French firm Alice & Bob says 23,000 qubits could be enough to break web encryption

22,593. That is the number of physical qubits that could be enough to break an RSA-2048 key, the encryption that still protects a good share of web connections, emails and electronic signatures. The estimate comes from Alice & Bob, a French company that builds quantum computers. It presented the figure on October 29, based on a 122-page preprint filed on the archive of the International Association for Cryptologic Research (IACR, reference 2026/2665). With this machine, the computation would take 3.14 days.

For comparison: in May 2025, Craig Gidney (Google Quantum AI) estimated it would take just under one million qubits and nearly five days. According to the analysis by the specialist site PostQuantum.com, that works out to about 897,864 qubits for 4.96 days. Alice & Bob is therefore asking for about forty times fewer qubits, for a runtime of the same order.

Where does this gain come from?

Alice & Bob is betting on “cat qubits,” its specialty. These qubits are designed to almost never suffer one of the two types of quantum errors, the bit flip. Error correction then only has to handle the other type, which saves a great many qubits. The company also adopted more efficient error-correcting codes (known as LDPC): its own 2023 estimate required 49,649 cat qubits.

The paper offers other settings: 610,530 qubits for about 1 hour 15 minutes, or 21,188 qubits for a little over 8 days. For the elliptic curve used by Bitcoin, the company gives at most 29,588 qubits and 61.8 minutes. That is longer than the ten minutes between two blocks: a transaction in progress would therefore remain out of reach, according to this calculation.

A machine that is still theoretical

This is an estimate, not an attack. The main scenario assumes that the qubits suffer no bit flips during the computation, which corresponds to about a hundred years without errors per qubit. If an error occurs once an hour, about 45,000 qubits are needed, Alice & Bob says. PostQuantum.com points out that the best peer-reviewed published result tops out at around twenty seconds. The company's largest processor to have produced error-correction results has 12 cat qubits, and the preprint has not yet been peer-reviewed.

The cryptologist Antoine Joux, quoted by Alice & Bob, sees it as “an important paper” for anyone tracking the arrival of the threat. The company places the meeting point between its machines and these requirements in the early 2030s.

What this means for you

Official deadlines are not changing. US and UK guidance aims for a complete transition to post-quantum cryptography by 2035, and the European Union targets the end of 2030 for high-risk systems. But the trend is clear: each new estimate lowers the bar, as Google already did this month. Data encrypted today that must stay secret for ten years is the most exposed, because data captured now could be decrypted later. Replacement algorithms exist: ML-KEM for key exchange, ML-DSA for signatures. The first step remains to inventory your uses of RSA and elliptic curves, starting with long-lived secrets.

The next milestone to watch is not a new qubit figure, but a hardware demonstration: cat qubits that hold up without errors under control, and error correction that improves as it is scaled up.