How many qubits and gates this project's honest gate-level circuit would need at a real RSA key size -- computed in closed form (quantum/resource_estimate.py), proven to exactly match real measured gate counts at small scale before being trusted to extrapolate here.
0. Where things stand today
Illustrative, not a formula
About 3.0 orders of magnitude short of factoring a real RSA-2048 key
The best published estimate for factoring RSA-2048 now stands at 1,000,000 noisy physical qubits (Gidney, 2025, arXiv:2505.15917) -- down from 20,000,000 in the original 2019 estimate (Gidney & Ekera, arXiv:1905.09749). The largest gate-model quantum processor publicly announced is IBM's 1,121-qubit Condor chip (2023).
Raw qubit count is necessary but nowhere near sufficient -- nobody has demonstrated fault-tolerant error correction at anywhere close to this scale yet, at any qubit count. The clock hand's exact position is this project's own editorial framing of that gap, not a derived formula -- exactly as the real Bulletin of the Atomic Scientists' clock is a judgment call, not an equation.
1. Pick a key size
What actually breaks first, at 2048 bits
Three independently real numbers for the same key size -- not a single verdict, since they're answers to three different questions (see each card).
2. The cliff: how fast this actually grows
Every point below is a real closed-form computation at that bit size, not an interpolation -- the dashed line marks wherever the slider above is currently set.