! Educational demonstration only. Keys, moduli, and RSA sizes here are intentionally tiny so classical/quantum attacks finish in seconds — today's classical hardware cannot run Shor's algorithm against real production RSA keys. See Security & Limitations.
Shor's Lab

Real, measured qubit and gate counts for the gate-level modular exponentiation circuit (quantum/modexp_circuit.py) -- via quantum/resource_estimate.py's CountingRegister, which runs the actual unmodified circuit-emission code.

N is capped to the 7 values below since larger composites make the gate-level circuit exponentially slower to actually build, not just simulate -- see Resource Estimation for extrapolated counts at real RSA sizes, where direct measurement like this is impossible.

0. Circuit schematic

c0c1c2⋮ n_count|1⟩HHHU_a^xQFT⁻¹

1. Compute real circuit metadata

2. Circuit stages

1.Hadamard layer

H on every control qubit -- equal superposition over all possible control-register values.

2.Controlled modular exponentiation

Built from elementary reversible-arithmetic gates: Fourier adders → controlled modular multiplication (compute-swap-uncompute) → exponentiation.

3.Inverse QFT

Applied to the control register -- concentrates measurement probability at multiples of 2^n_count / r.

4.Measurement

Only the control register is measured; the target/ancilla registers are traced out.

3. Why zero ancilla leakage matters

The ancilla (scratch) qubits used by the modular adder must return to exactly |0⟩ after each operation -- if they didn't, they'd carry a record of which computational path was taken, and that leaked "which-path" information would destroy the quantum interference the rest of Shor's algorithm depends on. This project's test suite checks this directly: a compute-swap-uncompute controlled multiplier is verified to leave 100% of the probability mass on the expected result with zero leakage to any other state.

Go deeper: Gate-Level Modular Exponentiation