What Can Quantum Computers Actually Do in 2026?

The honest answer, for anyone working in security: less than the briefings suggest, but more than the sceptics acknowledge. And the gap between what quantum hardware can do today and what it would need to do to break deployed cryptography is not closing on a straight line. Understanding where that gap actually sits is a prerequisite for making calibrated decisions about PQC migration, not just a technical curiosity.

This is not a quantum computing primer. You already know what a qubit is. What this article does is work through the hardware landscape as it stands in 2026, assess what published results mean when you read them carefully, and separate the engineering milestones that matter from the noise. The IBM Nighthawk nomenclature issue is a good place to start: "IBM Nighthawk 120-qubit" has circulated in secondary briefings. IBM's published current processor is the Heron r2 at 156 physical qubits. If someone is citing Nighthawk to you, check the source before passing it on.

The Hardware Landscape by Paradigm

Superconducting Gate-Based Systems: IBM and Google

IBM's Heron r2 processor, deployed as part of IBM Quantum's 2024-2025 fleet, operates at 156 physical qubits with two-qubit gate error rates in the 0.3 to 0.5 per cent range [INFERRED, IBM Heron r2 gate fidelity figures are from IBM Quantum's published technical reports; verify against current IBM Quantum benchmark before relying on specific figures]. IBM's roadmap has shifted away from raw qubit count milestones toward a system-level focus on error correction and fault tolerance. That shift is significant: it means IBM's own engineers understand that qubit counts are not the bottleneck.

Google's Willow chip, announced in December 2024, is the most technically significant recent milestone. The published result (Acharya et al., Nature, December 2024) demonstrated below-threshold error correction at a distance-7 surface code using approximately 105 physical qubits. What this means precisely: surface code error correction only improves as the code size increases if the physical error rate is below a certain threshold. Above the threshold, adding more qubits makes the logical error rate worse. Google's result demonstrates that their physical error rates are now below the surface code threshold. Increasing system size will therefore reduce logical error rates, the fundamental requirement for scalable fault-tolerant computing.

That is a genuine engineering advance. It is not a Q-Day announcement. A distance-7 surface code uses approximately 105 physical qubits to encode one logical qubit. Running Shor's algorithm against RSA-2048 requires approximately 4,000 logical qubits, based on the Gidney-Ekerå (2021) analysis of fault-tolerant circuit compilation. At distance-7, encoding 4,000 logical qubits would require roughly 420,000 physical qubits. To achieve the error rates that Shor's algorithm requires, surface code distance-25 or higher is needed, requiring approximately 1,250 physical qubits per logical qubit, totalling roughly 5 million physical qubits for RSA-2048. The best published estimate for breaking RSA-2048 remains Gidney and Ekerå: approximately 20 million physical qubits over eight hours of computation, using specific fault-tolerant compilation approaches (Quantum, Vol. 5, 2021). Current hardware is at 156 physical qubits.

Trapped Ion and Neutral Atom Systems

Quantinuum's H-series trapped ion processors currently lead on gate fidelity metrics. Moses et al. (Physical Review X, 2023) reported two-qubit gate fidelities exceeding 99.5 per cent on their race-track trapped ion processor. The practical trade-off is clock speed: trapped ion systems operate more slowly than superconducting systems, which limits circuit depth for time-constrained computations. For applications requiring high fidelity on moderate-depth circuits, the Quantinuum approach is competitive with or superior to superconducting architectures at current qubit counts.

QuEra's Aquila neutral atom system (256 atoms) and Atom Computing's 1,180-qubit neutral atom system (announced 2023; verify current qubit count before citing, as this figure may have been superseded by subsequent announcements) [INFERRED, neutral atom system qubit counts are from company announcements and third-party reporting; verify against current published specifications] represent a rapidly evolving segment. Evered et al. (Nature, 2023) demonstrated high-fidelity parallel entangling gates on neutral atom hardware. Neutral atom architectures provide promising scaling paths and flexible qubit connectivity, but no neutral atom or trapped ion system has demonstrated fault-tolerant computation at a scale relevant to Shor's algorithm.

Photonic Systems

PsiQuantum (Silicon Valley) and Xanadu (Toronto) are developing photonic quantum computing architectures with a claimed advantage: their qubits operate at room temperature rather than the approximately 15 millikelvin required by superconducting systems. Bartolucci et al. (Nature Communications, 2023) published a fusion-based quantum computation architecture for photonic qubits. Neither PsiQuantum nor Xanadu currently offers gate-based quantum computation at commercially available scale. [ASSUMED, availability status of photonic systems; verify before publication as this field moves quickly]

Quantum Annealing: D-Wave

D-Wave's Advantage system (approximately 5,000 qubits) operates on a fundamentally different principle: quantum annealing rather than gate-based universal computation. Annealing is suited to QUBO (Quadratic Unconstrained Binary Optimisation) problem formulations. D-Wave hardware cannot run Shor's algorithm. It is not a universal gate-based quantum computer. Published benchmarking shows D-Wave hardware is competitive with classical methods on specific QUBO instances but has not demonstrated general advantage over solvers like Gurobi or CPLEX at practical scale. [INFERRED, D-Wave versus classical solver comparisons follow from the available benchmarking literature including King et al.; verify that no subsequent peer-reviewed study has changed the consensus before publication.] King et al. (Nature Communications, 2023) is the most recent peer-reviewed D-Wave performance analysis available; check for more recent peer-reviewed work before publication.

What Quantum Hardware Can Actually Do Today

Chemistry Simulation

The variational quantum eigensolver (VQE) approach, introduced by Peruzzo et al. (Nature Communications, 2014) and extended by work at IBM Research and Google's quantum AI team, has demonstrated ground-state energy calculations on molecular systems in the 12 to 50 qubit range. These are genuine scientific results. They are proof-of-concept demonstrations for small molecules: hydrogen chains, lithium hydride, iron-sulphur cluster fragments.

The honest assessment is that classical simulation methods, including density functional theory (DFT) and coupled-cluster methods such as CCSD(T), remain more accurate and faster for the molecular systems that matter to drug discovery and materials science. The theoretical case for quantum advantage in chemistry is solid: exact quantum simulation of many-body systems scales exponentially on classical hardware and polynomially on quantum hardware. The practical case, demonstrated at industrially relevant molecular size, does not yet exist. The NISQ regime is at the stage of demonstrating equivalence with classical methods, not advantage over them.

Combinatorial Optimisation

The Quantum Approximate Optimisation Algorithm (QAOA), introduced by Farhi, Goldstone, and Gutmann (arXiv, 2014), has been demonstrated on MaxCut and combinatorial problems at circuit depths p=1 and p=2. Results are competitive with greedy classical algorithms on small instances. State-of-the-art classical solvers outperform current QAOA on most practically relevant problem sizes. Bravyi et al. (Physical Review Letters, 2020) proved formally that constant-depth QAOA cannot solve 3-SAT faster than classical algorithms on certain problem classes. The quantum advantage for optimisation on NISQ hardware is an open research question, not a demonstrated result.

Quantum-Inspired Classical Algorithms

Fujitsu's Digital Annealer, Toshiba's Simulated Bifurcation Machine, and D-Wave's hybrid classical-quantum offerings are classical computers running algorithms structurally inspired by quantum approaches. Goto et al. (Science Advances, 2019) documented the simulated bifurcation machine's performance on combinatorial optimisation. These systems can deliver genuine performance improvements over naive classical solvers for specific QUBO problems. They do not run on quantum hardware. Deploying a quantum-inspired optimisation tool has no effect on your quantum security posture, positive or negative.

What Already Works: QRNG and QKD

Two quantum technology applications are commercially deployed and delivering genuine value today, and neither requires NISQ-scale gate hardware.

Quantum random number generation (QRNG) devices generate cryptographically certified random numbers from quantum processes: photon detection, vacuum fluctuations, radioactive decay. ID Quantique, Quantinuum, and others ship commercial QRNG hardware. ETSI GS QKD 012 provides the standards framework. QRNG is the most commercially mature quantum technology currently available.

Quantum key distribution (QKD) provides physically-secured key exchange over dedicated optical channels. Chen et al. (Nature, 2021) documented China's 4,600-kilometre ground-network QKD deployment. European deployments include the Vienna metropolitan network, ID Quantique installations in Switzerland, and BT/Toshiba research networks in the UK. QKD's limitations are genuine: trusted node requirements, distance constraints, high infrastructure cost, and the absence of built-in authentication. QKD is complementary to post-quantum cryptography, not a substitute for it. The NCSC's position (2023) is that QKD is not recommended as a replacement for PQC migration.

The Q-Day Calibration

Two published analyses provide the authoritative benchmarks for the hardware requirements to run Shor's algorithm at RSA-2048 scale.

Gidney and Ekerå (Quantum, 2021) estimated that breaking RSA-2048 requires approximately 20 million noisy physical qubits operating for around eight hours, using optimised fault-tolerant circuit compilation. This uses specific assumptions about physical error rates and fault-tolerant overhead; it is not a ceiling. Research into more efficient error correction codes continues.

Webber et al. (AVS Quantum Science, 2022) estimated the requirements at approximately 317 million physical qubits at a physical error rate of 10⁻³, falling to approximately 13 million at 10⁻⁴. Current best superconducting systems operate at approximately 10⁻³ error rates and qubit counts in the hundreds. The engineering gap between the best current hardware and CRQC-capable hardware spans 4 to 5 orders of magnitude in physical qubit count and requires sustained fault-tolerant operation that has not been demonstrated at any useful scale.

The mainstream research consensus places the earliest plausible date for a CRQC at 2033 to 2035, a credible lower bound derived from published analysis of required hardware parameters and current improvement rates, not a guaranteed event date. The Mosca inequality makes the implications concrete: if the sum of your data retention period and your migration timeline exceeds the time until a CRQC arrives, migration should have started already.

The Google Willow result moves the picture from "impossible at any foreseeable engineering trajectory" to "theoretically plausible with orders-of-magnitude progress still required." That is meaningful for timeline calibration. It does not change the compliance calendar, because the HNDL threat operates independently of whether Q-Day arrives on schedule.

Common Misreadings

Google Willow confirming below-threshold error correction does not mean a CRQC is imminent. It means scaling from distance-7 to the distance-25 or higher that Shor's algorithm requires is no longer theoretically blocked by the error accumulation problem. The distance gap from 7 to 25 corresponds to a roughly 13-fold increase in physical qubits per logical qubit, while the total qubit count required remains in the millions.

D-Wave being a "quantum computer" in marketing language does not make it relevant to cryptographic security. D-Wave's Advantage system is an annealer. It cannot run Shor's algorithm. An organisation that uses D-Wave for logistics optimisation has not advanced or hindered its quantum security posture in any way.

NISQ hardware producing scientific results does not mean quantum computers are "useless." QRNG and QKD deliver commercial value today. Chemistry and optimisation experiments on gate-based NISQ hardware are producing genuine scientific insights. The claim that "quantum computers can't do anything yet" is as poorly calibrated as the claim that "quantum computers will break all encryption next year."

What This Means for Security Decision-Making

Quantum computers in 2026 can: generate certified random numbers at commercial scale; distribute symmetric keys over physically-secured optical channels; simulate small molecular systems at proof-of-concept scale; run combinatorial optimisation experiments competitive with classical greedy algorithms; and demonstrate below-threshold surface code error correction at distance-7.

Quantum computers in 2026 cannot: run Shor's algorithm against any RSA or ECC key size used in deployed systems; outperform classical solvers on industrially relevant optimisation problems; operate at fault-tolerant scale for any useful application; or break AES-256 or SHA-2.

The calibrated conclusion for security decisions: the HNDL threat is real and present-tense regardless of today's hardware. Data encrypted with RSA or ECDH session keys and captured now can be stored and decrypted when a CRQC arrives. The migration timeline for a large enterprise is three to five years. The credible Q-Day lower bound is seven to nine years from now. The Mosca inequality closes that gap quickly when you add data retention periods to migration timelines.

For a detailed analysis of IBM and Google hardware progress through 2025-2026, see the IBM and Google quantum computing progress in 2026 coverage. For the error correction milestones and their implications for Q-Day timelines, the quantum error correction and Q-Day timeline analysis works through the engineering trajectory in detail.