 10. CNOT flips B wherever A is 1, which moves the 10 amplitude to 11. The state is now entangled: only 00 and 11 remain, and the two readouts always match. Replay to measure again.
Why 2ⁿ matters
Each added qubit doubles the number of amplitudes. Three hundred qubits carry more amplitudes than there are atoms in the observable universe, and one gate can move all of them at once. But measurement still returns one bit per qubit, so an algorithm has to concentrate the amplitude on the answer before measuring.
7. A program: find the marked answer
This is Grover’s search on two qubits. H on both qubits gives four equal amplitudes. The oracle flips the sign of the answer that passes its test, 11. Diffusion reflects every amplitude about their average. The three wrong answers land on zero and the right one lands on 1, so measurement returns 11 every time, after a single check.
How it scales
With N candidates, Grover’s method needs about √N oracle rounds, against N/2 on average for a classical search. That is a real but modest speedup. Shor’s algorithm for factoring is a different and far stronger case. Shor, Grover and the Quantum Speedup explains both.
8. Noise, and how to fight it
Real qubits are fragile. Heat, vibration and stray fields nudge the arrow, and the stored information blurs. Error correction spreads one logical qubit across many physical qubits and runs checks that reveal where an error happened without reading the value. Once errors are rare enough, adding physical qubits makes the logical qubit more reliable.
What counts as rare enough?
Today’s best processors have two-qubit gate errors between 0.1% and 1%. In December 2024 Google reported that larger surface-code patches on its Willow chip had lower logical error rates, the first clear demonstration of operating below the threshold. Quantum Hardware and Error Correction has the platforms and the numbers.
9. What this means for encryption
Shor’s algorithm turns factoring and discrete logarithms into a period-finding problem that a large, error-corrected quantum computer solves efficiently. That breaks RSA, P-256 and X25519 at the key sizes in use. Grover’s algorithm only halves the effective key length of a cipher, so AES-256 stays safe. Post-quantum algorithms such as ML-KEM rest on problems with no known quantum shortcut, and OWL already uses one.
When?
Nobody has a machine near the size the estimates call for. A 2025 Google estimate puts RSA-2048 within reach of under a million noisy qubits running for under a week; the largest machines today have roughly a hundred to a thousand. The risk arrives before the machine, because encrypted data recorded now can be decrypted later. Post-Quantum Encryption explains how OWL already handles it.
Slides transition when you choose. The sphere carries forward between steps. Replay restarts the current animation and rolls new measurement outcomes.
The sphere and the amplitude bars are the standard textbook pictures of qubit states, drawn here for one and two qubits. Real machines run the same kinds of operations on many more. Reference: Nielsen and Chuang, Quantum Computation and Quantum Information, chapters 1 and 4; IBM Quantum Learning.
What It Is Good At
Quantum speedups are specific. They come from algorithms that exploit interference for one kind of structure, and most problems do not have that structure. Three families matter most.
Factoring and discrete logarithms
- Shor’s algorithm finds the period of a number-theoretic function exponentially faster than any known classical method.
- That breaks RSA, Diffie-Hellman and elliptic curves such as P-256.
- It is the reason post-quantum cryptography exists.
Searching
- Grover’s algorithm finds a marked item among N candidates in about √N steps instead of N.
- For a 128-bit key that is 2⁶⁴ steps: real, but a speedup that doubling the key size cancels.
- AES-256 keeps a wide margin.
Simulating nature
- Molecules, catalysts and materials are quantum systems.
- Simulating them exactly is exponentially hard for classical computers and natural for quantum ones.
- This was Feynman’s original argument for building the machine.
Beyond those families the picture is murkier. Optimization and machine learning attract attention, but the proven speedups there are small or depend on assumptions about how the data is loaded. Shor, Grover and the Quantum Speedup gives a measured view of what is and is not known.
Where Things Stand
The field moves quickly, and the headline claims come from the companies that build the machines. The table lists the results that changed what experts expect, with the caveats attached.
| When | What happened | Why it matters |
|---|---|---|
| 2019 | Google’s 53-qubit Sycamore processor ran a sampling task that Google said would take a classical supercomputer 10,000 years. | The first claim of a computation beyond classical reach. Classical methods later narrowed the gap sharply, a pattern worth remembering for every advantage claim. |
| 2022 | The Nobel Prize in Physics went to Aspect, Clauser and Zeilinger for experiments with entangled photons. | Entanglement is a measured fact, and the foundation of quantum information science. |
| December 2024 | Google reported that larger surface-code patches on its 105-qubit Willow chip had lower logical error rates, by a factor of about 2.1 per step in code size. | The first clear demonstration of error correction below threshold: more physical qubits made a better logical qubit. |
| May 2025 | A Google Quantum AI paper estimated that RSA-2048 could be factored with under one million noisy qubits in under a week. | Down from the 20 million qubits estimated in 2019. The target keeps moving toward current hardware. |
| October 2025 | Google reported a “verifiable quantum advantage” on Willow: a physics measurement it said ran 13,000 times faster than the best classical approach. | A narrower, checkable kind of claim than 2019, still made by the vendor and still a physics task rather than an application. |
| October 2025 | The Nobel Prize in Physics went to Clarke, Devoret and Martinis for demonstrating quantum behaviour in an electrical circuit. | Their 1980s experiments underpin superconducting qubits, the platform Google and IBM build on. |
| November 2025 | Quantinuum launched Helios, a 98-qubit trapped-ion machine with company-reported two-qubit gate fidelity of 99.921%. | Trapped ions trade speed for accuracy. Both leading platforms are now building logical qubits. |
The gap between those machines and a code-breaking one is still large. The 2025 estimate assumes about a million physical qubits with error rates near 0.1%, while today’s largest processors have roughly a hundred to a thousand qubits, most with higher error rates. Nobody can say when the gap closes. NIST’s draft transition plan, IR 8547, proposes deprecating RSA and elliptic-curve algorithms after 2030 and disallowing them after 2035, because migrations take years and recorded data keeps its value.
What It Means for Encryption
Two algorithms carry the whole story. Shor’s algorithm breaks the mathematics behind every public-key method in wide use: RSA, finite-field Diffie-Hellman, and elliptic curves such as P-256 and X25519. Grover’s algorithm gives only a square-root speedup against symmetric ciphers and hash functions, so AES-256 and SHA-256 keep comfortable margins.
The threat arrives before the machine. An attacker can record encrypted traffic or copy a database of wrapped keys today and decrypt it when a large enough machine exists. That is why harvest now, decrypt later is the planning assumption, and why NIST standardized replacement algorithms in 2024.
OWL already uses one. Recipient keys are wrapped with ML-KEM-768 combined with P-256, and the public ndevr.org endpoint supports the hybrid X25519MLKEM768 group for HTTPS. The file data itself stays under AES-256. Post-Quantum Encryption explains the algorithms, exactly which layers are covered, and what is not.
A quantum computer does not try every answer at once
A state of n qubits does hold 2ⁿ amplitudes, and one gate moves all of them. But a measurement returns a single n-bit result, drawn at random. The art of a quantum algorithm is arranging interference so that the amplitudes of wrong answers cancel before anyone looks. Step 5 of the walkthrough shows the mechanism, and step 7 shows it finding an answer.
Read the Series
Each article stands on its own. Read them in order for a complete picture, from one qubit to a code-breaking machine.
What is a Qubit?
The sphere, the two poles, and what the hardware behind a qubit really is.
Part 2Superposition, Measurement and Interference
Waves that add and cancel, the double-slit experiment, and why measurement creates the result.
Part 3What is Quantum Entanglement?
Correlations stronger than any shared secret, Bell tests, and why no message travels.
Part 4Shor, Grover and the Quantum Speedup
Which problems get faster, by how much, and what it costs to break RSA-2048.
Part 5Quantum Hardware and Error Correction
Ions, superconducting circuits, atoms and photons, and the numbers behind the headlines.
Sources & Further Reading
- M. A. Nielsen and I. L. Chuang, Quantum Computation and Quantum Information (Cambridge University Press, 10th anniversary edition, 2010): the standard textbook behind the pictures used above.
- The Quantum Atlas, Joint Quantum Institute, University of Maryland: short illustrated entries on qubits, superposition, measurement and entanglement that shaped this series.
- IBM Quantum Learning: Basics of quantum information: a free course that develops the amplitude picture with the same two-qubit examples.
- J. Preskill, “Quantum Computing in the NISQ era and beyond”, Quantum 2, 79 (2018): why today’s noisy machines are not yet fault tolerant.
- F. Arute et al., “Quantum supremacy using a programmable superconducting processor”, Nature 574, 505–510 (2019).
- Google Quantum AI and collaborators, “Quantum error correction below the surface code threshold”, Nature 638, 920–926 (2025); Google’s Willow announcement (December 2024) and “A verifiable quantum advantage” (October 2025).
- C. Gidney, “How to factor 2048 bit RSA integers with less than a million noisy qubits”, arXiv:2505.15917 (2025); C. Gidney and M. Ekerå, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits”, Quantum 5, 433 (2021).
- NIST, IR 8547 (initial public draft): Transition to Post-Quantum Cryptography Standards (2024), and What is Post-Quantum Cryptography?
- The Nobel Prize in Physics 2022 and 2025 press releases.
- Quantinuum, “Introducing Helios” (November 2025): company-reported specifications.
Hardware figures reflect vendor announcements and peer-reviewed papers available in October 2026. OWL’s cryptographic details are documented on Post-Quantum Encryption.