In short: Quantum computers will most credibly pay off first in simulating quantum chemistry and materials, with narrow optimisation gains still unproven, and cryptanalysis (Shor's algorithm) remains years away because it needs hundreds of thousands to millions of physical qubits with very low error rates.
Headlines tend to say "quantum will change everything". Engineers need a sharper question: for each proposed application, how many logical qubits does it need, how many gates must run before the answer decays, and does a quantum algorithm actually beat the best classical one? This article sorts the main candidates by those constraints. For the hardware obstacles behind the numbers, see our companion piece quantum computing challenges.
The two numbers that decide everything
Today's devices are "noisy intermediate-scale" machines. Physical two-qubit gate error rates sit around 10-3 (0.1%) on the best superconducting and trapped-ion systems, and a few hundred to roughly a thousand physical qubits are available. A useful algorithm may need 109 to 1012 gates. At 0.1% error per gate, a circuit of just a few thousand gates already fails more often than it succeeds.
The cure is quantum error correction. In a surface code, many physical qubits cooperate to form one logical qubit whose error falls exponentially as code distance grows, provided physical error is below roughly 1%. Typical estimates put the overhead at about 1,000 physical qubits per logical qubit at 10-3 physical error. Google's 105-qubit Willow chip (2024) showed logical error dropping as code distance increased, the first convincing "below threshold" demonstration, but this is still a few logical qubits, not thousands.
Rule of thumb: applications are limited by logical qubits × circuit depth. Multiply logical qubits by roughly 103 to estimate physical qubits.
Chemistry and materials simulation: the strongest case
Nature is quantum, so simulating electrons in molecules is where a quantum computer has a structural advantage. The exact electronic wavefunction of N electrons needs a classical state space that grows exponentially, so methods such as coupled cluster or DMRG approximate. They work well for weakly correlated molecules but struggle with strongly correlated systems: transition-metal catalysts, the nitrogenase cofactor FeMoco, high-temperature superconductors.
Resource estimates for FeMoco ground-state energy via quantum phase estimation land at around a thousand or more logical qubits and 1010-1013 T gates, depending on the encoding. That is a fault-tolerant target, not a near-term one. On NISQ hardware the variational quantum eigensolver (VQE) runs a shallow parameterised circuit, measures an energy, and lets a classical optimiser update the parameters. VQE has reproduced H2, LiH and BeH2, which classical codes solve exactly in milliseconds. Noise, plus "barren plateaus" where gradients vanish, has so far blocked a useful advantage.
- Near term (now to ~2030): small active-space calculations, benchmarking, hybrid workflows.
- Long term: catalysts, battery electrolytes, drug-binding energetics where classical accuracy of 1 kcal/mol is out of reach.
Chemistry needs few logical qubits compared with cryptanalysis, but a very deep circuit. Its limit is error rate more than raw qubit count.
Optimisation: more hype than evidence
Logistics, portfolio selection and chip floorplanning are NP-hard in general, and quantum computers are not known to solve NP-hard problems efficiently. The proven tool is Grover search, which gives only a quadratic speedup: N items in about √N queries. Quadratic sounds nice, but error-corrected quantum gates are slow (microseconds against nanoseconds), so a classical machine with parallel hardware often wins until problems become enormous. Analyses of Grover-style speedups for combinatorial problems suggest the crossover needs very large, fault-tolerant machines.
Quantum annealers and QAOA are promising heuristics but lack a rigorous advantage over tuned classical solvers such as simulated annealing, CP-SAT or the placement engines inside commercial tools. In physical design flows, such as Cadence Innovus or Synopsys IC Compiler II, cost functions rely on heuristics refined over decades. Any quantum contender must beat these on wall-clock time and quality, not on a toy instance.
| Application | Algorithm | Speedup | Main limiter |
|---|---|---|---|
| Strongly correlated chemistry | Phase estimation, VQE | Exponential (believed) | Gate depth, error rate |
| Breaking RSA / ECC | Shor | Exponential (proven) | Logical qubit count + depth |
| Unstructured search / optimisation | Grover, QAOA | Quadratic / unproven | Slow gates, classical competition |
| Machine learning | HHL, kernels | Contested | Data loading (QRAM) |
Cryptanalysis: certain in principle, distant in practice
Shor's algorithm factors integers in polynomial time, breaking RSA and elliptic-curve schemes. The size matters: Gidney and Ekerå (2019) estimated RSA-2048 needs about 20 million noisy physical qubits and eight hours; Gidney's 2025 refinement cut this to under one million physical qubits and under a week. Both assume 10-3 physical error and a surface code. Against today's roughly 103 qubits this is a gap of three orders of magnitude.
Symmetric ciphers fare better: Grover halves effective key length, so AES-256 stays comfortable. The real present-day threat is "harvest now, decrypt later", where adversaries store encrypted traffic for future decryption. That is why NIST finalised post-quantum standards (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA) in 2024 and why hardware security modules and secure-boot ROMs must plan for algorithm agility. If you work on silicon roots of trust, this affects the signature engine you tape out. Teams at Avecas design services already see post-quantum accelerators appear in SoC requirements.
The hybrid loop you can run today
Near-term applications are hybrid: a classical optimiser steers a quantum co-processor, shown below. Each iteration is a few thousand shots, so classical latency, not qubit count, often dominates runtime.
What to learn if you want to work here
Quantum advantage will be built by hardware engineers as much as physicists: cryogenic control ASICs, fast decoders, photonic interconnects. Circuit simulation of cryo-CMOS runs in tools like Cadence Spectre and Synopsys HSPICE, and qubit control chips need the same timing closure and verification discipline as any SoC. Our error correction basics article is a good next step, and ChipXpert VLSI training covers the digital design foundations. Browse all programs on our courses page.
Ready to build the hardware skills behind quantum and classical silicon? Explore the CourseTron VLSI and quantum-ready courses and start with the fundamentals today.
FAQ
Which quantum application will be useful first?
Most experts expect chemistry and materials simulation, because it maps naturally to quantum mechanics. Early value likely comes from small, accurate active-space calculations inside hybrid workflows.
When can quantum computers break RSA-2048?
Not with current hardware. Estimates require roughly one million or more physical qubits at 0.1% error, versus about a thousand today. Timelines are uncertain, which is why migration to post-quantum cryptography is already under way.
Will quantum computers solve NP-hard optimisation problems?
No proof exists. Grover gives a quadratic speedup at best, and heuristics such as QAOA have not beaten strong classical solvers on practical instances.
What limits applications more, qubit count or error rate?
Both, and they interact. Lower physical error reduces the physical-to-logical overhead, so better error rates cut required qubit count dramatically.