Google's Willow chip finished a benchmark calculation in under five minutes that would take today's fastest supercomputer roughly ten septillion years — a number so large it stops meaning anything by the second sentence. That statistic now does more work in quantum computing 2026 real-world impact coverage than almost any other single fact, repeated across headlines that rarely explain what the benchmark actually measured or what changes for a reader who isn't building a quantum computer. Willow's real contribution wasn't speed. It was proof that adding more qubits can lower the error rate instead of raising it, a threshold researchers chased for close to three decades. That distinction separates a party trick from a foundation, and most coverage never draws the line clearly enough to matter to someone deciding whether to worry about their encrypted data this year.
Most explainers do one of two things. They repeat "exponentially faster than classical computers" without saying faster at what, for whom, starting when — or they jump straight to shattered Bitcoin wallets and cracked RSA keys, which isn't what any serious cryptographer is forecasting for 2026. Both versions skip the question actually worth answering: what breaks first, on what realistic timeline, and what should change this year instead of in 2030.
What follows separates Willow's genuine hardware milestone from its marketing footnote, lines up the conflicting expert timelines on when encryption actually becomes vulnerable, and walks through the one place quantum computing has already produced a result a pharmaceutical researcher can use today — not in a press release, in a published workflow.
- What Willow Actually Achieved in the Lab
- Why "Ten Septillion Years" Oversells the Real News
- The Real Threshold for Breaking Encryption
- What's Already Quietly Changing: The Deadlines
- What Quantum Computing Is Actually Doing Right Now
- Who This Is For
- Verdict
- Frequently Asked Questions
What Willow Actually Achieved in the Lab
Willow is a 105-qubit superconducting processor, and its real achievement is below-threshold error correction: for the first time, adding more qubits reduced Google's error rate instead of raising it, cracking a problem the field had chased for close to three decades. The company says the chip finished a standard benchmark computation in under five minutes that would take one of today's fastest supercomputers roughly ten septillion years, a comparison detailed on Google's own announcement of the chip. Hartmut Neven, who leads Google Quantum AI, described the result more carefully than most coverage that followed it: the simulations produced genuine scientific findings, in his own account, but the outputs stayed "within the reach of classical computers," a qualifier that rarely survives the headline. In error-corrected terms, 105 physical qubits still works out to single-digit logical qubits — a number Google's own materials don't lead with, because it isn't the one that trends.
| Metric | Willow, 2024–2026 |
|---|---|
| Physical qubits | 105 |
| Qubit coherence (T1) | Roughly 100 microseconds |
| Error correction | Below-threshold — errors fall as qubits scale |
| Benchmark computation | Under 5 minutes (vs. roughly 10 septillion years classically) |
| Estimated usable logical qubits | Single digits |
Why "Ten Septillion Years" Oversells the Real News
That comparison measures a synthetic stress test, not a preview of a shippable capability. Random circuit sampling, the benchmark behind the septillion-year figure, has no known industrial use; researchers picked it because classical hardware struggles to replicate it and because it's easy to verify, not because solving it faster helps anyone discover a drug or route a shipment. The distance between a benchmark quantum computers can win and a real problem they can solve better than any alternative is exactly where most 2026 quantum coverage quietly loses precision. Google's own decision to add a second hardware approach based on neutral atoms in March 2026 is a tell: even the company that built Willow isn't betting its whole roadmap on Willow's architecture winning outright.
The Real Threshold for Breaking Encryption
Breaking RSA-2048 with Shor's algorithm needs on the order of 4,099 error-corrected logical qubits, a figure that hasn't moved much even as the physical-qubit cost estimate underneath it keeps falling. Early analyses put that cost near 20 million physical qubits; a 2025 paper narrowed it to roughly 1 million, and a February 2026 preprint from Iceberg Quantum claims under 100,000 using a different error-correction architecture — simulation-only, unbuilt, and explicitly not a claim that RSA has already been broken. Willow's 105 physical qubits, translated into that same error-corrected currency, sit nowhere close to any of those thresholds. Reporting this year noted that Google itself has warned that some encrypted systems could be vulnerable by 2029, a narrower and earlier window than the Global Risk Institute's Quantum Threat Timeline research, which frames the meaningful probability as landing in the early-to-mid 2030s. Nobody agrees on the exact date, because nobody has built the machine yet; the last community of cryptographers this confident about an unbreakable cipher was defending Enigma in 1939.
"...adversaries, will have access to a quantum computer that can break cryptographic codes" — Michele Mosca, evolutionQ, quoted in CNN's Q-Day coverage
The gap is real, and so is the countdown.
What's Already Quietly Changing: The Deadlines
None of that uncertainty postpones the compliance clock, because the danger isn't a working quantum computer today — it's an adversary storing your encrypted traffic now and waiting. Executive Order 14409, signed in 2026, sets a federal deadline of December 31, 2030 for migrating key-establishment cryptography and December 31, 2031 for digital signatures, with the NSA's CNSA 2.0 framework pushing national-security systems toward full migration by 2030 and complete infrastructure changeover by 2035. The UK's National Cyber Security Centre has published a parallel three-phase plan running to 2035, detailed in its own post-quantum migration roadmap. You're the person who now has to find every place your organization does key exchange or signs a certificate, because "harvest now, decrypt later" doesn't care whether Q-Day lands in 2029 or 2034 — it only cares how long your data has to stay confidential, and any secret worth protecting past 2030 is already exposed to a computer that doesn't exist yet.
That exposure is already being exploited at a smaller scale. Cryptographers tracking Bitcoin's migration risk have flagged that roughly a quarter of all bitcoin sits in wallets whose public keys are already visible on-chain, exposed the moment an address is used to spend from it, and harvestable from that point forward. Nobody needs to break RSA-2048 to start the clock. They just need to know what to copy, and copying has been underway for years.
What Quantum Computing Is Actually Doing Right Now
The more consequential 2026 quantum computing story isn't security at all — it's a hybrid quantum-classical workflow that just simulated a 12,635-atom protein, the largest molecule modeled this way to date. In May 2026, a joint Cleveland Clinic, RIKEN, and IBM team ran two 156-qubit IBM Quantum Heron processors alongside the Fugaku and Miyabi-G supercomputers, a forty-fold jump in scale from the same team's 303-atom Trp-cage result only two months earlier, according to IBM's own account of the result. IBM is careful to note the method doesn't yet beat the best classical approaches on raw accuracy — but it performs competitively, and it scales in a direction classical chemistry methods increasingly struggle to follow. That's not a benchmark engineered to be hard. It's a workflow a pharmaceutical researcher could plausibly use before the decade ends, running on hardware that already exists, which is more than can be said for anything that threatens your encryption keys today.
Separately, IonQ and Ansys reported a 36-qubit system beating a classical supercomputer by roughly 12 percent on a real medical-device simulation last year — not a benchmark contest, a working engineering result nobody needed a press release to interpret.
The pattern across both cases: quantum hardware is already useful when it's paired with classical supercomputers on narrow, well-chosen chemistry and optimization problems — years before it threatens to touch the cryptography protecting your inbox.
Who This Is For
This distinction matters most to two kinds of readers: security and infrastructure leads who need a migration plan with real dates attached, not a panic response to a chip announcement, and technical readers trying to separate quantum computing's actual 2026 output from its marketing output. If you fall into neither group, the honest takeaway is that nothing about your daily technology use changes this year — only the deadline you're now aware of.
Verdict
Willow is a genuine hardware milestone and a poor reason to panic about encryption in 2026. Treat the cryptographic migration as a scheduling problem with a hard 2030–2031 deadline attached to it, and treat quantum computing's near-term value as a research tool — chemistry, materials, and optimization — rather than a general-purpose replacement for classical infrastructure. Waiting for certainty on the exact date of Q-Day is the one option none of the named timelines actually support; every credible estimate agrees preparation should already be underway, even where they disagree on when it starts to pay off.
What none of the named estimates can settle is whether the next resource-estimate paper cuts the physical-qubit requirement again, the way the last one did twice in six years. Google, IBM, and a half-dozen well-funded labs are each running a different architecture toward the same finish line, and whichever group crosses it first has no obligation to announce it before using it.
Frequently Asked Questions
What is Google's Willow quantum chip?
Willow is Google Quantum AI's 105-qubit superconducting processor, announced in December 2024 and expanded on through 2026. Its defining achievement is below-threshold error correction, meaning error rates fall as more qubits are added — a milestone the field pursued for close to thirty years. It remains a research chip, not a commercial product.
How many qubits does Google Willow have?
Willow has 105 physical qubits. In error-corrected terms, that translates to only a handful of usable logical qubits, far short of the thousands needed for cryptographically relevant tasks like factoring RSA keys.
Can quantum computers break encryption in 2026?
No. No existing quantum computer, Willow included, comes close to the thousands of error-corrected logical qubits Shor's algorithm needs to break RSA-2048. Today's best machines operate with only dozens of logical qubits at most.
When will quantum computers break RSA encryption?
Estimates range from 2029 to the mid-2030s and disagree by design, since the machine hasn't been built yet. Global Risk Institute researchers place the meaningful probability in the early-to-mid 2030s, while some Google-linked estimates flag narrower risks as early as 2029.
What is Q-Day?
Q-Day is the informal name for the moment a quantum computer becomes capable of breaking the public-key encryption, mainly RSA and ECC, that secures most internet traffic today. It hasn't arrived, and no credible source claims otherwise.
Is quantum computing overhyped in 2026?
Partly. Hardware progress is real and faster than many expected two years ago, but near-term commercial value stays narrow — mostly chemistry, materials science, and optimization problems, not general-purpose computing.
What real-world problems can quantum computers solve today?
Molecular and materials simulation is the clearest 2026 example: a Cleveland Clinic, RIKEN, and IBM team modeled a 12,635-atom protein using a hybrid quantum-classical workflow. Optimization and specific chemistry problems follow the same pattern — narrow, real, and still paired with classical hardware.
How can organizations protect data from future quantum attacks?
Start by inventorying where RSA, ECC, and Diffie-Hellman key exchange run today, since every 2030 deadline assumes that step is already finished. Federal guidance under Executive Order 14409 and NIST's post-quantum standards, FIPS 203 through 205, give a concrete migration target even though the encryption threat itself remains years away.
Follow Peak of Trending for the next update on this beat as the 2030 migration deadlines and the quantum hardware race both move.
Published by 