NISQ vs CRQC
NISQ and CRQC name two different classes of machine. NISQ describes every quantum computer that has ever been built, with noisy physical qubits and no full error correction. CRQC describes a threshold that no machine has reached, defined by the ability to run Shor’s algorithm against real key sizes in a practical time.
The separation between them is error correction rather than size. A machine can add physical qubits indefinitely and remain firmly NISQ, which is why a qubit-count record tells a security team almost nothing about its exposure.
The short version:
- NISQ is a description of what exists, CRQC is a specification of what would be dangerous. One is a category of hardware, the other is a capability threshold.
- The gating axis is error-corrected depth, not qubit count. Preskill’s ceiling for a NISQ computation is roughly 1,000 gates before noise overwhelms it. Factoring RSA-2048 needs roughly 2.7 billion Toffoli operations over about 8 hours.
- Every announced chip through 2026 is NISQ, including those past 1,000 qubits, because none has fault-tolerant error correction.
- The conversion rate is brutal. A CRQC needs thousands of logical qubits, roughly 6,100 for RSA-2048, and each logical qubit costs hundreds to thousands of physical qubits at current overhead.
- The bridge was demonstrated once, at a scale of one. Google showed below-threshold error correction for a single logical qubit built from 101 physical qubits in 2024, and a CRQC needs thousands of them.
Think of the difference between a workshop full of hand tools and a certified machine shop. Adding more hand tools makes the workshop bigger and never makes it a machine shop, because what separates them is a tolerance guarantee: the certified shop can hold a specification across a long production run, and the workshop cannot hold it past a few operations before drift accumulates. Counting tools measures the wrong thing entirely, and the announcement that a workshop now holds 1,000 tools says nothing about whether anything it produces will hold tolerance.
What is the difference between NISQ and CRQC?
NISQ is a hardware era defined by noisy, uncorrected qubits and short computations. CRQC is a functional threshold defined by what a machine can actually break. The two terms are not points on one scale, because a NISQ machine does not become a CRQC by growing, and it becomes one only by acquiring fault tolerance and then growing.
That distinction is what makes the terms worth keeping apart in a risk conversation. NISQ answers “what do we have,” and its answer has been yes since 2018. CRQC answers “does the threat exist yet,” and its answer is still no.
What is NISQ?
NISQ, short for Noisy Intermediate-Scale Quantum, is the term John Preskill introduced in 2018 for near-term quantum computers. He defined both halves precisely. On size: “‘intermediate scale’ refers to the size of quantum computers which will be available in the next few years, with a number of qubits ranging from 50 to a few hundred.” On noise: “‘Noisy’ emphasizes that we’ll have imperfect control over those qubits; the noise will place serious limitations on what quantum devices can achieve in the near term.”
The noise is the defining property rather than the size. NISQ qubits run unprotected by quantum error correction, so errors accumulate and cap how deep a computation the machine can complete.
Source: John Preskill, “Quantum Computing in the NISQ era and beyond,” Quantum 2, 79, 2018, arXiv:1801.00862.
What is a CRQC?
A Cryptographically Relevant Quantum Computer is a quantum computer large and stable enough to break the public-key cryptography protecting most digital infrastructure. It is a threshold rather than a description of any existing machine, drawn where a quantum computer could run Shor’s algorithm against real key sizes in a practical amount of time.
Three targets define it: factoring RSA-2048 or larger, solving the elliptic-curve discrete logarithm problem at 256-bit curves or larger, and solving finite-field discrete logarithms at standard key sizes. Meeting any one of them requires full fault tolerance, thousands of logical qubits, and the circuit depth and coherence to run Shor’s to completion.
NISQ vs CRQC at a glance
| Dimension | NISQ | CRQC |
|---|---|---|
| What the term describes | A class of hardware that exists | A capability threshold not yet reached |
| Origin of the term | John Preskill, 2018 | Risk and policy literature naming the threat machine |
| Qubit type | Noisy physical qubits, uncorrected | Error-corrected logical qubits |
| Qubit count | 50 to a few hundred by the original definition; leading chips have passed 1,000 physical | Thousands of logical qubits, roughly 6,100 for RSA-2048, meaning millions of physical |
| Error correction | None. Gates run unprotected by quantum error correction | Full fault tolerance |
| Computation depth | Capped near 1,000 gates before noise overwhelms the result | Roughly 2.7 billion Toffoli operations over about 8 hours for RSA-2048 |
| Runs Shor’s at cryptographic scale | No | Yes, by definition |
| Runs Grover’s at threatening scale | No. Grover also needs a long fault-tolerant computation | Yes, though Grover only halves symmetric strength |
| Exists in 2026 | Yes. Every quantum processor announced through 2026 | No |
| What progress looks like | More qubits, better fidelity, useful physics experiments | Below-threshold error correction, scaled from 1 logical qubit to thousands |
| Genuine uses today | Many-body quantum physics, quantum chemistry and materials simulation, some optimization, early quantum machine learning | None. The machine does not exist |
| What it means for cryptography | Nothing directly. It cannot execute any credible cryptographic attack | Everything. Public-key cryptography fails on arrival |
| The right headline question | Are the qubits logical or physical, what is the 2-qubit error rate, has error correction been demonstrated | Has anyone built thousands of logical qubits with the depth to finish Shor’s |
Source: John Preskill, arXiv:1801.00862, 2018, for the NISQ definition and the gate-depth ceiling.
Source: Craig Gidney and Martin Ekerå, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits,” Quantum 5, 433, 2021, arXiv:1905.09749, for the Toffoli count, the runtime and the logical-qubit requirement.
Source: Rajeev Acharya et al. (Google Quantum AI), “Quantum error correction below the surface code threshold,” Nature 638, 920-926, 2025, arXiv:2408.13687, for the below-threshold demonstration.
How do they actually differ?
-
The separating variable is fault tolerance, and it is a category change rather than a quantity. Crossing from NISQ to fault tolerance means physical qubits clean enough that adding redundancy makes a logical qubit more reliable instead of noisier. Below that threshold, more qubits add more noise. Above it, more qubits add more reliable computation. The behavior on either side of that line is qualitatively different, which is why NISQ machines do not gradually become CRQCs.
-
The two numbers people compare are not the same unit. A vendor announcement counts physical qubits. A cryptographic resource estimate counts logical qubits. At current overhead a single logical qubit costs hundreds to thousands of physical qubits, so the two figures are separated by a conversion factor that swamps the difference between any two announcements.
-
Depth matters more than width for the attack. A Shor’s run against RSA-2048 is roughly 2.7 billion Toffoli operations against a NISQ ceiling near 1,000 gates. Widening a noisy machine does not extend how long it can compute before its result becomes noise, and depth is the axis the attack actually needs.
-
They are measured by different evidence. NISQ progress shows up as qubit counts, gate fidelities and quantum-advantage demonstrations on non-cryptographic problems. Progress toward a CRQC shows up as error-correction results, and the distance is now being measured directly from hardware rather than only projected forward.
-
Their timelines are separate clocks. A NISQ machine doing genuinely useful chemistry is real and important and moves the code-breaking timeline very little, because the thing gating the attack is fault tolerance at scale, which NISQ lacks by definition.
Where do they agree?
-
Both are quantum computers running the same underlying physics. Superposition, entanglement and interference are the same in each, and the difference is engineering quality rather than a different physical principle.
-
Both are gated by error rates. NISQ is limited by them directly, and a CRQC is defined by having overcome them through error correction. The same physical quantity governs both categories.
-
Neither threatens symmetric cryptography meaningfully. A NISQ machine cannot run Grover’s at scale, and a CRQC running Grover only halves the effective strength of a symmetric cipher, which AES-256 absorbs.
-
Both are on the same research path. Every serious effort to build a CRQC runs through improving today’s NISQ hardware, so NISQ progress is a necessary input even though it is not a measure of cryptographic risk.
Why does the distinction drive the migration timeline?
Because the answer to “does the threat exist” has been no for as long as the field has existed, and that answer is not what determines when to act. Migration across a large estate takes years, data harvested today under harvest now, decrypt later is exposed the moment a fault-tolerant machine arrives, and there is no patch for data already collected.
Credible expert and government estimates for a CRQC span roughly 2030 to 2040 and beyond, so a plan anchored on a predicted year is anchored on the least reliable input available. The sound approach runs on lead time instead, which is the reasoning in Mosca’s theorem: when a dataset’s confidentiality lifetime plus the migration time exceeds the time until the machine arrives, the exposure is already live.
The NISQ era being real today is therefore an argument for migrating now rather than a reason to wait, because the work has to be finished before the era ends.
How do I read a quantum computing headline?
A qubit-count record tells you a machine got wider and says almost nothing about whether it got closer to a cryptographic attack. IBM’s Condor chip reached 1,121 physical qubits, which sounds like it left Preskill’s “few hundred” range far behind, and those are noisy uncorrected qubits, so by the defining property of the term the machine is firmly NISQ.
Three questions separate a meaningful announcement from a loud one:
- Are the qubits logical or physical? Physical qubits are the raw hardware. Only logical qubits count toward a cryptographic threshold.
- What is the 2-qubit error rate? This determines whether error correction can help at all, since correction only works below the threshold error rate.
- Has error correction been demonstrated, and at what scale? One logical qubit is a genuine milestone and is three orders of magnitude short of a CRQC.
As long as the answers are physical, too noisy to correct, and no, the machine is a NISQ device and cryptography is not at risk from it, whatever the number in the release.
Source: IEEE Spectrum, “An IBM Quantum Computer Will Soon Pass the 1,000-Qubit Mark,” spectrum.ieee.org.
Common misconceptions
-
“A 1,000-qubit machine means encryption is nearly broken.” Those are noisy physical qubits with no error correction. A cryptographic attack needs thousands of error-corrected logical qubits, which at current overhead means millions of high-quality physical ones.
-
“NISQ machines will gradually become CRQCs as they grow.” Growth alone does not cross the gap. Below the error-correction threshold, adding qubits adds noise. Crossing requires fault tolerance, which is a change of category rather than of scale.
-
“Quantum advantage demonstrations mean the timeline moved.” Advantage results are on non-cryptographic problems chosen to suit noisy hardware, and they do not establish the error-corrected depth a cryptographic attack requires.
-
“No CRQC exists, so there is nothing to do.” Harvested data is exposed retroactively the moment one arrives, and migration takes years, so the work has to be complete beforehand.
-
“NISQ computers are useless.” They are useful research tools for many-body quantum physics, chemistry and materials simulation, and early optimization and machine-learning work. Being useful in those areas and being a cryptographic threat are unrelated properties.
-
“The CRQC threshold is one fixed qubit number.” It shifts with the algorithm being attacked and the error-correction overhead assumed, so it is a range. Roughly 4,000 logical qubits is the most-cited figure for RSA-2048 and roughly 2,000 to 3,000 for a 256-bit elliptic curve.
Questions people ask
Does a quantum computer exist today that can break encryption? No. Every quantum processor announced through 2026 is a NISQ device with noisy uncorrected qubits, and none has the fault-tolerant error correction or the circuit depth a cryptographic attack requires.
What exactly separates NISQ from a CRQC? Quantum error correction at scale. A NISQ machine runs its gates unprotected, so noise caps computation near 1,000 gates. A CRQC runs error-corrected logical qubits deep enough to complete billions of operations.
How many qubits would it take to break RSA-2048? Roughly 6,100 logical qubits by the most-cited peer-reviewed estimate, which at current error-correction overhead translates to millions of physical qubits. The most-cited CRQC threshold figure is around 4,000 logical qubits, and the range reflects differing overhead assumptions.
When will a CRQC exist? Credible expert and government estimates span roughly 2030 to 2040 and beyond, and no published result has approached the coherence, fidelity and scale required. Planning on a predicted year is weaker than planning on lead time.
Has anyone built a logical qubit? Yes. Google demonstrated below-threshold error correction for a single logical qubit built from 101 physical qubits in 2024, which showed the approach scales in the right direction. Going from 1 to the thousands a CRQC needs remains a large unsolved problem.
Can a NISQ machine run Grover’s algorithm against AES? No. Grover’s also requires a long fault-tolerant computation, so a NISQ device cannot run it at any threatening scale. Even on a CRQC, Grover only halves symmetric strength, which AES-256 absorbs.
Why do vendors announce qubit counts? Qubit counts are genuine engineering progress, since a CRQC will be built from far more qubits than exist today. They are a poor proxy for cryptographic risk because they measure width while the attack is gated by error-corrected depth.
Is progress toward a CRQC measurable, or only forecast? Increasingly measurable. A 2026 study analyzed 680 order-finding distributions from IBM quantum systems to characterize when classical post-processing can still recover a correct answer from a noise-distorted quantum result, putting a hardware-reality floor beneath the timeline forecasts.
Source: Yang and Markidis, arXiv:2605.16074, 2026.
The map is free and I keep it that way. When the question becomes what this timeline means for a specific estate and how much lead time it actually has, that’s the work I do at LaMarr Labs.
Go deeper
- NISQ (Noisy Intermediate-Scale Quantum) and Cryptographically Relevant Quantum Computer (CRQC) for each term in full
- Logical vs Physical Qubits for the conversion that separates the two counts
- Quantum Error Correction for the mechanism that bridges them
- Quantum Resource Estimation for how the attack figures are produced
- How Do You Tell Real Quantum Progress From Hype for reading announcements
- Quantum Threat Timeline for the dates and their uncertainty
- Mosca’s Theorem for why the arrival date is the wrong planning anchor
Last verified 2026-08-10 · Maintained by Addie LaMarr, LaMarr Labs.