In short: Quantum phase estimation (QPE) is the workhorse subroutine that reads the eigenvalue phase φ of a unitary U acting on one of its eigenstates — writing φ as a binary fraction into a register of counting qubits via controlled-U2k gates and an inverse Quantum Fourier Transform — and it is exactly the engine that turns factoring (Shor) and many chemistry problems into a phase-readout task.
Ask any quantum-computing interviewer to name the one subroutine you should be able to derive on a whiteboard, and most will say quantum phase estimation. It is the bridge between abstract linear algebra and the headline algorithms: Shor's factoring, the HHL linear-solver, and ground-state energy estimation in quantum chemistry all reduce to "estimate the phase of an eigenvalue." If you understand QPE, you understand why a quantum computer can factor RSA-2048 in polynomial time while your laptop cannot.
The problem QPE solves
Every unitary operator U has eigenvalues that lie on the unit circle, so each can be written as e2πiφ for some phase φ ∈ [0,1). If you are handed a unitary U and one of its eigenstates |u⟩, then by definition U|u⟩ = e2πiφ|u⟩. The eigenvalue carries no amplitude information you can measure directly — a global-like phase on a state is invisible to a measurement. QPE's job is to take that hidden φ and copy it, bit by bit, into a separate register you can measure.
Key fact: With t counting qubits, QPE resolves φ to t bits of precision, i.e. an error of order 2−t, succeeding with probability at least 4/π² ≈ 0.405 on the nearest bit string — a floor you push toward 1 by adding a handful of extra qubits.
The circuit, stage by stage
QPE uses two registers: a counting register of t qubits initialised to |0⟩⊗t, and an eigenstate register holding |u⟩. Three stages follow:
- Superposition. Apply a Hadamard to each counting qubit, producing an equal superposition over all 2t basis states.
- Kickback via controlled powers. Qubit k (k = 0…t−1) controls U2k acting on the eigenstate register. Because |u⟩ is an eigenstate, the unitary never changes it — instead the phase e2πi·2kφ is "kicked back" onto the control qubit. This is the same phase-kickback trick behind Deutsch–Jozsa.
- Inverse QFT. After the controlled gates the counting register holds a Fourier-basis encoding of φ. An inverse Quantum Fourier Transform rotates it into the computational basis, so a measurement yields the binary digits of φ directly.
Why the doubling of powers matters
The magic is that qubit k applies U raised to the power 2k. That means it accumulates the phase for bit position k of the binary expansion of φ. Concretely, if φ = 0.b1b2b3… in binary, the most significant bit comes from the qubit that applied the highest power of U. The inverse QFT then does precisely what a classical inverse DFT would do — it disentangles those staggered phase rotations into definite bit values.
If φ happens to be an exact t-bit fraction, QPE returns it with probability 1. If φ is irrational or needs more than t bits, you get the closest t-bit estimate with high probability, and the tail falls off quadratically.
A worked example: φ = 3/8
Take t = 3 and suppose U|u⟩ = e2πi(3/8)|u⟩. In binary, 3/8 = 0.011. After the Hadamards and controlled-powers, the counting register is in a Fourier state; the inverse QFT collapses it so a measurement yields the bit string 011 with certainty. Read back as 0.011₂ = 3/8 — exact, because 3/8 fits in three bits.
| Counting qubits t | Resolvable phases | Worst-case error | Typical use |
|---|---|---|---|
| 3 | 8 values | ~0.125 | Teaching / toy U |
| 8 | 256 values | ~0.004 | Small molecule energies |
| 20 | ~10⁶ values | ~10⁻⁶ | Order-finding in Shor |
| ~4000 | 2⁴⁰⁰⁰ values | cryptographic | Factoring RSA-2048 |
Watching the phase accumulate
Key fact: QPE is not fault-tolerant on today's hardware — accumulated gate error across the controlled-U chain limits useful t to a handful of qubits on NISQ devices, which is why variational methods (VQE) are often used as a near-term stand-in for the chemistry problems QPE will eventually own.
Where QPE shows up in the toolchain
QPE is the heart of Shor's algorithm, where the unitary is modular multiplication and the phase encodes the period you need to factor a number — the connection is laid out in our companion piece on Shor's and Grover's algorithms. It also underpins ground-state energy estimation, which you can explore alongside the Quantum Fourier Transform, QPE's indispensable final stage. On the engineering side, teams building control electronics and cryogenic test flows for these processors lean on the same silicon design discipline our partners at Avecas VLSI design services bring to classical chips.
If you are rehearsing for a quantum role, practise deriving the three-stage circuit cold, computing the success probability from the QFT kernel, and explaining why the powers double. See how this fits the broader curriculum on our courses page.
Ready to go from reading QPE to building it in Qiskit? Join CourseTron's Quantum Algorithms track and implement phase estimation, Shor, and HHL end to end — enrol today.
Frequently asked questions
Why do we need an eigenstate |u⟩ to run QPE?
Because the phase is only well defined for an eigenstate. If you feed a superposition of eigenstates, QPE returns the phase of one of them chosen at random (weighted by its amplitude squared) — which is actually how order-finding in Shor exploits it, since you don't need any specific eigenstate there.
How many extra qubits buy higher success probability?
To estimate φ to n bits with success probability at least 1−ε, you use roughly n + ⌈log(2 + 1/2ε)⌉ counting qubits. A few guard qubits lift the baseline 40% success toward 99%+.
What is the role of the inverse QFT specifically?
The controlled-powers stage leaves φ encoded in the relative phases of the Fourier basis. The inverse QFT is the exact change of basis that maps those phases to computational-basis bit strings, making φ measurable.
Is QPE usable on today's hardware?
Only at very small scale. The long chain of controlled unitaries demands deep, low-error circuits, so full-precision QPE waits on fault-tolerant machines; iterative and Bayesian QPE variants trade qubits for repeated shallow runs to stretch what NISQ devices can do.