A History ofQuantum Computing

0.1The conveyor belt

At Harvard and MIT, physicists built quantum computers from single atoms. They held each atom in an optical tweezer, a tightly focused laser beam, and used it as a qubit, the basic unit of a quantum computer. They kept losing atoms from the tweezers, and with them the information the atoms held. Every group that built such a machine had to stop, reload and start again when it lost too many. Neng-Chun Chiu, Elias Trapp and their colleagues in the laboratories of Mikhail Lukin, Markus Greiner and Vladan Vuletić built a way round it. With optical lattice conveyor belts, moving patterns of laser light, they carried in fresh atoms at up to 300,000 a second and set each in place with tweezers. They ran an array of more than 3,000 qubits for over two hours, cycling more than 50 million atoms through the machine without disturbing the information in the rest.¹1 Kermit Pattison, “Clearing significant hurdle to quantum computing”, Harvard Gazette, 25 September 2025. news.harvard.edu

They had not built a useful quantum computer; nobody had. They had found a way past one item on a long list of reasons why nobody could. They had refilled the array around qubits held in storage; they had yet to do it during a long calculation.²2 Neng-Chun Chiu et al., “Continuous operation of a coherent 3,000-qubit system”, Nature 646, 1075, 2025. arxiv.org Lukin’s group had already shown, in 2023, that they could spread one qubit’s information over a block of atoms and run calculations on 48 such blocks.³3 D. Bluvstein et al., “Logical quantum processor based on reconfigurable atom arrays”, Nature 626, 58, 2024. nature.com Engineers at Google, Quantinuum, IBM and a dozen other companies were working through that list too. Some used superconducting circuits cooled to about a hundredth of a degree above absolute zero; others used single ions held by electric fields, or particles of light in silicon chips.

0.2A century of objections

Physicists of standing had written each item on that list, usually for good reasons. Max Planck, a theorist in Berlin, told the German Physical Society on 14 December 1900 that he had divided the energy of a heated body’s resonators into fixed lumps, each equal to his new constant h times the frequency. He needed the lumps to count the ways the resonators could share their energy. He could fit the experimenters’ measurements of heat radiation in no other way, though nothing in the physics of the day allowed such lumps.⁴4 Nobel Prize Outreach, “Max Planck: Biographical”, from Nobel Lectures, Physics 1901–1921. nobelprize.org Albert Einstein, Boris Podolsky and Nathan Rosen argued in Physical Review in May 1935 that quantum mechanics must be incomplete. By its rules, a physicist who measured one of two separated particles could predict a measurement on the other without disturbing it. Most physicists filed the question under philosophy. In a short paper of November 1964, John Bell, a theorist at CERN, turned it into an inequality that experimenters could test. Experimenters ran the tests. Alain Aspect, John Clauser and Anton Zeilinger shared the 2022 Nobel Prize in Physics for their work with entangled photons.⁵5 Nobel Prize Outreach, “Press release: The Nobel Prize in Physics 2022”, 4 October 2022. nobelprize.org

Richard Feynman, a physicist at Caltech, pointed out in a talk published in 1982 that a programmer who adds one particle to a quantum system needs at least twice as many numbers to describe it. He suggested that engineers build computers out of quantum parts.⁶6 Richard P. Feynman, “Simulating physics with computers”, International Journal of Theoretical Physics 21, 467, 1982. doi.org Peter Shor at Bell Labs gave the idea a purpose in 1994. He showed that anyone with a large quantum computer could factor large numbers fast and so break the public-key codes that banks and governments use to protect their connections.⁷7 Peter W. Shor, “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer”, arXiv:quant-ph/9508027, expanded from the Proceedings of the 35th Symposium on Foundations of Computer Science, Santa Fe, 20–22 November 1994. arxiv.org Rolf Landauer of IBM had already told a meeting in Santa Fe that May that nobody knew how to protect such a machine from its own errors.⁸8 Peter W. Shor, “The Early Days of Quantum Computation”, arXiv:2208.09964, 2022. arxiv.org Christopher Monroe, David Wineland and their colleagues at NIST in Boulder built the first quantum logic gate on a single trapped ion the next year.

Serge Haroche and Jean-Michel Raimond, experimenters at the École Normale Supérieure in Paris, made the sceptics’ strongest case in Physics Today in August 1996. They argued that experimenters would lose the information in their qubits to the surroundings long before they could finish a useful calculation.⁹9 Serge Haroche and Jean-Michel Raimond, “Quantum computing: dream or nightmare?”, Physics Today 49(8), 51, 1996. doi.org Theorists answered with codes to detect and repair quantum errors and proofs that the repairs would work if engineers built each part well enough. Google’s team sampled a random circuit on their Sycamore chip in about 200 seconds in 2019. They estimated that programmers would need 10,000 years to do the same on the best supercomputer. IBM’s researchers replied that October that, by their own estimate, programmers could do it in about two and a half days.¹⁰10 F. Arute et al., “Quantum supremacy using a programmable superconducting processor”, Nature 574, 505, 2019. nature.com In December 2024 Google’s team reported logical qubits on their Willow chip that they had made more reliable by making them larger.

Other physicists answered each objection with an experiment, a proof or a list of parts. Stern and Gerlach split a beam of silver atoms; Bennett and Brassard made secret keys from quantum light. Wineland and Monroe built a gate from one ion. Clarke, Devoret and Martinis made a circuit behave like an atom. Haroche shared the 2012 Nobel Prize in Physics with Wineland, whose group had turned ion traps into quantum logic.¹¹11 Nobel Prize Outreach, “The Nobel Prize in Physics 2012”. nobelprize.org Not every claimant was right. Engineers at one company sold machines; academic researchers tested them in 2014 and found no clear speed-up. Authors at Delft retracted one celebrated Majorana paper. Many specialists doubted Microsoft’s later claims about that physics. By 2026 DARPA’s evaluators were testing whether anyone could build a useful machine by 2033. Nobody had yet used a quantum computer for work of commercial value that an ordinary computer could not do.

The first objection on the list was an assumption every physicist shared, that anyone could divide energy without limit. Experimenters at the Physikalisch-Technische Reichsanstalt in Charlottenburg, on the edge of Berlin, were measuring heat radiation to help the city’s officials compare gas and electric street lamps.¹²12 Physikalisch-Technische Bundesanstalt, “PTR/PTB: 125 Jahre metrologische Forschung”, PTB-Mitteilungen 122 (2), 2012. oar.ptb.de By 1900 they could show that the formula Planck believed he had derived from first principles was wrong at long wavelengths.

1.1Light for Berlin’s streets

Berlin’s officials had to choose between gas and electric street lamps; the physicists of the Physikalisch-Technische Reichsanstalt could not compare the two without a better standard of brightness. Otto Lummer and Wilhelm Wien built one in 1895: the first practical “black body”, a hollow oven, heated evenly, with a small hole in its wall. An experimenter who looks into such a hole sees the same colour and brightness at a given temperature, whatever the oven is made of. Physicists call the share of energy at each wavelength the spectrum. Werner von Siemens, the electrical industrialist, had given the land for the institute in Charlottenburg, on the western edge of the city. Deputies in the Reichstag voted its first budget on 28 March 1887. Its first president, Hermann von Helmholtz, had a staff of 65 and a budget of 263,000 marks.¹1 Helmut Rechenberg, “Helmholtz und die Gründerjahre”, PTB-Mitteilungen 122 (2), 2012. oar.ptb.de Richard Glazebrook, who ran Britain’s new National Physical Laboratory, valued the site alone at £25,000 in a lecture printed in 1901.²2 R. T. Glazebrook, “The Aims of the National Physical Laboratory of Great Britain”, Popular Science Monthly 60, December 1901, pp. 124–144. archive.org

Max Planck, the professor of theoretical physics at Berlin, believed he had derived Wien’s 1896 formula for that spectrum from first principles. Like other physicists of his day, he treated energy as a quantity he could divide without limit. The Reichsanstalt’s experimenters kept testing the formula deep in the infrared, where they needed a sensitive thermometer to register the heat. Lummer and Ernst Pringsheim reported on black-body radiation at long wavelengths to the German Physical Society on 2 February 1900; by the autumn they were arguing that Wien’s law did not hold there.³3 O. Lummer and E. Pringsheim, “Ueber die Strahlung des schwarzen Körpers für lange Wellen”, Verhandlungen der Deutschen Physikalischen Gesellschaft 2, p. 163, 1900; Hans Kangro, introduction to Planck’s papers (1972). informationphilosopher.com

Heinrich Rubens, who taught at the Technische Hochschule in Charlottenburg, pushed further at the Reichsanstalt with Ferdinand Kurlbaum. Rubens knew that a crystal of fluorspar or rock salt is a strong reflector in only one narrow band. By bouncing the radiation off several crystals, one after another, he could isolate a single band of invisible heat rays. With rock salt they worked at about 51 micrometres, roughly a hundred times the wavelength of green light, and found the energy rising in a straight line with temperature. Physicists using Wien’s law expected nothing of the kind; Lord Rayleigh had predicted just this behaviour with a rival formula.⁴4 H. Rubens and F. Kurlbaum, “On the Heat-Radiation of Long Wave-Length Emitted by Black Bodies at Different Temperatures”, Astrophysical Journal 14, 335, 1901 (from the Sitzungsberichte of the Berlin Academy, 25 October 1900). ifsc.usp.br

1.2Energy in pieces

By the usual account, Rubens described the new results when he and his wife dined with the Plancks on 7 October 1900. After the guests left, Planck worked out a formula that matched Wien at short wavelengths and Rayleigh at long ones. He wrote it on a postcard to Rubens, who soon reported that it fitted every measurement he had. Kurlbaum presented the long-wave data to the society on 19 October. In the lively discussion that followed, Planck offered his formula as “an improvement of Wien’s spectral equation”. He conceded that he had himself argued for the necessity of Wien’s law before that society.⁵5 Verhandlungen der Deutschen Physikalischen Gesellschaft 2, pp. 181 and 202, 1900. archive.org

Planck had a formula and wanted a reason for it. He turned to the statistical methods of Ludwig Boltzmann, the Viennese physicist whose approach to heat he had long resisted. Boltzmann measured disorder by counting the ways a system could share out its energy; to count, Planck had to treat the energy as a set of pieces.⁶6 Domenico Giulini and Norbert Straumann, “…ich dachte mir nicht viel dabei…”, arXiv quant-ph/0010008, 2000. arxiv.org He read the result to the society on 14 December 1900.

If E is regarded as a quantity divisible without limit, the distribution can be made in infinitely many ways. We consider, however – and this is the most essential point of the whole calculation – E to be composed of a quite definite number of finite equal parts, and for this we use the natural constant h = 6.55 × 10⁻²⁷ [erg × sec]. This constant, multiplied by the common frequency ν of the resonators, gives the energy element ε in erg, and by dividing E by ε we obtain the number P of energy elements which are to be distributed among the N resonators. If the quotient so calculated is not a whole number, take for P a whole number close to it.

Planck’s “resonators” were imaginary oscillators in the oven walls, which he supposed to absorb and emit the radiation. He did not claim that light itself came in lumps. In a letter of 1931 he recalled the step as “a purely formal assumption”, made because he had to find a theoretical explanation at any price. From the fit to the Reichsanstalt’s data he also drew two constants. With them he computed the number of molecules in a gram-molecule and the charge of the electron, the second far more precisely than anyone had before.⁷7 Giulini and Straumann, arXiv quant-ph/0010008, 2000, quoting Planck’s letter to R. W. Wood of 1931. arxiv.org

1.3Quanta of light

Albert Einstein, 26 and working in Bern, took the pieces more seriously than their inventor did. He signed his paper “On a Heuristic Point of View concerning the Production and Transformation of Light” on 17 March 1905; the editors of Annalen der Physik printed it that year.⁸8 Albert Einstein, “Über einen die Erzeugung und Verwandlung des Lichtes betreffenden heuristischen Gesichtspunkt”, Annalen der Physik 17, pp. 132–148, 1905. archive.org Einstein treated light itself as separate bundles of energy.

It seems to me, in fact, that the observations on “black radiation”, photoluminescence, the production of cathode rays by ultraviolet light and other groups of phenomena concerning the production or transformation of light appear easier to understand on the assumption that the energy of light is distributed discontinuously in space. On the assumption considered here, when a ray of light spreads out from a point, its energy is not spread continuously over ever larger volumes; instead it consists of a finite number of energy quanta, localised at points in space, which move without dividing and can be absorbed and produced only as wholes.

Einstein applied the idea to the photoelectric effect. Philipp Lenard had shone ultraviolet light on metals and found in 1902 that with brighter light he freed more electrons from the surface, but not faster ones. Physicists who pictured light as waves could not easily explain that, since brighter waves have more energy. Einstein pictured a single electron taking the whole energy of one quantum, spending a fixed amount to escape the metal and keeping the rest. On that view, an experimenter who brightens the light sends more quanta and frees more electrons, each no faster than before. He predicted that an experimenter who charged the metal just enough to stop the escaping electrons, and plotted that voltage against the frequency of the light, would find the points on a straight line. The slope would be the same for every metal. Against Lenard’s numbers he made a rough check: about 4.3 volts for the shortest ultraviolet in sunlight, the same order of magnitude as Lenard’s results.⁹9 Einstein, Annalen der Physik 17, pp. 145–146, 1905. archive.org

Almost no one accepted the light quantum; physicists had a century of interference experiments behind them, all explained by waves. When Planck, Walther Nernst, Rubens and Emil Warburg proposed Einstein for the Prussian Academy in 1913, they praised him warmly and apologised for this one idea.

1.4Stationary states

Ernest Rutherford at Manchester had proposed in 1911 that an atom is a tiny, heavy, positive nucleus with electrons around it. Physicists using the electrodynamics of the day calculated that a circling electron would radiate and spiral inward in a fraction of a second. Yet chemists handled stable atoms every day. Niels Bohr, a young Danish physicist in Copenhagen, carried the quanta into the atom to explain why. He published “On the Constitution of Atoms and Molecules” in the Philosophical Magazine in July 1913, with Rutherford as the communicating member.¹⁰10 N. Bohr, “On the Constitution of Atoms and Molecules”, Philosophical Magazine, series 6, vol. 26, pp. 1–25, July 1913. archive.org In two “principal assumptions” he let physicists apply ordinary mechanics to an atom in certain “stationary states” but not to its passage from one state to another. He required that each such passage end in the emission of light whose frequency obeyed Planck’s relation. He admitted that the second assumption stood “in obvious contrast to the ordinary ideas of electrodynamics”; he kept it because the experimental facts seemed to demand it.

With those rules Bohr reproduced the series of hydrogen’s spectral lines that Johann Balmer and Johannes Rydberg had fitted with formulas decades earlier. He computed the constant in Rydberg’s formula from the charge and mass of the electron and Planck’s h. Critics dismissed the agreement as numerology.¹¹11 Helge Kragh, “The Early Reception of Bohr’s Atomic Theory (1913–1915)”, RePoSS 9, Aarhus University, 2010. css.au.dk

1.5The machine shop in vacuo

Robert Millikan, at the University of Chicago’s Ryerson Laboratory, set out to test Einstein’s equation while rejecting the idea behind it. In a lecture in Cleveland in 1912 he had said that a particle theory of light was “quite unthinkable” to him.¹²12 Gerald Holton, “Centennial Focus: Millikan’s Measurement of Planck’s Constant”, Physical Review Focus 3, 23, 1999. physics.aps.org Millikan had worked on escaping electrons since 1905; his hardest problem was the metal. Experimenters who cut a fresh metal surface in air soon found it filmed over. After that they could not tell how much energy an electron needed to escape. Millikan chose sodium, potassium and lithium, alkali metals that he could test over a longer range of frequencies than others. He also noted that they were “inflammable”.

So Millikan’s team worked inside the vacuum. They cast the three metals as cylinders on a wheel in an evacuated glass tube and turned the wheel with electromagnets from outside. By moving an electromagnet they drove a knife forward to shave a thin slice off the face of a cylinder. They let the shavings drop into a bulb below, where, Millikan wrote, they were “of use in freeing the tube from residual oxygen”. Then they swung the fresh surface round to face a beam of single-colour light. Millikan wrote that the apparatus had become “a machine shop in vacuo”; he credited the mechanician Julius Pearson, who made the tubes and helped design them.¹³13 R. A. Millikan, “A Direct Photoelectric Determination of Planck’s ‘h’”, Physical Review 7, pp. 355–388, 1916. archive.org

In the full paper, in Physical Review in March 1916, Millikan reported that he had subjected Einstein’s equation to “very searching tests” and that “it appears in every case to predict exactly the observed results”. He gave h as 6.57 × 10⁻²⁷ erg-seconds, with an uncertainty of about half a per cent.¹⁴14 Millikan, Physical Review 7, p. 388, 1916. archive.org

Millikan still did not believe in the light quantum. On the paper’s first page he described Einstein’s idea as “the bold, not to say the reckless, hypothesis of an electro-magnetic light corpuscle”. In his Nobel address he said he had found the proof “contrary to my own expectation” and that the light quantum itself remained “far from being established”. The Nobel committee was more decided. Its members gave Einstein the 1921 prize, awarded in 1922, “especially for his discovery of the law of the photoelectric effect”. They gave Millikan the 1923 prize for his work on the electron’s charge and on the photoelectric effect.¹⁵15 Nobel Prize Outreach, The Nobel Prize in Physics 1921. nobelprize.org

Bohr’s rules were more makeshift than anything Planck, Einstein or Millikan had offered. He kept ordinary mechanics for the stationary states and set it aside for the jumps between them. By 1916 nobody had written a mechanics that took in both. Two theorists, Otto Stern and Max von Laue, had sworn to each other that they would leave physics if Bohr turned out to be right.¹⁶16 Bretislav Friedrich and Dudley Herschbach, “Stern and Gerlach: How a Bad Cigar Helped Reorient Atomic Physics”, Physics Today 56 (12), 2003. courses.physics.ucsd.edu Stern went on to test one of Bohr’s rules with a beam of silver atoms.

2.1A bad cigar in Frankfurt

Otto Stern, the theorist who had sworn to leave physics if Bohr turned out to be right, had his idea in a warm bed, by his own account. He was then Max Born’s assistant at the institute for theoretical physics in Frankfurt. Bohr and Arnold Sommerfeld had argued that an atom acting as a tiny magnet could point only in a few set directions in a magnetic field. Most physicists, Born among them, took this “space quantisation” as a manner of speaking. Stern proposed to take it literally. He would send a beam of silver atoms through a magnet shaped to push each atom up or down by an amount that depended on its tilt. If atoms could point any way, he expected a smear of silver on the collecting plate; if Bohr was right, separate lines.¹1 Friedrich and Herschbach, “Stern and Gerlach: How a Bad Cigar Helped Reorient Atomic Physics”, Physics Today 56 (12), 2003. courses.physics.ucsd.edu

Born was unimpressed. Stern recruited Walther Gerlach, an experimenter next door who had never heard of space quantisation. The two men needed more than a year. In its final form they heated silver to 1,000°C in an oven and let the vapour escape through two slits 0.03 mm wide into a magnet 3.5 cm long. The split they eventually saw was only 0.2 mm wide. They lost a run whenever a slit or the magnet sat more than 0.01 mm out of line; they seldom kept the apparatus working for more than a few hours. Nor could they see the thin film of silver on the plate.

Decades later Stern told the chemist Dudley Herschbach how they first saw a trace: Gerlach handed him the plate; Stern watched a line slowly appear. Paid like an assistant professor, Stern could afford only cheap cigars, heavy with sulphur, and believed he had turned the silver into jet-black silver sulphide by breathing on it. In 2002 Herschbach and Bretislav Friedrich tested the story on glass slides coated with silver. By breathing on them, even hard, they left no visible mark. With cigar smoke they blackened the film within seconds to minutes. They concluded that Stern had probably smoked over the plate.²2 Friedrich and Herschbach, Physics Today 56 (12), 2003. courses.physics.ucsd.edu

Born raised money as German inflation worsened. He charged for entry to public lectures on Einstein’s relativity. When that money ran out, a friend in New York told him to write to Henry Goldman, a founder of Goldman Sachs with family roots in Frankfurt; Goldman sent a cheque for some hundreds of dollars. Stern had since moved to a chair at Rostock. Early in 1922 he and Gerlach met in Göttingen and agreed to give up. Gerlach lost a day to a railway strike on the way home. He spent it going over every detail, decided to carry on, improved the alignment and soon saw the beam split cleanly in two. He telegraphed Stern: “Bohr is right after all.” On 8 February 1922 he sent Bohr a postcard bearing a photograph of the split, with congratulations on the confirmation of his theory.³3 Friedrich and Herschbach, Physics Today 56 (12), 2003. courses.physics.ucsd.edu

Stern and Gerlach were luckier than they knew. Physicists later traced a silver atom’s magnetism to the electron’s own “spin”, first proposed in 1925, which has only two possible orientations. Bohr had pictured an orbiting electron as the source. Friedrich and Herschbach found no one attributing the two lines to spin in print before Ronald Fraser in 1927.

2.2Matrices and waves

Werner Heisenberg, 23 and now Born’s assistant in Göttingen, suffered from hay fever. On 6 June 1925 he left for about ten days on the North Sea island of Heligoland, which had hardly a plant on it. Bohr had pictured electrons circling the nucleus in orbits that no one could observe. Heisenberg resolved to build a theory only from what experimenters could measure, the frequencies and brightness of the lines in an atom’s spectrum. He later recalled working through the night on the island; some historians think he did much of the work before and after the visit.⁴4 Ryan Dahn, “What happened on Helgoland 100 years ago—and what didn’t?”, American Institute of Physics, 13 June 2025. aip.org In the one-sentence summary of his paper he stated his aim: a mechanics resting “exclusively on relations between quantities that are observable in principle” (translated for this book).⁵5 Werner Heisenberg, “Über quantentheoretische Umdeutung kinematischer und mechanischer Beziehungen”, Zeitschrift für Physik 33, 1925, as quoted in Thomas Filk, “Die Jahre 1925 und 1926”, Universität Freiburg, 2025. physikdidaktik.uni-freiburg.de He gave the manuscript to Born to submit if he thought it worthwhile and went on holiday. The editors of Zeitschrift für Physik received it on 29 July.⁶6 W. Heisenberg, “Über quantentheoretische Umdeutung kinematischer und mechanischer Beziehungen”, Zeitschrift für Physik 33, pp. 879–893, received 29 July 1925. link.springer.com

Heisenberg had arranged his quantities in square tables, one row and one column for each state of the atom; when he multiplied two tables, the answer depended on the order. Born puzzled over the rule for about a week before he recognised it from his student mathematics. Heisenberg had reinvented matrices. With his student Pascual Jordan, Born rewrote the scheme in matrix form. The three men then extended it together. Einstein described the result as “a true witches’ multiplication table”.⁷7 Katherine Bourzac, “June/July 1925: Werner Heisenberg pioneers quantum mechanics”, APS News, 1 July 2025. main--aps-org.netlify.app

Louis de Broglie, a French aristocrat who had studied history before physics, had already turned Einstein’s light quanta round. If light waves sometimes behave as particles, he argued in his doctoral thesis of 1924, particles such as electrons should also have waves.⁸8 Wikipedia, Louis de Broglie, accessed 2026. en.wikipedia.org He had no experiment to support it. Erwin Schrödinger, an Austrian professor of physics, built on the idea. He wrote an equation for a wave spread through space and found that he could read hydrogen’s energy levels directly from its allowed patterns. The editors of Annalen der Physik received the first of his four papers, “Quantisation as an Eigenvalue Problem”, on 27 January 1926. In a paper sent in March he showed that physicists using his mechanics or Heisenberg’s would get the same answers.⁹9 Thomas Filk, “Die Jahre 1925 und 1926”, Universität Freiburg, 2025. physikdidaktik.uni-freiburg.de Many physicists found Schrödinger’s version easier to calculate with.

Schrödinger hoped that the wave was the electron, smeared out like a cloud of charge. Born disagreed. In a paper on collisions, which the editors received on 25 June 1926, he read the wave as a guide to chances. Physicists using the theory, he wrote, could get no answer to the question of the state after a collision, only to how probable a given outcome was.¹⁰10 Herbert Capellmann, “The Development of Elementary Quantum Theory from 1900 to 1927”, arXiv:1606.00190, 2016, quoting Born, Zeitschrift für Physik 37, 863, 1926. arxiv.org Physicists soon settled on the rule that the chance of finding a particle in a place is proportional to the square of the wave’s size there. The Nobel committee gave Born the physics prize in 1954 “especially for his statistical interpretation of the wavefunction”.¹¹11 Nobel Prize Outreach, The Nobel Prize in Physics 1954. nobelprize.org

2.3A broken tube in New York

At Bell Telephone Laboratories in New York, Clinton Davisson, a shy physicist, had been firing slow electrons at metal targets since the early 1920s. On 5 February 1925, by the laboratory notebook, his assistant Lester Germer found a cracked trap and the nickel target badly oxidised.¹²12 Richard K. Gehrenbeck, “Electron diffraction: fifty years ago”, Physics Today 31 (1), 1978. aip.brightspotcdn.com In their paper of 1927 they dated the accident to April.

The investigation reported in this paper was begun as the result of an accident which occurred in this laboratory in April 1925. At that time we were continuing an investigation, first reported in 1921, of the distribution-in-angle of electrons scattered by a target of ordinary (polycrystalline) nickel. During the course of this work a liquid-air bottle exploded at a time when the target was at a high temperature; the experimental tube was broken, and the target heavily oxidized by the inrushing air.

They cleaned the nickel by long heating in hydrogen and in vacuum and had the tube working again by 6 April. In mid-May they began to see electrons bouncing off in a new pattern, with sharp peaks at particular angles. They cut open the tube and, with a microscopist, found that by heating the target they had turned its many tiny crystals into about ten large ones. By April 1926 they had a single large crystal of nickel from the company’s metallurgist, Howard Reeve.¹³13 Gehrenbeck, Physics Today 31 (1), 1978. aip.brightspotcdn.com

Davisson knew little of the new theory until the summer of 1926, when he travelled with his wife to the British Association meeting in Oxford. There he heard Born cite his and Charles Kunsman’s old curves for a platinum target as evidence for de Broglie’s electron waves. He came home with a plan. Physicists already got strong X-ray reflections from a crystal only at angles where the waves from neighbouring rows of atoms were in step. With de Broglie’s rule Davisson could work out a wavelength for each electron energy and so predict, for each voltage, the angle at which a reflected beam of electrons should appear.

For weeks they saw only feeble peaks. On 6 January 1927 they set the collector at an intermediate angle and looked for a bump near 78 volts, the value they had calculated. They found one at 65 volts. Across the bottom of the notebook page Germer wrote: “First Appearance of Electron Beam”. Over the next few days, working in one-volt steps, they found clear peaks and the threefold pattern they expected from the crystal’s symmetry.¹⁴14 Gehrenbeck, Physics Today 31 (1), 1978. aip.brightspotcdn.com They announced electron diffraction in Nature on 16 April 1927. George Paget Thomson at Aberdeen, firing faster electrons through thin films, also reported electron diffraction in Nature that June. Davisson and Thomson shared the 1937 Nobel Prize; Germer did not.¹⁵15 Chelsea Wald, “Landmarks: Electrons Act Like Waves”, Physical Review Focus 17, 17, 2006. physics.aps.org

2.4Brussels, October 1927

Heisenberg, working with Bohr in Copenhagen, had by early 1927 set limits on what anyone using the new mechanics could know. He sent the argument to Wolfgang Pauli in a long letter on 23 February 1927; the editors of Zeitschrift für Physik received his paper on 23 March.¹⁶16 W. Heisenberg, “Über den anschaulichen Inhalt der quantentheoretischen Kinematik und Mechanik”, Zeitschrift für Physik, received 23 March 1927. link.springer.com He imagined locating an electron with a microscope. An observer who wants a sharp position must use gamma rays, light of very short wavelength. By bouncing even one gamma-ray quantum off the electron, the observer gives it a large kick of unknown size and so knows less about its momentum. Bohr found errors in the details but agreed with the conclusion. Earle Kennard, a physicist at Cornell, derived the exact relation from the mathematics of the theory later in 1927.

Twenty-nine physicists gathered in Brussels from 24 to 29 October 1927 for the fifth Solvay Council, under Hendrik Lorentz of Haarlem. The members included Marie Curie, Bohr, Born, de Broglie, Einstein, Heisenberg and Planck; Schrödinger gave a report on wave mechanics.¹⁷17 Institut International de Physique Solvay, Électrons et Photons: rapports et discussions du cinquième Conseil de Physique (Gauthier-Villars, 1928), pp. vii–viii. archive.org Born and Heisenberg closed their joint report by declaring the theory complete.

In sum, we would point out that, while we do not regard the researches last mentioned, on the treatment of the electromagnetic field by quantum mechanics, as finished, we hold quantum mechanics to be a complete theory, whose fundamental physical and mathematical hypotheses are no longer open to modification.

In the general discussion Einstein, whose light quanta had started the trouble, apologised for not having gone deeply into quantum mechanics and set out a simple case, with a sketch. He imagined electrons passing through a small hole in a screen and spreading out towards a large curved photographic film. Physicists using the theory calculate a wave spread over the whole film. Yet experimenters find the mark of each electron at a single spot. If the wave is a complete description of a single electron, Einstein said, physicists must suppose some peculiar action at a distance. Without it they could not explain why no one ever sees the wave act at two places on the film.¹⁸18 Électrons et Photons, pp. 253–256, 1928. archive.org

But the interpretation according to which |ψ|² expresses the probability that this particle is at a given place presupposes an entirely peculiar mechanism of action at a distance, which prevents the wave, spread continuously through space, from producing an effect at two places on the screen.

Bohr answered, there and in conversations that followed; the two men did not settle the matter in Brussels. Einstein accepted the theory’s predictions. He still wanted to know what physicists using the theory could say about one electron on its own. He kept looking for a case that would force Bohr to answer.

3.1Afternoon tea in Princeton

Einstein had left Brussels in 1927 still asking what a physicist using quantum mechanics could say about a single particle. By 1935 he held a post at the Institute for Advanced Study, whose members worked in Fine Hall, alongside Princeton University’s mathematicians, until 1939.¹1 Wikipedia, Institute for Advanced Study, accessed 2026. en.wikipedia.org By one account Nathan Rosen, a young physicist Einstein had recruited in 1934, raised a puzzle over the Institute’s three o’clock tea about wave functions shared between two particles. He, Einstein and Boris Podolsky, another recruit, talked it over. Podolsky wrote the paper, apparently for reasons of language, and submitted it to Physical Review on 25 March 1935.²2 Institute for Advanced Study, “The Advent and Fallout of EPR”, 2013. ias.edu

The authors considered two particles that interact and fly apart. In Podolsky’s description, experimenters who measure the position of the first particle can predict the position of the second with certainty; if they measure momentum instead, they can predict the second particle’s momentum. The authors proposed a test for what is real: if a physicist can predict a quantity with certainty “without in any way disturbing a system”, the quantity corresponds to an element of reality. An experimenter measuring the first particle, far away, surely disturbs nothing at the second. So, they argued, the second particle must possess a definite position and a definite momentum. Physicists using the wave function could describe no such thing, so they were working with an incomplete account of reality.³3 Wikipedia, EPR paradox, accessed 2026. en.wikipedia.org

Podolsky also told the press. On 4 May 1935, eleven days before the paper appeared, editors at the New York Times ran a story headed “Einstein Attacks Quantum Theory”. Einstein issued a statement saying the information had been given “without my authority”; by one account he never spoke to Podolsky again. Apparently he had never checked Podolsky’s draft. On 19 June he wrote to Schrödinger that Podolsky had buried the essential point under formalism. He gave a simpler version, based on what he took to be a principle of separation: what an experimenter does to one system cannot change the real state of another, distant one.⁴4 Arthur Fine, “The Einstein-Podolsky-Rosen Argument in Quantum Theory”, Stanford Encyclopedia of Philosophy. plato.stanford.edu

3.2Answers from Copenhagen and Oxford

Bohr replied in Physical Review on 15 October 1935, under the same title.⁵5 N. Bohr, “Can Quantum-Mechanical Description of Physical Reality be Considered Complete?”, Physical Review 48, 696, published 15 October 1935. journals.aps.org He accepted that experimenters measuring one particle give the other no mechanical push. But he argued that the authors had stated their test for reality ambiguously. By choosing what to measure on the first particle, he wrote, experimenters exert “an influence on the very conditions which define the possible types of predictions” about the second. Most physicists took Bohr’s reply as the end of the matter and went back to calculating.

Erwin Schrödinger, whose wave equation physicists found easy to use, had left Germany in 1933 for Magdalen College, Oxford. He took Einstein’s side further than Einstein had. In a paper for the Cambridge Philosophical Society, published in October 1935, he named the property that Einstein, Podolsky and Rosen had exposed. When two systems interact and separate, he wrote, physicists can no longer give each its own wave function, only one for the pair. He described the two as “entangled”, his own English for Verschränkung, the word he had used in a letter to Einstein. He ranked the property above all others in the theory.⁶6 Yu Shi, arXiv:2602.14601, 2026, quoting Schrödinger, Proceedings of the Cambridge Philosophical Society 31, 1935. arxiv.org

Schrödinger worked out his other famous example in letters with Einstein, who had pictured a keg of gunpowder that physicists using the theory would describe, after a while, as a blend of exploded and unexploded. In a three-part essay in Die Naturwissenschaften in November and December 1935, Schrödinger shut a cat in a steel chamber with a Geiger counter and a speck of radioactive material. He used so little that perhaps one atom would decay within the hour, perhaps none. He wired the counter, through a relay, to a hammer poised over a flask of hydrocyanic acid. A physicist who applies the wave function to the whole box must describe the cat, at the end of the hour, as a blend of living and dead. Schrödinger meant the case as an absurdity, to show that the wave function could not be a full picture of reality.⁷7 Wikipedia, Schrödinger’s cat, accessed 2026.; Springer, Die Naturwissenschaften 23, issue 49, December 1935. en.wikipedia.org link.springer.com

3.3A proof and its critic

Einstein wanted a fuller description; most physicists believed a mathematician had already shown that none could exist. John von Neumann, a Hungarian-born mathematician who joined the Institute in 1933, had set quantum mechanics on axioms in his book Mathematische Grundlagen der Quantenmechanik, published in Berlin in 1932. Some physicists hoped that quantum chances, like the odds at a roulette wheel, reflected ignorance of details: “hidden variables” which, if anyone knew them, would fix every result in advance. Von Neumann claimed to show that no such variables could reproduce quantum mechanics.⁸8 Wikipedia, Mathematical Foundations of Quantum Mechanics, accessed 2026. en.wikipedia.org

Grete Hermann, a mathematician and philosopher who had taken her doctorate under Emmy Noether at Göttingen, questioned the proof. In 1934 she joined Heisenberg’s seminar in Leipzig, by Heisenberg’s own account with the express purpose of challenging the philosophical basis of atomic physics.⁹9 C. L. Herzenberg, “Grete Hermann: An early contributor to quantum theory”, arXiv:0812.3986, 2008. arxiv.org In 1935 she published a long essay on the philosophical foundations of quantum mechanics, with a section headed “Der Zirkel in Neumanns Beweis”, the circle in Neumann’s proof.¹⁰10 Deutsche Physikalische Gesellschaft, “Grete Hermann”, Arbeitsset Quantenphysikerinnen. dpg-physik.de

Hermann charged von Neumann with assuming what he set out to prove. Von Neumann relied on a rule about averages: the average of a sum of two measured quantities equals the sum of their averages. Physicists can rely on that rule for the states of quantum mechanics. Von Neumann required it as well of the imagined states fixed by hidden variables, even for quantities that no one can measure at the same time. In Hermann’s view, a physicist who granted that step had already ruled out hidden variables. Physicists paid little attention until the historian Max Jammer revived her objection in 1974. Scholars still disagree about how far it reached. N. David Mermin and Rüdiger Schack have defended Hermann’s reading. Dennis Dieks has argued that von Neumann meant only to show that hidden variables would need a structure unlike that of quantum mechanics; on that reading, Hermann and later Bell attacked a stronger claim than he had made.¹¹11 N. David Mermin and Rüdiger Schack, “Homer nodded: von Neumann’s surprising oversight”, arXiv:1805.10311, 2018.; Dennis Dieks, “Von Neumann’s impossibility proof: Mathematics in the service of rhetorics”, arXiv:1801.09305, 2018. arxiv.org arxiv.org

3.4Hidden variables in exile

David Bohm, a young assistant professor at Princeton who had worked at the Radiation Laboratory in Berkeley during the war, restated the EPR argument in his textbook Quantum Theory, published in the spring of 1951. He swapped positions and momenta for spins: a molecule of zero total spin splitting into two atoms whose spins experimenters measure with magnets of the kind Stern and Gerlach had used. By the time the book appeared, Bohm faced a charge of contempt of Congress.

Members of the House Committee on Un-American Activities, investigating a Communist cell at the Radiation Laboratory, had questioned Bohm in executive session in Washington on 25 May 1949 and released his testimony on 10 June.

Mr. Russell. Mr. Bohm, have you ever been a member of the Young Communist League? Mr. Bohm. I can’t answer that question on the ground it might tend to incriminate and degrade me, and, also, I think it infringes on my rights as guaranteed by the first amendment. Mr. Wood. Would you mind repeating your answer? Mr. Bohm. I can’t answer that question because it might tend to incriminate and degrade me, and also because it might infringe on my rights as guaranteed by the first amendment.

A federal grand jury indicted Bohm for contempt of Congress late in 1950; Princeton’s administrators suspended him and barred him from the campus.¹²12 Princeton Alumni Weekly, “A Scholar Finally Gets His Due: David Bohm”. paw.princeton.edu A court acquitted him in May 1951. Princeton’s president, Harold Dodds, still declined to renew his contract. On the recommendation of Einstein and Oppenheimer, Bohm took a chair at the University of São Paulo and arrived in Brazil on 10 October 1951. The American consul in São Paulo took his passport and would return it only if Bohm went back to the United States.¹³13 Wikipedia, David Bohm, accessed 2026. en.wikipedia.org

In 1952 Bohm published two papers in Physical Review, “A Suggested Interpretation of the Quantum Theory in Terms of ‘Hidden’ Variables”, I and II. He gave every particle a definite position at every moment, steered by a wave, and still reproduced every quantum prediction. Louis de Broglie had proposed a version of the idea at the Solvay Council of 1927 and dropped it after criticism.¹⁴14 Wikipedia, De Broglie–Bohm theory, accessed 2026. en.wikipedia.org Bohm had built what most readers of von Neumann thought no one could build. In his account, though, what happens to one particle depends on the setting of an apparatus acting on its distant partner. Few physicists took it up. Heisenberg dismissed it as superfluous ideology; Einstein, who had urged Bohm to look for an alternative, found it too cheap. In 1957 Bohm and his student Yakir Aharonov pointed out that Chien-Shiung Wu and Irving Shaknov had already measured correlated pairs of photons, made when an electron meets its antiparticle, in experiments published in 1950.

3.5Geneva, 1964

By day John Stewart Bell worked on particle physics and accelerator design at CERN in Geneva; in his own time he worried about the foundations. The son of a Belfast dressmaker, he had come by way of Queen’s University Belfast and the British atomic research establishment at Harwell. He moved to CERN in 1960 with his wife, Mary Ross Bell, also a physicist.¹⁵15 Wikipedia, John Stewart Bell, accessed 2026. en.wikipedia.org Bell admired Bohm’s 1952 papers. He wrote later that he had seen “the impossible done”.¹⁶16 Dan Garisto, “1964: John Stewart Bell Quietly Rings in New Era of Quantum Theory”, APS News, 2022, republished in Physics 18, 53, 2025. physics.aps.org

On a year’s leave in the United States from 1963, at Stanford, Wisconsin and Brandeis, Bell wrote two papers. In the first he argued, as Hermann had, that von Neumann’s proof rested on an assumption that a hidden-variables theory need not satisfy. After someone misfiled the manuscript, the editors of Reviews of Modern Physics did not print it until 1966. In the second he asked what any theory with Einstein’s local instructions must predict for Bohm’s pairs of particles.

Bell assumed that each pair carries instructions fixed at the source, and that no experimenter at one magnet can affect the atom at the other. On those assumptions, he proved, experimenters who compare results at three magnet angles must find correlations that satisfy a simple inequality.¹⁷17 Yu Shi, “The road of quantum entanglement: from Einstein to 2022 Nobel Prize in Physics”, arXiv:2602.14601, 2026. arxiv.org Bell found that, by the rules of quantum mechanics, experimenters should see correlations that break it. Physicists had argued over the question as philosophy; experimenters could now settle it by counting.

Bell placed the paper, “On the Einstein Podolsky Rosen Paradox”, in a new journal, Physics Physique Физика, whose editors paid their authors but gave no free reprints. Bell used his fee to buy copies for colleagues.¹⁸18 Wikipedia, Physics Physique Fizika, accessed 2026. en.wikipedia.org The editors published it in November 1964.

In a letter to Max Born on 3 March 1947 Einstein had dismissed quantum correlations of this kind as “spooky action at a distance”. Bell had shown that anyone holding Einstein’s view of 1935 must predict different numbers from anyone using quantum mechanics. He did not promote the result. Other physicists cited it fewer than a dozen times in six years.¹⁹19 Garisto, Physics 18, 53, 2025. physics.aps.org Most still filed the question under philosophy; no one had built the experiment. One of the paper’s few readers was a young American physicist, John Clauser, who noticed the journal’s odd three-language title in 1967.²⁰20 Wikipedia, Bell’s theorem, citing David Kaiser, How the Hippies Saved Physics (2012). en.wikipedia.org

4.1A tabletop in Berkeley

John Clauser, a graduate student in astrophysics at Columbia University, read Bell’s paper and wanted to run the test. He paid for it later. Some American physicists doubted that such experiments counted as “real physics”. Clauser struggled to win a permanent post.¹1 Olival Freire Junior, “Alain Aspect’s experiments on Bell’s theorem”, European Physical Journal D, 2022. arxiv.org The apparatus he had in mind had been built at Berkeley for another purpose.

Carl Kocher, a Berkeley graduate student, and his adviser, Eugene Commins, wanted to catch the two photons, one green and one violet, given off in quick succession by a calcium atom on its way back to its ground state. In 1964 Kocher could not buy a suitable ultraviolet lamp to excite the atoms, so he designed and built a hydrogen arc lamp himself. Commins found $10,000 and arranged access to equipment from the Lawrence Radiation Laboratory up the hill.²2 Carl A. Kocher, “Quantum entanglement of optical photons: the first experiment, 1964–67”, Frontiers in Quantum Science and Technology, 2024. frontiersin.org Over more than a year he assembled the rest. He heated about 12 grams of calcium in a tantalum oven to 1,000 kelvin to make a thin beam of atoms. On each side of the beam he set a photomultiplier tube behind a rotatable polariser, a filter with an axis that a single photon either passes or fails to pass. He cooled the tubes to −15 °C to cut their random clicks and ran the apparatus for 25 hours from 17 December 1966. With the polarisers parallel he counted a clear excess of pairs arriving together; with them crossed, he found none. Kocher and Commins had shown that the two photons’ polarisations were linked. With counts at only two angles, they had not tested Bell’s inequality.

Clauser saw the gap. With Michael Horne and Abner Shimony of Boston University and Richard Holt of Harvard, he sent Physical Review Letters a proposal that the editors received on 4 August 1969. The four men rewrote Bell’s argument for leaky polarisers, inefficient detectors and photons scattered in every direction. They named the Kocher–Commins apparatus as the place to start and listed what an experimenter would have to add: runs at two more angles, and runs with each polariser taken out. They promised “a decisive test”.³3 Clauser, Horne, Shimony and Holt, “Proposed Experiment to Test Local Hidden-Variable Theories”, Physical Review Letters 23, 1969. informationphilosopher.com

4.2The sub-basement of Birge Hall

Clauser moved to Berkeley late in 1969 as a postdoctoral researcher under Charles Townes, who backed the experiment. Commins was unenthusiastic at first, by Clauser’s account, but with Townes behind the project he lent his old apparatus and a graduate student, Stuart Freedman.⁴4 William Thomas, “Entanglement and experiment, part 2: Oral history of the first Bell tests”, American Institute of Physics, 2026. aip.org Freedman and Clauser took over a room in the sub-basement of Birge Hall, assembled a new experiment from borrowed and scrounged parts and measured the photons about 10 feet apart.⁵5 Robert Sanders, “Physics Nobel recognizes Berkeley experiment on ‘spooky action at a distance’”, Berkeley Research, 2022. vcresearch.berkeley.edu Kocher and Clauser remember the hardware differently. Kocher wrote in 2024 that Clauser used his apparatus with minor improvements. Clauser told the historian Joan Bromberg, in an interview now held by AIP, that almost nothing of Kocher’s original was left.

Clauser had taught himself quantum mechanics and come to favour hidden variables. He hoped to find evidence for them.

Freedman and Clauser collected about 200 hours of data.⁶6 Freire, European Physical Journal D, 2022. arxiv.org In 1972 they reported a violation of the inequality by six standard deviations: the gap between their count and the hidden-variable limit was six times the random scatter they expected.⁷7 Stuart J. Freedman and John F. Clauser, “Experimental Test of Local Hidden-Variable Theories”, Physical Review Letters 28, 1972. doi.org Holt, a doctoral student of Francis Pipkin at Harvard, then reported numbers in favour of hidden variables. Clauser repeated the Harvard experiment and got the quantum answer. In 1976 Edward Fry and Randall Thompson excited their atoms with a tunable laser and gathered their data in 80 minutes.⁸8 Freire, European Physical Journal D, 2022. arxiv.org

4.3Switching in flight

Alain Aspect joined the Institut d’Optique at Orsay, south of Paris, in 1974, after civilian national service in Africa. A colleague, Christian Imbert, handed him a set of Bell’s papers. When Aspect described his plans, Bell asked whether he had a permanent job. Aspect had one. He planned and ran the experiments over about five years.⁹9 Freire, European Physical Journal D, 2022. arxiv.org

Freedman and Clauser had left their polarisers at fixed angles for hours. Nobody could rule out a signal, at or below the speed of light, passing between the two ends with news of how each was set. Aspect set out to change the settings after each pair had left the atom. First Aspect, Philippe Grangier and Gérard Roger excited their calcium atoms with two tunable lasers. In runs of 100 seconds they gathered enough counts to beat the inequality by more than 13 standard deviations.¹⁰10 Freire, European Physical Journal D, 2022. arxiv.org Then Aspect, Jean Dalibard and Roger placed an optical switch 6 metres from the source on each side: a small cell of water with a standing ultrasound wave in it. By driving the wave, the team sent each photon either straight on to one polariser or aside to a second, set at a different angle. They flipped the switches about every 10 nanoseconds; the trip from one switch to the other was 40 nanoseconds at the speed of light. Over runs of 12,000 seconds they found a violation by five standard deviations, close to the quantum prediction.¹¹11 Aspect, Dalibard and Roger, “Experimental Test of Bell’s Inequalities Using Time-Varying Analyzers”, Physical Review Letters 49, 1982. people.disim.univaq.it

Aspect drove the switches on a regular cycle, not at random, a weakness later experimenters removed. He defended his thesis at Orsay on 1 February 1983. After he presented the work at Caltech, Richard Feynman wrote to call the talk excellent.

4.4Teleportation

At the University of Innsbruck, the Austrian physicist Anton Zeilinger used entanglement as a tool as well as a thing to test. Charles Bennett, Gilles Brassard and four colleagues had proposed in 1993 a way to move a quantum state from one particle to another with the help of an entangled pair, and named it teleportation.¹²12 Wikipedia, “Quantum teleportation”, citing C. H. Bennett et al., Physical Review Letters 70, 1895, 1993. en.wikipedia.org Dik Bouwmeester, Jian-Wei Pan, Zeilinger and colleagues fired 200-femtosecond laser pulses into a crystal to make entangled photon pairs. They gave a separate photon a chosen polarisation, then measured it together with one photon of an entangled pair. When they got one particular result out of four, which they did in a quarter of cases, they found the far photon of the pair with the same polarisation as the first.¹³13 Bouwmeester et al., “Experimental quantum teleportation”, Nature 390, 1997. ar5iv.labs.arxiv.org The editors of Nature published the paper on 11 December 1997. Nobody sent anything faster than light: the experimenters at the receiving end needed a message about the joint measurement, sent by ordinary means, before they could use the state. In 1998 Zeilinger’s group entangled two photons that had never met. Later his teams used light from distant galaxies to choose their measurement settings.¹⁴14 Royal Swedish Academy of Sciences, “Popular information: The Nobel Prize in Physics 2022”. nobelprize.org

4.5Closing the loopholes

By 2015 critics had three main loopholes. If experimenters detected only a small share of the photons, critics could blame a biased sample. If they chose the settings too early or too slowly, critics could invoke a signal between the stations. If they chose them by a process that shared a past with the photon source, critics could suspect a link. Three groups closed the first two together in a single year and narrowed the third. No experimenter can close it completely, since a critic can always suppose some common cause, in the distant past, of the settings and the source.¹⁵15 Wikipedia, “Loopholes in Bell tests”, accessed 2026. en.wikipedia.org

Bas Hensen and colleagues at Delft University of Technology entangled two electrons in labs 1,280 metres apart. They held each electron in a nitrogen-vacancy centre: a flaw in a diamond crystal, made of a nitrogen atom beside a gap where a carbon atom is missing. They cooled each diamond to 4 kelvin. Over 220 hours they completed 245 trials and measured S = 2.42 ± 0.20, above the limit of 2. They put the chance of getting such a result from local hidden variables at 3.9 per cent, a thin margin, and posted the paper in August 2015.¹⁶16 Hensen et al., “Loophole-free Bell inequality violation using electron spins separated by 1.3 kilometres”, Nature 526, 2015. arxiv.org

Krister Shalm and colleagues at the National Institute of Standards and Technology in Boulder, Colorado, used photons and detectors made of superconducting nanowires.

The NIST experiment closed the three major loopholes as follows:

Fair sampling: Thanks to NIST’s single-photon detectors, the experiment was efficient enough to ensure that the detected photons and measurement results were representative of the actual totals. The detectors, made of superconducting nanowires, were 90 percent efficient, and total system efficiency was about 75 percent.

No faster-than-light communication: The two detectors measured photons from the same pair a few hundreds of nanoseconds apart, finishing more than 40 nanoseconds before any light-speed communication could take place between the detectors. Information traveling at the speed of light would require 617 nanoseconds to travel between the detectors.

Freedom of choice: Detector settings were chosen by random number generators operating outside the light cone (i.e., possible influence) of the photon source, and thus, were free from manipulation.

The NIST team placed its detectors in rooms 184 metres apart. In their best 30-minute run they recorded 6,378 coincidences and put the chance of getting such numbers from local hidden variables at about 1 in 170 million. When they mixed data from films, television shows and the digits of pi into their settings, they still found a violation.¹⁷17 NIST, “NIST Team Proves ‘Spooky Action at a Distance’ is Really Real”, 2015. nist.gov Marissa Giustina and colleagues in Vienna, Zeilinger among them, ran a similar test with a NIST-supplied detector and put the chance at no more than 3.74 × 10⁻³¹. The editors of Physical Review Letters printed both papers on 16 December 2015.¹⁸18 Giustina et al., “Significant-loophole-free test of Bell’s theorem with entangled photons”, arXiv, 2015. arxiv.org

On 4 October 2022 members of the Royal Swedish Academy of Sciences announced that Aspect, Clauser and Zeilinger would share the Nobel Prize in Physics “for experiments with entangled photons, establishing the violation of Bell inequalities” and for pioneering quantum information science. Freedman had died in 2012. Dmitry Budker, his colleague at Berkeley, said Freedman would certainly have shared the prize had he lived.¹⁹19 Sanders, Berkeley Research, 2022. vcresearch.berkeley.edu

Anders Irbäck, chair of the Nobel Committee for Physics, said that physicists could now see a new kind of quantum technology emerging from the laureates’ work. The testers had shown that entanglement was real. None of them had shown that anyone could use it to calculate. Physicists who later tried to compute with it started from an older question. In 1961 Rolf Landauer, a physicist at IBM, had asked how little heat a computer made of real matter must give off.

5.1The sorting demon

Rolf Landauer wanted to know how small and how frugal anyone could make a computer. He had come to the United States from Stuttgart as a boy in 1938 and joined IBM’s research staff in the early 1950s. Physicists had argued over a version of his question since 1871, when the Scottish physicist James Clerk Maxwell closed his textbook Theory of Heat with a puzzle. Knowing that in a gas some molecules are fast and some slow, he asked what would happen if a creature small and quick enough to see them took charge of a door between two chambers.¹1 Maxwell, Theory of Heat, Appleton edition, 1872, pp. 308–9. archive.org

But if we conceive a being whose faculties are so sharpened that he can follow every molecule in its course, such a being, whose attributes are still as essentially finite as our own, would be able to do what is at present impossible to us. For we have seen that the molecules in a vessel full of air at uniform temperature are moving with velocities by no means uniform, though the mean velocity of any great number of them, arbitrarily selected, is almost exactly uniform. Now let us suppose that such a vessel is divided into two portions, A and B, by a division in which there is a small hole, and that a being, who can see the individual molecules, opens and closes this hole, so as to allow only the swifter molecules to pass from A to B, and only the slower ones to pass from B to A. He will thus, without expenditure of work, raise the temperature of B and lower that of A, in contradiction to the second law of thermodynamics.

Later physicists named the creature Maxwell’s demon and had good reason to dislike it. By the second law of thermodynamics, as they stated it, nobody can make heat pass from a cold body to a hot one without doing work.

Leo Szilard, a Hungarian physicist teaching in Berlin, cut the puzzle down to one molecule. In a paper in Zeitschrift für Physik in 1929, he put a single molecule in a box and had the demon find out which half it was in. Once the demon knew, it could slide in a partition and use it as a piston to draw work from the surrounding heat. Szilard argued that the demon must pay for the knowledge: to learn which of two equal possibilities held, it had to raise the entropy of the world by at least k ln 2, where k is Boltzmann’s constant.²2 Owen Maroney, “Information Processing and Thermodynamic Entropy”, Stanford Encyclopedia of Philosophy, 2009. plato.stanford.edu Entropy here means a count, on a logarithmic scale, of the ways a system’s parts could be arranged. Szilard had tied a unit of information to a unit of entropy nearly twenty years before Shannon put the word “bit” into print.

5.2Machines on paper

Alan Turing’s machine existed only on paper. The young fellow of King’s College, Cambridge, sent “On Computable Numbers, with an Application to the Entscheidungsproblem” to the London Mathematical Society in May 1936. His machine had a tape divided into squares, a head that read and wrote one symbol at a time, and a short table of rules. Turing then described a single universal machine: a user who wrote another machine’s rules on its tape could get from it every result that the other machine would give.³3 Turing machine, Wikipedia. en.wikipedia.org In April 1936 Turing learned that Alonzo Church at Princeton had already answered the decision problem of Turing’s title by another route. Logicians generally judged Turing’s approach the more satisfying. That summer Turing proved the two approaches equivalent. In September he arrived at Princeton.⁴4 Andrew Hodges, “The Alan Turing Internet Scrapbook”. turing.org.uk

Claude Shannon, a mathematician at Bell Telephone Laboratories, published “A Mathematical Theory of Communication” in the Bell System Technical Journal in July and October 1948. He measured information in binary digits, or bits, a word he credited to his colleague John Tukey. He showed how far a sender could compress a message and how fast the sender could send it over a noisy line with as few errors as desired.⁵5 A Mathematical Theory of Communication, Wikipedia. en.wikipedia.org Neither Turing nor Shannon needed to say whether a bit was a hole in paper tape, a charge on a capacitor or a spot on a screen. They wrote mathematics that applied equally to all of them, with no charge for energy in it.

5.3A germanium slab

Shannon’s colleagues at Bell Labs were already changing the hardware. On 16 December 1947, John Bardeen and Walter Brattain, at the laboratories in Murray Hill, New Jersey, pressed two gold contacts, held close together by a plastic wedge, onto a small slab of pure germanium. By varying the voltage on one contact they controlled the current through the other and amplified a signal up to 100 times. William Shockley, who led their group, later described their demonstration to laboratory officials on 23 December as “a magnificent Christmas present”. Bell Labs managers announced the transistor at a press conference in New York on 30 June 1948.⁶6 Computer History Museum, “1947: Invention of the Point-Contact Transistor”, The Silicon Engine. computerhistory.org In 1956 Shockley, Bardeen and Brattain shared the Nobel Prize in Physics “for their researches on semiconductors and their discovery of the transistor effect”.

Over the next decade engineers began to build computers from transistors, smaller and cooler than the vacuum tubes in the UNIVAC 1103 that Seymour Cray had helped design.⁷7 NASA Glenn Research Center, “ERA 1103 UNIVAC 2 Calculating Machine”, photograph GRC-1955-C-39782, 1955. images.nasa.gov

Gordon Moore, director of research and development at Fairchild Semiconductor, plotted five data points from 1959 to 1964. In the magazine Electronics on 19 April 1965 he predicted that makers would fit 65,000 components on a single chip by 1975, doubling the count every year. In 1975 Moore, who had moved to Intel, slowed his forecast to a doubling every two years.⁸8 Computer History Museum, “1965: Moore’s Law Predicts the Future of Integrated Circuits”, The Silicon Engine. computerhistory.org Anyone who extended Moore’s line could see that within a few decades engineers would be building switches from a handful of atoms. At that size engineers would see electrons tunnel through barriers only a few atoms thick.

5.4The cost of forgetting

Landauer published his answer in the IBM Journal of Research and Development in July 1961. He separated two kinds of step. After some, anyone could work backwards from the output to the input; after others, nobody could. Once an engineer resets a bit to 1, whatever its earlier value, nobody can tell whether it was 0 or 1. Landauer argued that whoever performs such a “logically irreversible” step must release a small, fixed amount of heat into the surroundings. Under the laws of mechanics, nobody can design one frictionless push to carry both starting states to the same end state. He calculated the minimum heat per erased bit as kT ln 2, where T is the temperature.⁹9 Rolf Landauer, “Irreversibility and Heat Generation in the Computing Process”, IBM Journal of Research and Development 5, 1961. sites.pitt.edu He saw a purpose in that heat: engineers rely on it to bring every signal back to a clean 0 or 1, whatever its history.

Landauer himself wrote that the heat from any practical device would be many orders of magnitude larger. He cared about the kind of cost. Engineers could in principle cut every other loss, but whenever they erased a bit, they had to pay that minimum.

5.5Running backwards

Charles Bennett, a young physicist who joined IBM Research in 1972, took up Landauer’s question from the other side. He asked whether engineers who paid in energy only for erasure could build a computer that never erased. In “Logical Reversibility of Computation”, published in the IBM Journal in November 1973, he showed how. He had his reversible Turing machine compute while saving every intermediate result, copy the answer onto a separate tape, then run the first stage backwards until only the input and the answer remained. He compared RNA polymerase, the enzyme that copies DNA into messenger RNA, to a tape-copying Turing machine running close to reversibly.¹⁰10 Charles H. Bennett, “Logical Reversibility of Computation”, IBM Journal of Research and Development 17, 1973. cs.princeton.edu

In 1982 Bennett turned to Maxwell’s demon. Szilard and the French physicist Léon Brillouin had charged the demon for measuring the molecules; Bennett argued that a careful demon could measure for free and would pay later. To keep sorting, the demon must clear its memory of old measurements. By Landauer’s rule it gives off at least kT ln 2 of heat for every bit it clears, enough to save the second law.¹¹11 Charles H. Bennett, “The Thermodynamics of Computation: a Review”, International Journal of Theoretical Physics 21, 1982. doi.org

Not everyone accepted the argument. John Norton, a philosopher of physics at the University of Pittsburgh, has argued since the late 1990s that Landauer and his followers misused statistical mechanics and never properly derived the principle.¹²12 John D. Norton, “A Hot Mess”, Inference, 2019. inference-review.com Bennett replied in 2003 that the principle might be no more than a restatement of the second law but that physicists could still learn a great deal from it.¹³13 Charles H. Bennett, “Notes on Landauer’s Principle, Reversible Computation and Maxwell’s Demon”, arXiv, 2003. arxiv.org Antoine Bérut and colleagues in Lyon and Germany measured the cost in 2012. They held a single microscopic particle in a laser trap with two wells, erased its one-bit position again and again, and measured heat approaching Landauer’s limit in slow cycles. The editors of Nature printed their paper on 8 March 2012.¹⁴14 Bérut et al., “Experimental verification of Landauer’s principle linking information and thermodynamics”, Nature 483, 2012. pubmed.ncbi.nlm.nih.gov Landauer summed up his view in the title of a short article for Physics Today in May 1991: “Information is Physical”.¹⁵15 Rolf Landauer, “Information is Physical”, Physics Today 44, 1991. physicstoday.aip.org

By the late 1970s Bennett had shown how to compute without paying the heat that Landauer charged for erasure. The laws of quantum mechanics are reversible too. Paul Benioff, a scientist at Argonne National Laboratory near Chicago, read both men’s papers and wondered whether anyone could describe a computer in nothing but quantum mechanics.

6.1A chemist’s spare time

Computer scientists had taken it since Turing that an ordinary computer could carry out any reasonable calculation, including the physicists’ own. Few doubted that it could do so in reasonable time. Paul Benioff turned the question round in his spare time. By day he worked in chemistry and environmental science at Argonne National Laboratory, the federal research centre outside Chicago. He had joined it in 1961 with a degree in botany and a doctorate in nuclear chemistry.¹1 Argonne National Laboratory, “Remembering Paul Benioff, renowned scientist and quantum computing pioneer”, via EurekAlert!, 2022. eurekalert.org If physicists could describe everything with quantum mechanics, he reasoned, they must also be able to describe the computers that they used to work out its predictions.²2 Paul Benioff, “Quantum computing: early history”, talk at Argonne QC2016 workshop, 2016. phy.anl.gov

He met an obstacle that Landauer had made plain. Physicists who run the equations of quantum mechanics backwards get every system back where it started; engineers design ordinary computers to erase bits at nearly every step and pay for it in heat. Benioff found his way round the problem in Bennett’s reversible Turing machine, in which Bennett had kept a record of the machine’s history. He wrote down a Hamiltonian, the quantity from which physicists work out how a quantum system changes over time. He chose it to make the state of his quantum system, at each completed step, match the state of a Turing machine after that step.³3 Benioff, “The computer as a physical system”, Journal of Statistical Physics 22, 1980 (ADS abstract). ui.adsabs.harvard.edu The editors of the Journal of Statistical Physics printed the paper in May 1980.

Landauer objected. In Benioff’s telling, Landauer said that saving the history only “delays the inevitable”, since someone would have to erase the tapes in the end. Benioff took up erasure in a second paper, published in April 1982. Landauer also urged him to write another paper to make the idea of quantum computers better known. The editors of Physical Review Letters published it on 7 June 1982.⁴4 Benioff, QC2016 talk, 2016. phy.anl.gov Stephen Gray, a colleague at Argonne, recalled Benioff as a man who followed his own questions rather than whatever was fashionable.⁵5 Argonne National Laboratory, “Remembering Paul Benioff”, 2022. eurekalert.org Benioff had shown that physicists could describe computing entirely within quantum mechanics. He had not claimed that a quantum computer could do anything faster.

6.2Six variables

Erwin Schrödinger had met the difficulty that Benioff’s successors would put to use. In the second of his 1926 papers on wave mechanics, he worked out the vibrations and rotations of a molecule made of two atoms. He wrote its wave function in a space with one axis for each coordinate of each nucleus.

For the present I wished to give this case only as an example to show that, and in what way, the intuitive notion of the equilibrium configuration of the nuclear system keeps its meaning in wave mechanics too, in that the wave amplitude ψ differs appreciably from zero only in a small neighbourhood of the equilibrium configuration. The direct interpretation of this wave function, which depends on six variables, in three-dimensional space does, however, run at first into difficulties of a conceptual kind.

A physicist needs six variables for two particles and three hundred for a hundred. A classical physicist needs as many, but gives each a single value; a physicist using the wave function must give a number to every combination of values, and so needs far more numbers than variables. Physicists see the cost most simply in two-state systems, such as a spin that can be up or down. A physicist describes one such system with two numbers, called amplitudes: one for up and one for down. For two systems the physicist needs four: up-up, up-down, down-up, down-down. For ten, 1,024. With each added system, the physicist needs twice as many.

Engineers at Cray Research installed the first Cray-1 at Los Alamos in 1976. In 1977 its price was $7.9 million and its memory at most 1,048,576 words of 64 bits.⁶6 Cray-1, Wikipedia. en.wikipedia.org A programmer needed two such words for each amplitude, one for the real part and one for the imaginary part. On the fastest computer of the late 1970s, nobody could store the full state of more than 19 spins. Buyers of the Cray-1S, such as NASA’s Ames Research Center by 1981, could order up to four times as much memory, enough for 21.

Yuri Manin, a mathematician at the Steklov Institute in Moscow, made the point in print in 1980. In Computable and Uncomputable, written in Russian, he noted that anyone simulating many interacting particles on a classical computer faces an exponential cost. He expected quantum automata to show far richer behaviour than classical ones. John Preskill of Caltech later quoted him, in Victor Albert’s translation, as writing that “the quantum phase space is much bigger than classical”.⁷7 John Preskill, “Quantum computing 40 years later”, arXiv, 2021. arxiv.org By one account, readers outside the Soviet Union barely noticed Manin’s remark for years.⁸8 Quantum Zeitgeist, “The Manin Manifesto, the Hidden Soviet Roots of Quantum Computing”, 2026. quantumzeitgeist.com

6.3Endicott House

Charles Bennett, who had shown at IBM how to compute without erasing, took the group photograph at Endicott House, which is why he is not in it. Nearly 50 researchers, Freeman Dyson, Konrad Zuse and Benioff among them, had come to the manor that MIT kept as a conference centre in Dedham, outside Boston, from 6 to 8 May 1981. Edward Fredkin, a professor at MIT, had organised the meeting on the physics of computation with Landauer.⁹9 MIT Technology Review, “Tomorrow’s computer, yesterday”, 2021. technologyreview.com¹⁰10 Charles Bennett and Olivia Lanes, “Celebrating the 40-year anniversary of the Physics of Computation Conference”, IBM Research blog, 2021. research.ibm.com

Richard Feynman, the Caltech physicist and Nobel laureate, at first refused to give the keynote. He agreed when the organisers told him he could talk about anything he liked. He came without a written paper. Norman Margolus, a graduate student, recorded and transcribed the talk.

Feynman credited Fredkin with his interest in the subject, then set himself a rule: the number of parts in a simulating computer should be proportional to the volume of space and time under study, no more. He showed that a programmer who tracked every probability exactly would break the rule even for classical physics with chance in it. For N variables, that programmer needs a number of entries exponential in N. For classical systems Feynman had an answer: a computer with dice of its own, which a programmer sets to produce each outcome as often as experimenters would see it. For quantum systems he had none. With an argument about pairs of polarised photons, much like Bell’s, he showed that nobody could reproduce the quantum correlations with a local computer of that kind.¹¹11 Richard P. Feynman, “Simulating Physics with Computers”, International Journal of Theoretical Physics 21, 1982, pp. 472–476. cqi.inf.usi.ch Feynman told his audience that anyone who doubled the size of the piece of nature would need an exponentially larger computer.¹²12 Richard P. Feynman, “Simulating Physics with Computers”, International Journal of Theoretical Physics 21, 1982. link.springer.com

Then he proposed that physicists build the computer itself out of quantum mechanical elements. Feynman said such a device would not be a Turing machine. He guessed that with a lattice of simple two-state quantum systems a physicist could imitate any quantum system, including fields. He set the audience a problem: find a class of quantum systems that a physicist could use to imitate all the others, a universal quantum simulator. He thought the answer would be easy to find, though he had not found it. Seth Lloyd, a physicist in MIT’s mechanical engineering department, showed in Science in 1996 that Feynman had guessed right. A programmer could set a quantum computer to imitate any quantum system with only local interactions, between a few parts at a time. That programmer needed a number of steps proportional to the size of the system; a programmer with an ordinary computer needed exponentially many.¹³13 Seth Lloyd, “Universal Quantum Simulators”, Science 273, 1073, 23 August 1996. fab.cba.mit.edu Feynman said he had had wonderful, intense and interminable arguments with Fredkin, who hoped to describe physics as a classical computer program. Feynman argued that anyone pursuing that programme had to deal with quantum mechanics in full.

Anyone who wanted to simulate nature, he told the audience, had better make the simulation quantum mechanical. He said the problem was wonderful because it did not look easy. Preskill wrote in 2021 that physicists rightly remember the talk for launching quantum computing as a field of study.¹⁴14 Preskill, “Quantum computing 40 years later”, 2021. arxiv.org

6.4A universal quantum computer

Bennett asked Feynman whether physicists would find any limit on computing in quantum mechanics and the uncertainty principle. Feynman answered in a plenary talk at the CLEO/IQEC laser conference in 1984, printed in Optics News in February 1985. Physicists would find no such limit, he said, apart from the obvious one on size once engineers built the working parts from atoms. He described a quantum computer built from logic gates on two-state systems, with a “cursor” that he moved along a chain of sites to mark how far the calculation had gone.¹⁵15 Richard P. Feynman, “Quantum Mechanical Computers”, Foundations of Physics 16, 1986 (reprinted from Optics News, 1985). vql.cs.msu.ru

At Oxford, the young physicist David Deutsch restated the Church–Turing hypothesis as a law of physics. Computer scientists took the hypothesis to mean that anyone with a Turing machine can carry out any reasonable calculation. In Deutsch’s version, anyone with a universal computing machine, working by finite means, could perfectly simulate any physical system that could exist in finite form. Deutsch argued that the classical Turing machine is not compatible with his principle in its strong form, since classical physics is continuous and Turing’s machine is discrete. He then defined a universal quantum computer, a quantum Turing machine whose tape and head are quantum systems, and showed that it is compatible. The Royal Society’s editors printed the paper in 1985.¹⁶16 David Deutsch, “Quantum theory, the Church-Turing principle and the universal quantum computer”, Proceedings of the Royal Society A 400, 1985. daviddeutsch.org.uk

Deutsch went past simulation. A user of his machine, he showed, could exploit “quantum parallelism”: set the machine working on every input of a function at once, then combine the results by interference, letting some amplitudes cancel and others add. He also proved the limit. A user who measures the machine gets one answer, so nobody can use quantum parallelism to compute all the values faster. A user gains only on tasks that need one combined property of the answers. His example was a program that forecast the next day’s stock market from today’s but needed two days to run. Someone running a quantum version every day, he showed, would read a failure signal on about half the days and on the others would get in one day what had needed two.

Deutsch read the result as evidence for Hugh Everett’s many-worlds view of quantum mechanics. Few of his readers followed him that far, though many took up his definition. Nobody yet knew of a problem outside physics that someone with a quantum computer could solve much faster than someone with a classical one. Bennett had also found a use for single quanta that needed no computer. With Gilles Brassard he had taken up a friend’s idea for banknotes that no forger could copy.¹⁷17 Gilles Brassard, “Brief history of quantum cryptography: a personal perspective”, 2006. arxiv.org

7.1Money that cannot be forged

Stephen Wiesner, a physics graduate student at Columbia, often visited the communal house in Boston where his friend from Brandeis University, Charles Bennett, lived while at Harvard. On one visit, in the late 1960s or early 1970s, Wiesner described banknotes that no forger could copy without breaking the laws of physics.¹1 Gilles Brassard, “Brief history of quantum cryptography: a personal perspective”, 2006. arxiv.org Forgers and wiretappers had always assumed that whatever they could read, they could copy; Wiesner wanted to prove them wrong.

He proposed that a bank print a serial number on each note beside a row of particles, each prepared in a state that only the bank had recorded. A forger would have to measure the particles to copy them, and in measuring would disturb them, misread some, alter others and leave a note the bank could reject. Wiesner wrote the scheme up as “Conjugate Coding” and sent it to the IEEE Transactions on Information Theory. The editors turned it down; Brassard later guessed that they found a physicist’s prose incomprehensible. Wiesner left research, worked for Silicon Valley start-ups, became an Orthodox Jew and worked as a building labourer in Israel, where he died in August 2021.²2 Scott Aaronson, “Stephen Wiesner (1942–2021)”, Shtetl-Optimized, 2021. scottaaronson.blog

For about ten years Bennett described Wiesner’s idea to other researchers and found almost none who took an interest.

Gilles Brassard, a young computer scientist from Montreal, was swimming off the beach of a smart hotel in San Juan, Puerto Rico, in late October 1979. He was attending the 20th IEEE Symposium on Foundations of Computer Science. A stranger swam up and began to talk about Wiesner’s banknotes. Brassard told Quanta Magazine in 2026 that he felt trapped and listened politely.³3 Quanta Magazine, “Quantum Cryptography Pioneers Win Turing Award”, 2026. quantamagazine.org Within hours the two men had joined Wiesner’s physics to the public-key cryptography that computer scientists were then building.⁴4 Gilles Brassard, “Brief history of quantum cryptography: a personal perspective”, 2006. arxiv.org

With Seth Breidbart and Wiesner they presented their first joint paper, “Quantum cryptography, or Unforgeable subway tokens”, at Crypto ‘82 in Santa Barbara in August 1982, and so gave the field its name. The committees of major computer science conferences, STOC among them, turned down their second. In 1983 they worked out how two people could send single photons from one to the other and use them to agree a random key, a string of bits that both sides use to lock and unlock messages. Anyone who listened in would disturb the photons; the two users would detect the disturbance and throw the key away. They set this out in a one-page abstract for a symposium at St-Jovite, Quebec, in September 1983, and in full at a conference in Bangalore in December 1984. Later writers named the scheme BB84.

Three physicists showed in 1982 why an eavesdropper could not simply copy the photons. William Wootters and Wojciech Zurek were replying to Nick Herbert, who had proposed a device to signal faster than light with entangled photons. In a two-page proof in Nature, they showed that nobody can build a machine to copy an unknown quantum state exactly. Dennis Dieks gave a proof in Physics Letters A. James Park had published a version in 1970.⁵5 Wikipedia, “No-cloning theorem”. en.wikipedia.org Physicists call the result the no-cloning theorem: Eve cannot copy each photon, keep one and send the other on to Bob.

7.2Thirty-two centimetres

Few people took the scheme seriously, so Bennett and Brassard built a prototype with no special budget. John Smolin made the hardware at IBM; François Bessette and Louis Salvail wrote the software in Montreal. The team set up an optical bench about a metre long inside a light-tight box of roughly 1.5 by 0.5 by 0.5 metres. By one account, Bennett and Smolin bought black velvet from a fabric shop to keep out stray light.⁶6 Quanta Magazine, “Quantum Cryptography Pioneers Win Turing Award”, 2026. quantamagazine.org

The team flashed a green light-emitting diode for 60 billionths of a second at a time. They dimmed each flash to about a tenth of a photon on average. At that level Eve would rarely find two photons in one pulse to split between herself and Bob. They set Alice’s choice with two Pockels cells, crystals in which they could turn the polarisation of light by applying about 800 volts. They sent the photons across 32.5 centimetres of air to Bob’s own Pockels cell, a calcite prism and two photomultiplier tubes. They drew their random choices from a diskette of bits that they had generated by counting a photomultiplier’s random clicks. They measured an error rate of about 4 per cent. Instead of throwing the key away, they found and removed the errors by comparing the parities of blocks of bits over the public line. Then they shortened the key by hashing until Eve could know almost nothing of what was left. Cryptographers call the last step privacy amplification. The team conceded that the prototype had no practical use, since no one needed secret keys over such a distance.⁷7 Bennett, Bessette, Brassard, Salvail and Smolin, “Experimental Quantum Cryptography”, Journal of Cryptology 5, 1992. eclass-b.uoa.gr

They made it work in late October 1989, ten years to the day after the swim in San Juan, by Brassard’s account. They set the power supply for the Pockels cells, the largest part of the prototype, to a different voltage for each polarisation and could hear a different noise for each. They could tell zeros from ones by ear; Brassard joked that the system was secure against any eavesdropper who happened to be deaf. The Association for Computing Machinery announced in March 2026 that Bennett and Brassard would receive its A.M. Turing Award, worth $1 million, for their part in founding quantum information science.⁸8 Quanta Magazine, “Quantum Cryptography Pioneers Win Turing Award”, 2026. quantamagazine.org

7.3Entangled pairs and real fibre

At Oxford, a graduate student named Artur Ekert came to key distribution from physics. In Physical Review Letters on 5 August 1991 he proposed that Alice and Bob each receive one photon of an entangled pair, the pairs Einstein had distrusted and John Bell had turned into a test. If the users found Bell’s inequality violated by the expected margin, they could be sure no eavesdropper had tampered with the pairs. Because Ekert published in a physics journal, physicists began to read about quantum cryptography, by Brassard’s account.⁹9 Brassard, “Brief history of quantum cryptography”, 2006. arxiv.org¹⁰10 Wikipedia, “Artur Ekert”. en.wikipedia.org

Nobody had yet proved BB84 secure against every attack that physics allows. Building on a proof by Hoi-Kwong Lo and H. F. Chau, Peter Shor and John Preskill published a short one in 2000, using the quantum error-correcting codes of the mid-1990s. Like the authors of every such proof, they assumed equipment that behaved exactly as the theory described.¹¹11 Peter W. Shor and John Preskill, “Simple Proof of Security of the BB84 Quantum Key Distribution Protocol”, arXiv:quant-ph/0003004, 2000. arxiv.org

Antoine Muller, Hugo Zbinden and Nicolas Gisin in Geneva sent keys through 23 kilometres of telecom fibre already laid under Lake Geneva with weak laser pulses averaging 0.12 photons each. They kept the error rate below 3.4 per cent and submitted their paper in September 1995.¹²12 Muller, Zbinden and Gisin, “Quantum cryptography over 23 km in installed under-lake telecom fibre”, Europhysics Letters 33, 1996. epljournal.edpsciences.org

Joshua Bienfang and Alan Mink, at the National Institute of Standards and Technology in Gaithersburg, Maryland, sent photons through the air to a telescope in a building 730 metres away. On 3 May 2004 they reported keys at a million bits a second, about 100 times faster than earlier systems of the kind.¹³13 NIST, “NIST System Sets Speed Record For Generation of Quantum Keys for ‘Unbreakable’ Encryption”, 2004. nist.gov Three years later Xiao Tang, Mink and colleagues converted telecom photons to a shorter wavelength suited to low-noise silicon detectors. They sent keys at more than half a million bits a second through 10 kilometres of fibre.

7.4A satellite named Micius

Jian-Wei Pan put half of his start-up money, which totalled 2.4 million yuan or about $290,000, into satellite quantum communication. He had helped teleport a photon’s polarisation in 1997 as Anton Zeilinger’s student at Innsbruck, and arrived at the University of Science and Technology of China in 2001. People thought the idea crazy, he later recalled. He lobbied for about a decade to fund the $100 million project. His team took five years to build the satellite. Chinese engineers launched it, Micius, from Jiuquan on 16 August 2016 into an orbit about 500 kilometres up.¹⁴14 Physics Today, “Quantum entanglement reaches new heights”, 2017. physicstoday.aip.org¹⁵15 Liao et al., “Satellite-relayed intercontinental quantum network”, 2018. arxiv.org

Pan’s team aimed lasers from the satellite at telescopes in Delingha in Qinghai and near Lijiang in Yunnan, 1,203 kilometres apart. They used passes around 1.30 in the morning, when both sites could see it for about four and a half minutes. With the source on Micius they made almost six million entangled pairs a second and caught about one pair a second at both stations. They reported in Science in June 2017 that they still found Bell’s inequality violated.¹⁶16 EurekAlert!/Science, “Satellite-based entanglement distribution over 1200 kilometers”, 2017. eurekalert.org

On 29 September 2017 members of the Chinese Academy of Sciences in Beijing and the Austrian Academy of Sciences in Vienna held a 75-minute video call. Pan’s team and Zeilinger’s had used Micius to share keys with stations at Xinglong and Graz, some 7,600 kilometres apart. The engineers used about 70 kilobytes of quantum key to refresh an ordinary 128-bit AES cipher every second across the 2 gigabytes of the call. The team had stored both keys on the satellite, so users had to trust it.¹⁷17 Liao et al., “Satellite-relayed intercontinental quantum network”, Physical Review Letters 120, 2018. arxiv.org

7.5The sceptics at the NSA

With a bright light and parts anyone could buy, Lars Lydersen, Vadim Makarov and four colleagues attacked the hardware. They shone tailored bright light into the single-photon detectors of two commercial systems, blinded them and then steered them at will; they could take the whole key and leave no trace. They reported in 2010 that they expected most systems built with avalanche photodiodes to share the weakness, and offered the work as a way to make future systems safer.¹⁸18 Lydersen et al., “Hacking commercial quantum cryptography systems by tailored bright illumination”, Nature Photonics 4, 2010. arxiv.org

Cryptographers at the US National Security Agency listed five problems on the agency’s website. Users still needed another way to prove who was sending. They had to lease dedicated fibre and could not patch hardware in software. Anyone using trusted relays had to pay for secure buildings and risk a dishonest insider. Engineers could not build hardware as perfect as the theorists assumed. An attacker could jam the link by disturbing it. They preferred new mathematical ciphers designed to resist quantum computers. On 1 October 2026 the agency’s cryptographers restated all five problems and added that changes in conditions and wear on the hardware could weaken a system after certification.¹⁹19 National Security Agency, “Quantum Cryptographic Solutions are Limited Compared to Post-Quantum Algorithms”, 1 October 2026. nsa.gov

The actual security provided by a QKD system is not the theoretical unconditional security from the laws of physics (as modeled and often suggested), but rather the more limited security that can be achieved by hardware and engineering designs. … In summary, NSA views quantum-resistant (or post-quantum) cryptography as a more cost effective and easily maintained solution than quantum key distribution. For all of these reasons, NSA does not support the usage of QKD or QC to protect communications in National Security Systems, and does not anticipate certifying or approving any QKD or QC security products for usage by NSS customers unless these limitations are overcome.

Researchers at the company Terra Quantum answered in 2023 that most of these objections were true of classical systems too, and that engineers had run fibre links without trusted relays over about 1,000 kilometres.²⁰20 Sych et al., “Applicability of QKD: TerraQuantum view on the NSA’s scepticism”, 2023. arxiv.org Nobody had yet solved the engineering problems the NSA’s cryptographers named.

When Bennett’s team sent its first key in 1989, nobody had shown that a quantum computer could break any cipher in use. Feynman and Deutsch had described machines good for simulating physics and little else. Peter Shor, a mathematician at Bell Labs in New Jersey, began reading their papers in the company library late in 1992.²¹21 Physics Today, “Peter Shor on the genesis of Shor’s algorithm”, 2025. physicstoday.aip.org

8.1Contrived problems

Peter Shor looked up the papers on quantum computers in the Bell Labs library and found three authors: Feynman, Deutsch, and Deutsch with Richard Jozsa. “There were not that many,” he recalled.¹1 Physics Today, “Peter Shor on the genesis of Shor’s algorithm”, 2025. physicstoday.aip.org He had studied mathematics at Caltech and MIT before joining AT&T Bell Laboratories in New Jersey. Feynman had wanted a quantum computer to simulate physics; nobody had shown that anyone could use one for anything else that mattered.

David Deutsch at Oxford had defined a universal quantum computer in 1985. Its user would store information in units that Benjamin Schumacher, a physicist at Kenyon College, later named qubits. Each qubit is a two-state system that, like a spinning electron, can be in a superposition of 0 and 1, with an amplitude for each, until someone measures it and finds one or the other.²2 Wikipedia, “Qubit”, citing B. Schumacher, “Quantum coding”, Physical Review A 51, 2738, 1995. en.wikipedia.org Deutsch and Jozsa found a task in 1992 on which a quantum user would plainly beat anyone with an ordinary computer. They considered a user handed a black box. The user feeds in a string of n bits, reads off 0 or 1, and has been promised that the answer is either the same for every input or 0 for exactly half of them. A programmer who wants certainty on an ordinary computer may have to try just over half of all inputs. Deutsch and Jozsa showed that a quantum user needed to ask only once or twice, whatever the size of n.³3 Deutsch and Jozsa, “Rapid Solution of Problems by Quantum Computation”, Proceedings of the Royal Society A 439, 1992. ui.adsabs.harvard.edu Nobody needed the answer; a programmer willing to accept small odds of error could get it with a few random tries.

Umesh Vazirani of the University of California, Berkeley, came to Bell Labs in 1992 to speak about “Quantum complexity theory”, which he and Ethan Bernstein presented at the STOC conference in San Diego in May 1993. Shor had taken more physics in college than most computer scientists. He followed the talk better than most of his colleagues, though he later judged their example problem contrived.⁴4 Peter W. Shor, “The Early Days of Quantum Computation”, 2022. arxiv.org

By the account Shor heard, Daniel Simon, a computer scientist, had set out to prove quantum computers no stronger than ordinary ones and found the opposite. He considered a black box with a secret string s built in, such that the user reads the same output for two inputs exactly when they differ by s. Simon showed that a quantum user could find s with a number of questions in proportion to its length; an ordinary user needed exponentially many. Shor sat on the programme committee for STOC 1994 and argued for Simon’s paper. The other members rejected it.⁵5 Peter W. Shor, “The Early Days of Quantum Computation”, 2022. arxiv.org

8.2Forty quadrillion years

Ronald Rivest and Adi Shamir proposed schemes; Leonard Adleman broke them. The three young computer scientists and mathematicians at MIT kept at it through 1976 and into 1977, looking for a cipher that anyone could lock and only one person could open. After a Passover evening of wine at a student’s house in April 1977, Rivest could not sleep. By morning he had the idea and much of a paper.⁶6 Wikipedia, “RSA cryptosystem”. en.wikipedia.org

Anyone with a computer can multiply two 100-digit prime numbers, numbers with no divisors except 1 and themselves, in a moment. No one knew a quick way to find the two primes again from the product. An RSA user publishes the product of two secret primes; anyone can use it to scramble a message, but only someone who knows the primes can unscramble it. Martin Gardner described the scheme in Scientific American in August 1977. The inventors offered $100 to whoever could read a message they had locked with a 129-digit number. Rivest estimated that anyone factoring a number of about that size with the methods of the day would need some 40 quadrillion years.⁷7 Derek Atkins, Michael Graff, Arjen K. Lenstra and Paul C. Leyland, “The Magic Words are Squeamish Ossifrage”, 1994. people.math.wisc.edu By the 1990s banks, software makers and governments used RSA and the related Diffie–Hellman method to secure their connections.

Arjen Lenstra of Bellcore, with Derek Atkins, Michael Graff and Paul Leyland, recruited about 600 volunteers in more than 20 countries. The volunteers ran a newer method, the quadratic sieve, on more than 1,600 of their own computers for about eight months. Lenstra finished with 45 hours on a MasPar parallel computer.⁸8 Atkins, Graff, Lenstra and Leyland, announcement of the RSA-129 factorisation, Cypherpunks mailing list, April 1994. cypherpunks.venona.com At the end of April 1994 they announced the two factors, of 64 and 65 digits, and the message: “The magic words are squeamish ossifrage.” They gave the $100 to the Free Software Foundation.⁹9 Derek Atkins, Michael Graff, Arjen K. Lenstra and Paul C. Leyland, “The Magic Words are Squeamish Ossifrage”, 1994. people.math.wisc.edu The volunteers had not broken RSA. Users could pick bigger numbers; with every known method, an attacker needed much more work for each extra digit. That same month, at Bell Labs in New Jersey, Shor worked out how an attacker with a quantum computer could avoid most of that extra work.

8.3Finding the period

Shor saw what Simon had done. Simon had found a repeating pattern, a period, with a Fourier transform, the tool engineers use to split a signal into regular waves. Shor knew that mathematicians could reduce two problems on which designers of public-key ciphers relied, factoring and the discrete logarithm, to finding a period. He worked on the discrete logarithm first, told no one, and solved it in April 1994. Jeff Lagarias, a colleague, found a small error, which Shor fixed. His manager, David Johnson, suggested he present it at Henry Landau’s Tuesday seminar, whose audience interrupted so freely that one speaker had once never got past his second slide.¹⁰10 Peter W. Shor, “The Early Days of Quantum Computation”, 2022. arxiv.org

Shor got through the talk and later that week adapted the method to factoring. At home that weekend with a bad cold, he took a telephone call from Vazirani. Somewhere in the retelling, people had turned a talk about discrete logarithms into a claim about factoring; Shor had solved factoring in the meantime, so he could explain it.

Shor built the method on an old fact about remainders. To factor a number N, a mathematician picks a smaller number, a, that shares no factor with it, writes out the powers of a and keeps only the remainder after dividing each by N. Sooner or later the mathematician reaches a remainder of 1 and sees the list begin again; mathematicians call the length of the cycle the period, r. G. L. Miller had shown in 1976 that anyone who can find periods quickly can factor quickly. In his full paper Shor proved that a mathematician who picks a at random gets a factor at least half the time.¹¹11 Peter W. Shor, “Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer”, SIAM Journal on Computing, 1997. arxiv.org

For a number of 600 digits the cycle can be so long that no one with an ordinary computer could list enough powers to see it repeat. Shor proposed that a programmer use a quantum computer to work out the powers of a for an enormous range of exponents in a single run. The programmer would hold them in superposition, a single combined state of the machine’s qubits with an amplitude for every exponent. Next the programmer would apply a quantum Fourier transform, arranging the interference to cancel the amplitudes of wrong answers and reinforce those related to the period. On measuring the qubits, the programmer would get, with good odds, a number from which to work out r. Shor showed that a programmer would need a number of steps roughly in proportion to the cube of the number of digits. Programmers using the best classical method, the number field sieve, needed a number of steps that grew faster than any power of the number of digits, though more slowly than exponentially.¹²12 Wikipedia, “Integer factorization”, accessed 2026. en.wikipedia.org

8.4How the news travelled

At a Columbia University theory day later in April, Shor took Charles Bennett of IBM and John Smolin, who together had sent the first quantum key in 1989, through the algorithm. The organisers of a number theory symposium at Cornell gave him about a week’s notice to talk in early May. Vazirani presented the algorithm on his behalf at a Santa Fe Institute meeting in mid-May. That summer Artur Ekert, the Oxford physicist who had proposed entangled keys, carried it to an atomic physics conference in Boulder, where many experimenters first heard of it. Shor presented the paper at the Symposium on Foundations of Computer Science (FOCS) in Santa Fe, held 20 to 22 November 1994; Simon’s paper was in the same proceedings.¹³13 Peter W. Shor, “The Early Days of Quantum Computation”, 2022. arxiv.org

Alexei Kitaev, a physicist at the Landau Institute in Moscow, could not get the paper; he worked out his own method, now called phase estimation, and posted it in November 1995. Shor later reflected that he had challenged a working belief of computer science, that any reasonable computer could simulate any other without an exponential slowdown. Nobody had proved that ordinary computers could not factor quickly, so computer scientists took his result as strong evidence against the belief, not a proof.¹⁴14 Wikipedia, “Church–Turing thesis”, section on the complexity-theoretic thesis, accessed 2026. en.wikipedia.org

8.5Searching a directory

At Bell Labs two years later, the electrical engineer Lov Grover took as his example a telephone directory with N names in random order. To find the name for a given number, a programmer with an ordinary computer has to check entries one by one, about N/2 of them on average. Grover showed that a quantum user could find it in about the square root of N steps: for a million entries, about a thousand instead of half a million. He presented the paper at STOC in May 1996 and posted it on arXiv on 29 May.¹⁵15 Lov K. Grover, “A fast quantum mechanical algorithm for database search”, 1996. arxiv.org Grover counted the questions a programmer puts to a black box built to recognise the answer. A programmer who first had to load a real directory into the machine could spend longer on that than on an ordinary search.¹⁶16 Wikipedia, “Grover’s algorithm”, accessed 2026. en.wikipedia.org

Programmers could apply Grover’s smaller speed-up to any problem in which they can check a proposed answer. Charles Bennett, Ethan Bernstein, Gilles Brassard and Umesh Vazirani proved that no quantum user could search a black box much faster than with Grover’s method.¹⁷17 Charles H. Bennett, Ethan Bernstein, Gilles Brassard and Umesh Vazirani, “Strengths and Weaknesses of Quantum Computing”, SIAM Journal on Computing 26, 1997. arxiv.org Nobody would crack the hardest search problems by brute force on a quantum computer. An attacker using Grover’s method could search a space of 2^128 keys in about 2^64 steps; defenders could restore the margin by doubling key lengths. Against an attacker running Shor’s algorithm, users of RSA, Diffie–Hellman and elliptic curves had no such remedy. Analysts at the National Institute of Standards and Technology set out the consequences in April 2016, when no one had yet factored more than tiny numbers on a quantum computer.

In 1994, Peter Shor of Bell Laboratories showed that quantum computers, a new technology leveraging the physical properties of matter and energy to perform calculations, can efficiently solve each of these problems, thereby rendering all public key cryptosystems based on such assumptions impotent. Thus a sufficiently powerful quantum computer will put many forms of modern communication—from key exchange to encryption to digital authentication—in peril.

Shor received the Nevanlinna Prize in 1998 and, for the factoring algorithm, the Gödel Prize in 1999.¹⁸18 MacTutor History of Mathematics, “Peter W Shor Prizes and Awards”. mathshistory.st-andrews.ac.uk In 1994 he still faced an objection to the machine itself. Rolf Landauer of IBM, who had shown that erasing a bit must give off heat, raised it at the Santa Fe meeting that May. Nobody, he said, knew how to correct errors in a quantum computer. Without correction, a programmer who runs a calculation of N steps needs every step accurate to about one part in N. Factoring a number big enough to matter would take something like a billion steps. Experimental physicists thought one-in-a-billion accuracy absurd. Shor took the objection as his next problem.¹⁹19 Peter W. Shor, “The Early Days of Quantum Computation”, 2022. arxiv.org

9.1The case against

A few weeks after Landauer’s warning at Santa Fe, William Unruh, a theorist at the University of British Columbia in Vancouver, put numbers on the problem. No experimenter can perfectly shield a qubit from stray light, vibration and jiggling atoms; physicists call the resulting loss of a superposition decoherence. In a paper he posted on 9 June 1994, Unruh calculated what a programmer running Shor’s algorithm would need to keep its many superposed states in step. Engineers would have to make the coupling between qubits and their surroundings very weak, and their calculations very short.¹1 W. G. Unruh, “Maintaining coherence in quantum computers”, Physical Review A 51, 1995. arxiv.org Landauer made his own case in print in December 1995. He expected the build-up of small errors to wreck any long calculation.²2 Rolf Landauer, “Is quantum mechanics useful?”, Philosophical Transactions of the Royal Society A 353, 1995. doi.org

In Paris, Serge Haroche and Jean-Michel Raimond trapped single photons between mirrors at the École Normale Supérieure and watched them decohere. They made the sharpest case in Physics Today in August 1996. They compared T, the lifetime of a qubit’s superposition, with t, the time an experimenter needs to run one gate. To factor a 400-bit number, they reckoned, an experimenter would need a ratio T/t of about 4 × 10^11. With gates as slow as those in David Wineland’s ion trap at NIST in Boulder, a tenth of a millisecond, the experimenter would need qubits that lived a year. They argued that an experimenter cannot shorten t without also shortening T. An experimenter who turns up the laser to run a gate faster also kicks the atom more often into short-lived states. They expected anyone running error-correcting schemes to add errors of their own to experiments that were already very hard.³3 Serge Haroche and Jean-Michel Raimond, “Quantum computing: dream or nightmare?”, Physics Today 49(8), 1996. aip.brightspotcdn.com

Wineland and Christopher Monroe, a physicist in his group, replied in the November issue that the doubts were technical rather than fundamental. Haroche and Raimond answered that they expected the odds of decoherence to grow exponentially with the size of the machine. Experimenters would settle the friendly dispute in time, they added, though perhaps not for a decade.⁴4 Monroe and Wineland; Haroche and Raimond, “Future of quantum computing proves to be debatable”, Physics Today 49(11), 1996. aip.brightspotcdn.com

9.2Nine qubits

Shor had taken up Landauer’s objection more than a year before the Paris physicists wrote. Engineers had long built reliable machines from unreliable parts. They saved the state and restarted, added check bits as Richard Hamming had done at Bell Labs in 1950, or kept many copies of every bit and took a vote. Many physicists believed that no one could use these tricks on qubits. Wootters, Zurek and Dieks had proved in 1982 that no one can copy an unknown quantum state; nor can anyone look at a qubit to see whether it has gone wrong without collapsing its superposition.⁵5 Peter W. Shor, “The Early Days of Quantum Computation”, 2022. arxiv.org

Shor found a way round both rules. He started from the simplest code, three copies and a majority vote, and spread one qubit across three: 0 became 000 and 1 became 111. He copied nothing. He turned a superposition of 0 and 1 into a single entangled superposition of 000 and 111. With that code a physicist can catch a bit flip, a qubit turned from 0 to 1. A physicist must also catch phase flips, changes of sign between the two parts of a superposition, which have no counterpart in an ordinary computer. Shor found that anyone using the three-qubit code made them three times as likely. With one simple operation, now called the Hadamard transform, he could turn bit flips into phase flips and back. He nested three bit-flip codes inside a phase-flip code and arrived at nine qubits in three groups of three. He could correct any error on any one of the nine.⁶6 Peter W. Shor, “Scheme for reducing decoherence in quantum computer memory”, Physical Review A 52, 1995. link.aps.org

9.3Seven qubits and a family of codes

Andrew Steane, a physicist at the Clarendon Laboratory in Oxford, started from Hamming’s seven-bit code, in which an engineer can correct any single bit flip among seven. He showed that a physicist who chose the right superposition of its codewords could correct phase flips too, protecting one qubit with seven. Shor’s paper had reached Physical Review A’s editors on 17 May 1995. Steane sent his to Physical Review Letters on 4 October 1995; the editors published it on 29 July 1996.⁷7 A. M. Steane, “Error Correcting Codes in Quantum Theory”, Physical Review Letters 77, 793, 1996. users.physics.ox.ac.uk In it Steane warned that experimenters would find it hard to make the entangled states the code needed.⁸8 David Lindley, “Quantum Milestones, 1995: Correcting Quantum Computer Errors”, Physics 18, 59, 2025. physics.aps.org

Shor and Rob Calderbank, a coding theorist, showed how to build a quantum code from any pair of ordinary codes with the right relationship between them. They posted the result on 30 December 1995. Steane reached the same construction independently; physicists call the family CSS codes, after Calderbank, Shor and Steane. Teams at Los Alamos and IBM searched by computer for smaller codes and found codes of five qubits. Charles Bennett, who had sent the first quantum key, posted one in April 1996 with David DiVincenzo, John Smolin and William Wootters of the no-cloning proof.⁹9 Bennett, DiVincenzo, Smolin and Wootters, “Mixed State Entanglement and Quantum Error Correction”, 1996. arxiv.org Shor and Neil Sloane, puzzling over the five-qubit code with the algebra program MAGMA, found that its symmetry group had 5,160,960 elements, which Sloane recognised from his own research. From that link Calderbank, Eric Rains, Shor and Sloane, and separately Daniel Gottesman, developed the general theory of stabiliser codes.¹⁰10 Peter W. Shor, “The Early Days of Quantum Computation”, 2022. arxiv.org

9.4The threshold

Builders who need perfect gates to run a code gain nothing, because they make new errors with the gates they use to check for old ones. Shor next showed how to compute on encoded qubits without decoding them. He ran most gates on each qubit of a block separately and so confined the damage from any single fault to one qubit per block. He proved that a builder could run more steps as the error rate fell, but did not get the result he wanted, a fixed threshold.

Two groups found the threshold within a year by nesting codes inside codes: they encoded each qubit in seven, then each of those seven in seven more, and so on. John Preskill, a theorist at Caltech, showed why the trick helps with a simple count in a review he posted in December 1997. He counted a block of seven as lost only if two of its parts had errors. If the chance of an error in each part is p, the chance of losing the block is roughly 21p². When p is less than 1/21, the block is more reliable than its parts. With a second layer the builder squares the gain again; with a third, once more. Below that crossover a builder who adds layers drives the error rate down very fast, at a cost of seven times as many qubits per layer. Above it, the builder makes matters worse with every layer. Physicists call it the accuracy threshold. Preskill estimated that once theorists had counted every source of error, they would find real thresholds above about one error in 10,000 operations.¹¹11 John Preskill, “Fault-tolerant quantum computation”, 1997. arxiv.org

Dorit Aharonov and Michael Ben-Or at the Hebrew University in Jerusalem posted their proof on 14 November 1996, with a threshold of about one error in a million.¹²12 Aharonov and Ben-Or, “Fault-tolerant quantum computation with constant error”, 1996. arxiv.org Emanuel Knill, Raymond Laflamme and Wojciech Zurek at Los Alamos National Laboratory posted theirs on 26 February 1997. They stated plainly that physicists could make quantum computations as accurate as they wished if they kept the error per operation below a threshold.¹³13 Knill, Laflamme and Zurek, “Resilient quantum computation: error models and thresholds”, Proceedings of the Royal Society A 454, 1998. arxiv.org

Alexei Kitaev, a theorist at the Landau Institute in Moscow, took a different route. In a paper he posted on 9 July 1997 he laid qubits on the edges of a square grid and joined its opposite edges, making a torus, the shape of a ring doughnut. He stored information in patterns that run all the way round it. A physicist checks only small local groups of four qubits and loses the stored information only if errors line up in a long chain across much of the surface. A builder who enlarges the grid makes the data safer. Kitaev, Preskill and colleagues later analysed these surface codes in detail; Google’s engineers ran one on their Willow chip in 2024.¹⁴14 A. Yu. Kitaev, “Fault-tolerant quantum computation by anyons”, Annals of Physics 303, 2003. arxiv.org Kitaev and the other provers assumed that errors in different parts of the machine were unrelated, or nearly so. In 2005 Aharonov, Kitaev and Preskill extended the threshold theorem to errors correlated over long distances, provided the correlations were weak enough and became weaker fast enough with distance.¹⁵15 Dorit Aharonov, Alexei Kitaev and John Preskill, “Fault-tolerant quantum computation with long-range correlated noise”, Physical Review Letters 96, 050504, 2006. arxiv.org

9.5The builders’ list

Wineland, Monroe and four colleagues at NIST’s Boulder laboratory surveyed every source of error they could find in trapped-ion qubits in the May–June 1998 issue of NIST’s journal. If they could bring errors per operation down to between one in 100,000 and one in a million, they wrote, they hoped to use fault-tolerant schemes. Then speed would matter, because anyone running those schemes would need many more qubits and operations.

The theorists had answered the claim that noise made a large machine impossible; they had not answered Haroche and Raimond’s practical objection, that nobody knew how to build qubits good enough. They had given builders a target short of perfection: qubits better than a fixed standard, and enough of them to pay for the overhead. NIST’s cryptographers wrote in 2016 that many leading experts had once thought quantum states too fragile for large machines. Those experts changed their minds in the late 1990s, the authors added, after theorists found error-correcting codes and proved the threshold theorems.¹⁶16 Lily Chen et al., Report on Post-Quantum Cryptography, NISTIR 8105, NIST, 2016. nvlpubs.nist.gov David Cory’s group at MIT reported the first experimental demonstration of quantum error correction in 1998, with a three-qubit code for phase errors run on nuclear spins in a liquid.¹⁷17 D. G. Cory et al., “Experimental Quantum Error Correction”, Physical Review Letters 81, 2152, 1998; see also David Lindley, Physics 18, 59, 2025. arxiv.org

On 25 February 2000 David DiVincenzo of IBM turned the requirements into a list. A builder would need a scalable physical system of well-defined qubits and a way to set them all to a known starting state. The builder would also need decoherence times much longer than the time a gate takes, a universal set of gates, and the ability to measure each qubit. He added two more items for sending quantum information from place to place. He put the random error a builder could tolerate at about one in 10,000 to one in 100,000 per gate. He wrote that no one could yet see how, or whether, anyone could meet all the requirements, and that it would be some time before anyone could even test error correction.¹⁸18 David P. DiVincenzo, “The Physical Implementation of Quantum Computation”, Fortschritte der Physik 48, 2000. arxiv.org Nobody had yet built a single reliable qubit and gate. The ion trappers in Boulder had been trying since the summer of 1994, when Artur Ekert brought Shor’s algorithm to a conference in their city and asked how anyone could build a machine to run it.

10.1A question in Boulder

Artur Ekert, the Oxford physicist of the entangled keys, told a room of laser and atom specialists in Boulder, Colorado, about Shor’s factoring algorithm in the summer of 1994. Then he asked how anyone could build a machine to run it.¹1 J. Ignacio Cirac, “Thirty Years of Ion-Trap Computing Too”, APS March Meeting abstract, 2024. meetings-archive.aps.org That August Charles Clark, a physicist at NIST, gathered mathematicians, computer scientists and experimenters in Gaithersburg, Maryland, to discuss that question.²2 NIST, “NIST Jump-Starts Quantum Information”, 2018. nist.gov Nobody had yet built a quantum logic gate from real matter. Many physicists doubted that anyone could; Haroche and Raimond would soon argue in print that nobody could keep such qubits coherent long enough for a useful calculation.

Ignacio Cirac, a theorist at the University of Castilla-La Mancha in Spain, and Peter Zoller, a theorist at JILA in Boulder who moved to Innsbruck at the end of 1994, sat in Ekert’s audience. About three months later they came back with a design that ion trappers could build with tools they already owned.³3 IQOQI Innsbruck, “25 years ago: the beginning of the quantum computer era”, 2020. iqoqi.at

An ion is an atom with an electron missing. Ion trappers held them in a vacuum with electric fields, cooled them with lasers until they barely moved and read them by the light they scattered. With a laser pulse of the right length, an experimenter puts an ion into a superposition of two internal energy states, labelled 0 and 1. Cirac and Zoller solved the hard part, making two ions interact. Because ions are all positively charged, an experimenter who nudges one in a row sets the whole row moving; Cirac and Zoller proposed using that shared motion as a bus. The experimenter would fire one laser pulse at the first ion to copy its state into the motion, then a second at the second ion to reverse the sign of part of its state only if the row was moving. With a third pulse at the first ion, the experimenter would copy the motion back.⁴4 Qubytes, “The first trapped-ion quantum computer proposal”, 2021. qubytes.org With two further pulses on the second ion, one before and one after, an experimenter turns that conditional sign change into a controlled-NOT gate. In a controlled-NOT gate the experimenter flips the second qubit, the target, only when the first, the control, is set to 1. With it and single-qubit rotations, a programmer can build any quantum circuit. Cirac and Zoller published the scheme in May 1995.

10.2One ion, two qubits

Wineland ran the Ion Storage Group at NIST in Boulder, whose official job was better atomic clocks. To build them, Wineland, Jim Bergquist, Wayne Itano and colleagues had learned to trap a single magnesium ion (1981) and to watch mercury ions make single quantum jumps (1986). They had also learned to cool an ion to the lowest energy of motion that quantum mechanics allows.⁵5 NIST, “The Nobel Moments: Dave Wineland”, 2018. nist.gov Wineland and Chris Monroe, a young physicist on his staff, recognised their own laboratory in Cirac and Zoller’s proposal.

“It was a bit of serendipity for us,” Wineland recalls. “We were doing experiments that were closely related to the ideas they put forward.”

It was a short step from there to building the first quantum-mechanical logic gate based on individual quantum bits. … Gates of the type Monroe and Wineland demonstrated in 1995, known as “controlled-not gates,” can, in principle, be used to construct any logical circuit, no matter how complex.

“We saw that we had the first tiny little rudimentary quantum computer, before anybody knew what that meant,” says Monroe, now a professor at the University of Maryland, College Park, and fellow in the NIST-Maryland Joint Quantum Institute. “We were years ahead of everybody else.”

Monroe and Wineland, with D. M. Meekhof, Brian King and Itano, took a shortcut: instead of two ions they used one beryllium ion and stored two qubits in it. For the target they used two hyperfine states, two arrangements of the ion’s outer electron and nucleus; for the control, the ion’s motion, with its lowest level of vibration as 0 and the next as 1. They cooled the ion into its lowest level about 95 per cent of the time, then fired three laser pulses, following Cirac and Zoller’s recipe. When they had set the ion vibrating, they found its internal state flipped. When they had left it still, they found it unchanged. They matched the controlled-NOT truth table with high probability, though not perfectly. They needed about 50 microseconds for each gate and lost the superposition a few thousand times a second. That was slow enough for one gate and too fast for a long calculation.⁶6 C. Monroe, D. M. Meekhof, B. E. King, W. M. Itano and D. J. Wineland, “Demonstration of a Fundamental Quantum Logic Gate”, Physical Review Letters 75, 4714, 1995. tf.boulder.nist.gov

10.3Computers in a test tube

Chemists use nuclear magnetic resonance (NMR) to work out the structure of molecules. A chemist lines up the spins of atomic nuclei with a strong magnet, tips them with radio pulses and records the faint echo. Neil Gershenfeld of the MIT Media Lab and Isaac Chuang, then at Santa Barbara, found qubits in those spins, already shielded from their surroundings. They pointed out that there are several nuclear spins in each molecule of a liquid, and that each molecule is almost isolated from its neighbours. A chemist could treat each molecule as a small quantum computer and read a strong signal from roughly 10²³ copies.⁷7 Neil A. Gershenfeld and Isaac L. Chuang, “Bulk Spin-Resonance Quantum Computation”, Science 275, 350, 1997. fab.cba.mit.edu

At room temperature the directions of the spins are almost random. By the usual reasoning, no experimenter could see quantum interference in such a sample. Gershenfeld and Chuang and, independently, David Cory of MIT with Amr Fahmy and Timothy Havel of Harvard Medical School used pulse sequences to leave a small excess of spins in one state on top of a uniform background. Cory, Fahmy and Havel named them “pseudo-pure” states.⁸8 D. G. Cory, A. F. Fahmy and T. F. Havel, “Ensemble Quantum Computing by NMR Spectroscopy”, Proceedings of the National Academy of Sciences 94, 1634, 1997. web.mit.edu On them Cory, Havel and Mark Price ran a controlled-NOT gate.⁹9 D. G. Cory, M. D. Price and T. F. Havel, “Nuclear magnetic resonance spectroscopy: an experimentally accessible paradigm for quantum computing”, Physica D 120, 1998. arxiv.org With each added spin they lost signal exponentially; Havel put the limit at about eight to ten spins.

Samuel Braunstein, Carlton Caves and four other theorists proved in 1999 that a physicist could describe every state as close to random as those in NMR experiments without any entanglement.¹⁰10 S. L. Braunstein et al., “Separability of very noisy mixed states and implications for NMR quantum computing”, Physical Review Letters 83, 1054, 1999. arxiv.org Critics could ask whether NMR experimenters had done anything a programmer could not imitate on a classical computer.

The NMR teams ran the algorithms anyway. At IBM’s Almaden Research Center in San Jose, Chuang, Lieven Vandersypen, Matthias Steffen and colleagues, with two chemists, designed a molecule that nobody had made before, a perfluorobutadienyl iron complex. They used its five fluorine-19 nuclei and two carbon-13 nuclei as seven qubits.¹¹11 Robert Davis, IBM Quantum blog, “‘15’ was factored on quantum hardware twenty years ago”, 2022. ibm.com The team put a vial of it inside an 11.7-tesla magnet, drove the spins with shaped radio pulses and ran Shor’s algorithm to factor 15. They read the answer, 3 and 5, from the NMR spectrum and published it in Nature in December 2001.¹²12 L. M. K. Vandersypen et al., “Experimental realization of Shor’s quantum factoring algorithm using nuclear magnetic resonance”, Nature 414, 883, 2001. arxiv.org Vandersypen traced most of the errors to decoherence rather than faulty control.

Like the builders who later factored other small numbers, the IBM team simplified the circuit with what they already knew about 15.¹³13 Wikipedia, “Shor’s algorithm”, section on physical implementation, accessed 2026. en.wikipedia.org John Smolin, who had built the hardware for the first quantum key, showed with Graeme Smith and Alex Vargo in 2013 that with such shortcuts anyone could appear to factor very large numbers with two qubits.¹⁴14 John A. Smolin, Graeme Smith and Alex Vargo, “Oversimplifying quantum factoring”, Nature 499, 163, 2013 (arXiv title “Pretending to factor large numbers on a quantum computer”). arxiv.org

10.4Spins in silicon

Daniel Loss of the University of Basel and David DiVincenzo of IBM looked to the chip industry. They suggested trapping single electrons in quantum dots, tiny islands of semiconductor, and using each electron’s spin as a qubit. An engineer would lower the barrier between two neighbouring dots with a voltage to let the electrons interact for a moment.¹⁵15 Daniel Loss and David P. DiVincenzo, “Quantum Computation with Quantum Dots”, Physical Review A 57, 120, 1998. arxiv.org

Bruce Kane, at the University of New South Wales in Sydney, proposed in Nature in 1998 to place phosphorus-31 atoms 20 nanometres apart in a crystal of pure silicon-28. An engineer would address each nuclear spin through metal gates above the atoms and use the gates to pull neighbouring electrons together. Kane admitted “substantial challenges”; Physics World’s reporter named the main one as placing the phosphorus atoms accurately.¹⁶16 Physics World, “Quantum computers shape up”, 1998. physicsworld.com Robert Clark and later Michelle Simmons made Kane’s design the main goal of Australia’s national effort. By 2003 physicists in the programme had placed phosphorus atoms with a scanning tunnelling microscope.¹⁷17 S. R. Schofield, N. J. Curson, M. Y. Simmons, F. J. Rueß, T. Hallam, L. Oberbeck and R. G. Clark, “Atomically precise placement of single dopants in Si”, Physical Review Letters 91, 136104, 2003. arxiv.org

10.5Stockholm

Wineland’s group entangled two ions on demand in 1998, and four with a single laser pulse in 2000, using a gate that Klaus Mølmer and Anders Sørensen of Aarhus University had designed to tolerate warmer ions.¹⁸18 C. A. Sackett et al., “Experimental entanglement of four particles”, Nature 404, 256, 2000. ideas.repec.org In 2004 the NIST group and Rainer Blatt’s group at Innsbruck each teleported a quantum state from one ion to another.¹⁹19 NIST, “The Nobel Moments: Dave Wineland”, 2018. nist.gov “It was a real gravy train for a couple years,” Monroe told NIST. The physicists would read a theory paper, see they could do the experiment, do it and move on.

In Wineland’s group at NIST, John Bollinger’s team held about 1,000 beryllium ions in a Penning trap, a cage of electric and magnetic fields, as a model quantum memory. Michael Biercuk, a young physicist in the team, worked with Bollinger, Itano and colleagues on a method called dynamical decoupling. They flipped the stored qubits back and forth with timed pulses to cancel out slow noise from the surroundings. They reported in 2009 that with sequences they had tuned by experiment, without knowing the noise in advance, they protected the qubits better than with the textbook sequences.²⁰20 M. J. Biercuk, H. Uys, A. P. VanDevender, N. Shiga, W. M. Itano and J. J. Bollinger, “Optimized dynamical decoupling in a model quantum memory”, Nature 458, 996, 2009. arxiv.org

On 9 October 2012 members of the Royal Swedish Academy of Sciences gave the Nobel Prize in Physics to Wineland and to Haroche of the Collège de France, the sceptic of 1996.²¹21 Nobel Prize Outreach, “Press release: The Nobel Prize in Physics 2012”, 2012. nobelprize.org Haroche had worked the other way round, trapping photons and probing them with atoms. The academy cited them “for ground-breaking experimental methods that enable measuring and manipulation of individual quantum systems.” Monroe, who had moved to the University of Maryland, founded IonQ with Jungsang Kim in 2015 to sell trapped-ion machines.²²22 Wikipedia, “IonQ”, accessed 2026. en.wikipedia.org

Within a few years physicists stopped treating liquid NMR as a route to large machines; Steffen, for one, later worked on superconducting qubits at IBM. Atoms and molecules were small. The NIST team had needed 50 microseconds for one gate. A third group of physicists had begun to make qubits from electrical circuits on a chip, far larger and faster. Many physicists doubted that anything so big could behave like an atom at all. John Clarke’s group at Berkeley had set out in the 1980s to find out.

11.1A circuit that tunnelled

From 1978 onwards Anthony Leggett, a theorist who later shared the 2003 Nobel Prize in Physics, asked whether physicists could ever see a large object tunnel. To tunnel is to pass through a barrier too high to climb; George Gamow had used the effect in 1928 to explain the alpha decay of heavy nuclei. Leggett proposed a test with a Josephson junction: two pieces of superconductor, metal with no electrical resistance when cold, separated by an insulating layer a few atoms thick. Physicists describe the electrons in a superconductor as bound in pairs, billions of them sharing one quantum state. If they could catch that shared state tunnelling, Leggett argued, physicists would see quantum mechanics at work in an object they could hold.¹1 Nobel Prize Outreach, “Quantum properties on a human scale”, popular science background to the Nobel Prize in Physics 2025, 2025. nobelprize.org

By the mid-1980s John Clarke, a Cambridge-trained physicist at the University of California, Berkeley, had taken up the problem with his graduate student John Martinis and Michel Devoret, a postdoc from the Saclay nuclear research centre near Paris. Several groups had looked for the effect, but sceptics could blame their results on stray electrical noise. Clarke’s team built a chain of filters packed with copper powder and fixed each to a cold stage of the cryostat. With them they cut noise between 0.1 and 12 gigahertz by more than 200 decibels. With a weak microwave line they measured every property of the junction independently. They could then test the theory with no adjustable parameters.²2 Royal Swedish Academy of Sciences, “Scientific background to the Nobel Prize in Physics 2025”, 2025. nobelprize.org

They fed a steady current into a junction on a chip about a centimetre across and watched the voltage: zero while the circuit was trapped, a voltage at the moment of escape. They timed thousands of escapes. As they cooled the chip they counted fewer escapes, until below a certain temperature they found the rate no longer fell, as Leggett had predicted for tunnelling. Then they sent in microwaves. At particular frequencies they could pump energy into the circuit, lift it to a higher level and make it escape sooner. They concluded that the circuit had separate energy levels, like an atom.³3 Royal Swedish Academy of Sciences, “Quantum properties on a human scale”, popular science background to the Nobel Prize in Physics 2025, 2025. nobelprize.org

On 7 October 2025 members of the Royal Swedish Academy of Sciences gave Clarke, Devoret and Martinis the Nobel Prize in Physics for “the discovery of macroscopic quantum mechanical tunnelling and energy quantisation in an electric circuit”.⁴4 Royal Swedish Academy of Sciences, “The Nobel Prize in Physics 2025”, press release, 7 October 2025. kva.se The committee noted that Martinis later made a qubit from those energy levels, the lowest as 0 and the next as 1.

11.2Boxes, phases and cavities

At NEC’s laboratories in Tsukuba, Yasunobu Nakamura worked with Yuri Pashkin and his supervisor Jaw-Shen Tsai on a “Cooper-pair box”. The box was an aluminium strip 700 nanometres long, 50 wide and 15 thick, joined to a reservoir by a Josephson junction. They defined its two states by one extra pair of electrons on the box. They cooled the chip to about 30 thousandths of a degree above absolute zero and hit it with voltage pulses as short as 80 picoseconds. Reading it through a second junction, they watched the box swing back and forth between its two states for up to about 2 nanoseconds, a coherent oscillation.⁵5 Y. Nakamura, Yu. A. Pashkin and J. S. Tsai, “Coherent control of macroscopic quantum states in a single-Cooper-pair box”, Nature 398, 786, 1999. arxiv.org They published in Nature in April 1999; NEC’s staff later described the work as the first demonstration of a qubit on a solid-state device suited to integration.⁶6 NEC, press material on Yasunobu Nakamura and Jaw-Shen Tsai, 2023. nec.com

Two nanoseconds was far too short for computing; over the next decade experimenters removed one source of noise after another. Martinis, at NIST and from 2004 at the University of California, Santa Barbara, built “phase qubits” and read them by the tunnelling he had measured at Berkeley. At Yale, Robert Schoelkopf and Steven Girvin’s group borrowed a method from atomic physics. In 2004 Andreas Wallraff, David Schuster, Alexandre Blais and colleagues put a qubit inside a microwave resonator on the chip, a tiny transmission line in which they could hold a single photon. They swapped energy between the qubit and the photon faster than they lost it.⁷7 A. Wallraff et al., “Strong coupling of a single photon to a superconducting qubit using circuit quantum electrodynamics”, Nature 431, 162, 2004. arxiv.org With this arrangement, circuit quantum electrodynamics or circuit QED, an experimenter could read a qubit through the resonator, leave it in the state found, and keep it apart from noisy wires.

In 2007 Jens Koch, Schoelkopf and colleagues at Yale published the design that most builders of superconducting machines still use. They added a large capacitor across the junction of the Cooper-pair box. With that change they made the qubit almost insensitive to stray charges, the main source of noise in Nakamura’s box. They also kept the gap between its two lowest levels different enough from the next gap up that engineers could drive the lowest pair alone.⁸8 Jens Koch et al., “Charge insensitive qubit design derived from the Cooper pair box”, Physical Review A 76, 042319, 2007. arxiv.org They named it the transmon.

In 2011 Hanhee Paik and others in the Yale group put transmons inside a machined three-dimensional cavity and measured coherence times of 10 to 20 microseconds.⁹9 Hanhee Paik et al., “Observation of high coherence in Josephson junction qubits measured in a three-dimensional circuit QED architecture”, Physical Review Letters 107, 240501, 2011. arxiv.org Matthias Steffen, who had helped factor 15 with NMR at IBM a decade before, tallied the progress in 2011. Experimenters had raised coherence times from about a nanosecond in 1999 to a reliable 1 to 5 microseconds within ten years; the Yale group had then gained a further factor of 20 to 60.¹⁰10 Matthias Steffen, “Superconducting Qubits Are Getting Serious”, Physics 4, 103, 2011. physics.aps.org

11.3The machine in Burnaby

D-Wave’s engineers built an annealer instead of a gate machine. On its chip of superconducting niobium loops, a programmer sets the interactions to encode a puzzle, such as the best seating plan for a wedding. The engineers start the loops in a simple quantum state and slowly change the settings, aiming to leave the circuit in its lowest-energy state, from which they read the answer. Geordie Rose had founded the company in Vancouver in 1999 with Haig Farris, Bob Wiens and Alexandre Zagoskin.

On 13 February 2007 D-Wave’s managers showed a 16-qubit machine called Orion at the Computer History Museum in Silicon Valley. By internet link from the company’s refrigerator in British Columbia, the audience watched engineers use the chip to solve a Sudoku, seat dinner guests and match drug molecules.¹¹11 EDN, “D-Wave demos quantum computer”, 15 February 2007. edn.com D-Wave’s managers admitted that Orion was about 100 times slower than the best classical algorithm on a PC;¹²12 Edwin Cartlidge, “Quantum computing: a commercial reality?”, Physics World, 2 April 2007. physicsworld.com Rose allowed that his engineers might not be able to scale the design.

Academic physicists asked for evidence that D-Wave’s engineers had done anything quantum with Orion. Umesh Vazirani of Berkeley accused D-Wave of misleading the public; Scott Aaronson, then at Waterloo, compared the machine’s usefulness to “a roast-beef sandwich”.¹³13 Jason Pontin, “Q&A: D-Wave’s Geordie Rose”, MIT Technology Review, 6 April 2007. technologyreview.com

In May 2011 Mark Johnson and colleagues at D-Wave reported in Nature that they had seen quantum annealing in eight of their qubits. That month D-Wave’s managers announced the 128-qubit D-Wave One and said that Lockheed Martin would buy one. Richard Chirgwin of The Register reported a rumoured price of 10 million dollars, which D-Wave’s managers did not confirm. Aaronson accepted that Johnson’s team had shown a quantum effect; the claim that the machine beat classical computers remained D-Wave’s own.¹⁴14 Richard Chirgwin, “Lockheed-Martin signs on for D-Wave prototype computer”, The Register, 30 May 2011. theregister.com In May 2013 researchers from Google, NASA and the Universities Space Research Association announced a laboratory with a 512-qubit D-Wave Two at NASA’s Ames Research Center.¹⁵15 MIT Technology Review, “Google and NASA Launch Quantum Computing AI Lab”, 16 May 2013. technologyreview.com

Troels Rønnow, Matthias Troyer, Martinis and colleagues ran a D-Wave Two with up to 503 qubits on random puzzles and, in Science in 2014, reported no evidence of quantum speed-up over classical methods.¹⁶16 T. F. Rønnow et al., “Defining and detecting quantum speedup”, Science 345, 420, 2014. arxiv.org In December 2015 Google’s researchers built problems with tall, narrow energy barriers to favour a machine that could tunnel. On those, they found a D-Wave 2X about 100 million times faster than simulated annealing, a standard classical method, running on one processor core. The researchers added the caveats themselves. They had made the problems to order; on most problems the chip could hold, programmers using other classical methods kept pace.¹⁷17 Vasil S. Denchev et al., “What is the Computational Value of Finite Range Tunneling?”, arXiv:1512.02206, 2015. arxiv.org

On 12 March 2025 Andrew King and colleagues at D-Wave reported in Science that they had used their annealer to model quantum magnets that no one could simulate with leading classical methods.¹⁸18 Andrew D. King et al., “Beyond-classical computation in quantum simulation”, Science 388, 199, 2025. arxiv.org In the days before publication, groups at EPFL in Lausanne and the Flatiron Institute in New York had posted classical simulations of some of those problems. Juan Carrasquilla, one of King’s co-authors, replied that the rival groups had covered only part of the problem set.¹⁹19 Edd Gent, “D-Wave ‘Supremacy’ Controversy Overshadows Real Progress”, IEEE Spectrum, 31 March 2025. spectrum.ieee.org

Joseph Tindall of the Flatiron Institute and colleagues published their simulations in Science on 21 May 2026. Five days later D-Wave’s managers replied that it did not reproduce the hardest of their problems or all of their measurements.²⁰20 D-Wave Quantum, “D-Wave’s Quantum Supremacy Result Stands”, press release, 26 May 2026, answering J. Tindall et al., Science 392, 868, 2026. ir.dwavequantum.com

11.4Five qubits on the internet

IBM’s research team at the Thomas J. Watson Research Center in Yorktown Heights, New York, connected a five-qubit superconducting processor to the internet on 4 May 2016 and named the service the IBM Quantum Experience. Members of the public could request access and run experiments on the real chip.²¹21 IBM, “IBM Makes Quantum Computing Available on IBM Cloud to Accelerate Innovation”, press release, 4 May 2016. uk.newsroom.ibm.com IBM’s managers predicted processors of 50 to 100 qubits within a decade and said that no one could emulate a 50-qubit machine on any of the TOP500 supercomputers.

Chris Williams of The Register pointed out that an invitation-only experiment was not much of a cloud service.²²22 Chris Williams, “IBM’s quantum ‘puter news proves Big Blue still doesn’t get ‘cloud’”, The Register, 4 May 2016. theregister.com But people with no laboratory could now run circuits on real qubits. Nobody had shown that any such chip could do something a supercomputer could not. Google’s managers had hired Martinis and his Santa Barbara group in 2014 to build larger chips; his engineers set out to learn how many qubits they would need before no supercomputer could keep up.

12.1A word for the goal

John Preskill gave the rapporteur’s talk on quantum information at the 25th Solvay Conference on Physics, in Brussels in October 2011. The Caltech theorist had estimated the error threshold in 1997. He wanted a name for the moment when someone used a quantum device to do a task, useful or not, that no ordinary computer could do in any reasonable time. In the written version of the talk, posted in March 2012, he chose “quantum supremacy”. He put the open question in one line: “Is controlling large-scale quantum systems merely really, really hard, or is it ridiculously hard?” If the first, he guessed, engineers might build large quantum computers within a few decades; if the second, they would need centuries.¹1 John Preskill, “Quantum computing and the entanglement frontier”, arXiv:1203.5813, 2012. arxiv.org

Gil Kalai, a mathematician at the Hebrew University in Jerusalem, argued that nobody would reach it. Because of noise, he held, programmers would always be able to imitate real devices on classical computers.

In January 2018 Preskill offered a second label, “noisy intermediate-scale quantum” or NISQ. He meant the machines of 50 to 100 qubits that builders were about to deliver: perhaps able to beat classical computers at some tasks, but too error-prone for long circuits.²2 John Preskill, “Quantum Computing in the NISQ era and beyond”, Quantum 2, 79, 2018. arxiv.org He later wrote that he had considered “quantum advantage” in 2012 and rejected it as too weak. He had not foreseen the racist overtones that some readers heard in “supremacy”.³3 John Preskill, “Why I Called It ‘Quantum Supremacy’”, Quanta Magazine, 2 October 2019. quantamagazine.org

12.2Sycamore

John Martinis, who had watched a circuit tunnel at Berkeley in 1985, had brought his Santa Barbara group to Google in 2014. Their engineers fabricated the Sycamore chip in December 2018: 54 transmon qubits in a rectangular grid, each joined to its four neighbours by a coupler that they could tune from off to 40 megahertz. They made the wiring of aluminium, joined two silicon wafers with indium bumps, cooled the chip below 20 thousandths of a degree in a dilution refrigerator and drove it through 277 digital-to-analogue converters. One qubit was faulty, so they ran their experiments on the other 53.⁴4 Frank Arute et al., “Quantum supremacy using a programmable superconducting processor”, Nature 574, 505, 2019. nature.com

The team chose a task that nobody could easily fake on a classical computer. They built random circuits, layers of gates chosen at random, ran each one and read out all 53 qubits as a string of zeros and ones. Because of interference, they expected some strings far more often than others. No programmer then had a classical machine with the working memory to hold the full state of 53 qubits. They checked the chip on smaller circuits that they could still simulate on the Jülich supercomputer in Germany and on Google’s servers. From the error rates of single gates they predicted a fidelity of only about 0.2 per cent for their largest circuits, with 1,113 single-qubit gates and 430 two-qubit gates. To tell that weak signal from noise they needed a few million samples.

By Martinis’s account, the team thought the experiment was working in the winter of 2019, then saw an unexplained drop in fidelity and traced it to calibration. By late spring they had the data. When they finished, he said, “everyone’s emotion was just relief”.⁵5 UC Santa Barbara, “Ushering in a New Quantum Era”, 17 December 2019. news.ucsb.edu

Someone posted a draft on a NASA website in September 2019 (three co-authors worked at NASA’s Ames Research Center) and soon took it down. Reporters at the Financial Times described it on 20 September; a Google spokesperson declined to confirm it. Dario Gil, head of IBM Research, called the experiment a special-case laboratory experiment with no practical applications.⁶6 Robert Hackett, “Google Claims ‘Quantum Supremacy’”, Fortune, 20 September 2019. fortune.com

Nature’s editors published the paper, with 77 authors, on 23 October 2019. The team reported sampling one circuit a million times in about 200 seconds; they estimated that a programmer would need about 10,000 years for the same task on a state-of-the-art supercomputer. They had run parts of the simulation on Summit, then the world’s most powerful supercomputer, at Oak Ridge National Laboratory, and extrapolated. Martinis compared the result to a programmer’s first Hello World on a new machine: of no use in itself, but proof that the system worked. Preskill, writing in Quanta that month, agreed that the output was not very informative, but argued that the team had at least shown that they understood their hardware.⁷7 Elizabeth Gibney, “Hello quantum world! Google publishes landmark quantum supremacy claim”, Nature (reprinted in Scientific American), 23 October 2019. scientificamerican.com

12.3IBM’s reply

IBM’s researchers did not wait for publication either. On 21 October 2019 Edwin Pednault and four colleagues posted a preprint arguing that Google’s team had based its estimate on a method limited by memory and had overlooked Summit’s disks. With those 250 pebibytes of storage, they argued, programmers could hold the full state of 53 or 54 qubits and simulate the circuits to any depth “in a matter of days”. For 20 cycles they put the time at about two and a half days.⁸8 Edwin Pednault et al., “Leveraging Secondary Storage to Simulate Deep 54-qubit Sycamore Circuits”, arXiv:1910.09534, 2019. arxiv.org The next day Pednault, Dmitri Maslov, John Gunnels and Jay Gambetta repeated the estimate in an IBM blog post, said it was conservative and noted that they would match Sycamore’s output with far higher fidelity.

The IBM authors said plainly that they had not run the calculation; they offered a method and an estimate. Hamish Johnston of Physics World reported that if IBM’s researchers were right, Google’s team had beaten the best classical machine by a factor of about a thousand.⁹9 Hamish Johnston, “Is Google’s quantum supremacy not so supreme after all?”, Physics World, 23 October 2019. physicsworld.com Scott Aaronson of the University of Texas at Austin, D-Wave’s old critic, said the achievement was huge if it held up. Chris Monroe, who had built the first ion-trap gate with Wineland in 1995, warned that readers might overrate how close useful machines were. Kalai and two colleagues at the Hebrew University, Yosef Rinott and Tomer Shoham, began a statistical audit of Google’s published data, which they wrote up from 2020.¹⁰10 Yosef Rinott, Tomer Shoham and Gil Kalai, “Statistical Aspects of the Quantum Supremacy Demonstration”, Statistical Science 37, 322, 2022 (arXiv, August 2020). arxiv.org

12.4Taking turns

In Hefei, Jian-Wei Pan and Chao-Yang Lu of the University of Science and Technology of China (USTC) answered with light. Pan’s team had earlier sent quantum keys through the Micius satellite. They fixed a block of glass optics, equal to 300 beam splitters and 75 mirrors, to a 20-centimetre plate of ultra-low-expansion glass. They sent in 50 beams of squeezed light (light prepared in a special quantum state) and counted the photons at the far side with 100 superconducting nanowire detectors. They named the machine Jiuzhang, after an ancient Chinese book of mathematics, and set it a task called Gaussian boson sampling: to record where the photons came out. They detected up to 76 photons at once.¹¹11 Han-Sen Zhong et al., “Quantum computational advantage using photons”, Science 370, 1460, 2020. arxiv.org On 3 December 2020 they reported in Science that they had produced in 200 seconds samples which, they estimated, would take programmers 2.5 billion years on China’s TaihuLight supercomputer, or 600 million years on Japan’s Fugaku. Christian Weedbrook of the photonics company Xanadu pointed out that nobody could reprogram Jiuzhang’s fixed optics.¹²12 Philip Ball, “Physicists in China challenge Google’s ‘quantum advantage’”, Nature 588, 380, 2020. media.nature.com

Aaronson and Alex Arkhipov, then both at MIT, had proposed boson sampling in 2011, for single photons sent through a network of beam splitters. They gave evidence that nobody could imitate the photons’ output on an ordinary computer in reasonable time unless complexity theorists were wrong about beliefs that most of them shared.¹³13 Scott Aaronson and Alex Arkhipov, “The Computational Complexity of Linear Optics”, Proceedings of the 43rd ACM Symposium on Theory of Computing, 2011. arxiv.org Craig Hamilton and colleagues in Prague and Paderborn adapted the task for squeezed light in 2017; Pan’s team ran that version.¹⁴14 Craig S. Hamilton et al., “Gaussian Boson Sampling”, Physical Review Letters 119, 170501, 2017. arxiv.org

Yulin Wu and others in the same group then built Zuchongzhi, a 66-qubit chip of Sycamore’s general design, and in June 2021 posted random-circuit results on 56 of its qubits over 20 cycles. By their estimate a programmer would need at least eight years on the most powerful supercomputer to match their 1.2 hours of sampling. They put the classical cost of their task at 100 to 1,000 times that of Sycamore’s.¹⁵15 Yulin Wu et al., “Strong quantum computational advantage using a superconducting quantum processor”, Physical Review Letters 127, 180501, 2021. arxiv.org

Classical programmers answered. In September 2021 Benjamin Villalonga, Sergio Boixo and others at Google posted a cheap method for imitating the statistics of Gaussian boson sampling experiments. On some standard tests they came closer than the experimenters had.¹⁶16 Benjamin Villalonga et al., “Efficient approximation of experimental Gaussian boson sampling”, arXiv:2109.11525, 2021. arxiv.org In November Feng Pan, Keyang Chen and Pan Zhang of the Institute of Theoretical Physics in Beijing generated a million samples for Sycamore’s hardest circuit in about 15 hours on 512 graphics processors. Their fidelity was about 0.37 per cent. On an exascale supercomputer, built for a billion billion operations a second, they estimated that programmers could do it in a few dozen seconds, faster than Sycamore.¹⁷17 Feng Pan, Keyang Chen and Pan Zhang, “Solving the sampling problem of the Sycamore quantum circuits”, Physical Review Letters 129, 090502, 2022. arxiv.org In 2023 Changhun Oh, Bill Fefferman and colleagues posted a tensor-network algorithm, in which programmers store a quantum state as a chain of small linked tables instead of one vast list. With it, they argued, they had reproduced the largest Gaussian boson-sampling experiment more faithfully than its builders had.¹⁸18 Changhun Oh et al., “Classical algorithm for simulating experimental Gaussian boson sampling”, Nature Physics 20, 1461, 2024. arxiv.org

Google’s team set a harder test. In April 2023 Alexis Morvan, Boixo and colleagues posted a random circuit experiment on 67 qubits and 32 cycles, which, they argued, nobody could simulate on an existing supercomputer.¹⁹19 A. Morvan et al., “Phase transitions in random circuit sampling”, Nature 634, 328, 2024. arxiv.org By 2023 many physicists said “quantum advantage”, the phrase Preskill had turned down in 2012. Every team had picked a sampling task for its difficulty alone and run it on qubits that nobody could yet correct. Haroche and Raimond, the Paris sceptics of 1996, had expected experimenters to find error-correcting codes very hard to run beyond a few gates. In 2021 Google’s team had cut one kind of error more than a hundredfold by growing a repetition code, built to catch only bit flips or only phase flips, from 5 to 21 qubits.²⁰20 Zijun Chen et al., “Exponential suppression of bit or phase flip errors with repetitive error correction”, Nature 595, 383, 2021. arxiv.org Until February 2023 nobody had published evidence that builders could protect a qubit against every kind of error better with a larger code than with a smaller one. Google’s team in Santa Barbara had begun to test it on Sycamore.

13.1A thin margin

Google’s team in Santa Barbara put Haroche and Raimond’s doubt to a direct test on Sycamore. Theorists had proved that a builder gains from a larger code only if the physical qubits’ error rate is below a critical value, the threshold. Above it, every added qubit is one more place for an error to start. The first estimates, in the 1990s, were one error in 10,000 operations or stricter. In 2007 Robert Raussendorf and Jim Harrington calculated that builders of surface codes could tolerate about 0.75 per cent.¹1 Robert Raussendorf and Jim Harrington, “Fault-tolerant quantum computation with high threshold in two dimensions”, Physical Review Letters 98, 190504, 2007. arxiv.org The team built surface codes, square patches of data qubits with measuring qubits between them, and compared a 5-by-5 patch (distance 5) with 3-by-3 patches (distance 3). In the larger code they lost the stored information on 2.914 per cent of correction cycles; in the smaller ones, on 3.028 per cent. In February 2023 the authors described their result, thin as the margin was, as the first in which error correction “begins to improve performance” as they added qubits.²2 Google Quantum AI (R. Acharya et al.), “Suppressing quantum errors by scaling a surface code logical qubit”, Nature 614, 676, 2023. arxiv.org

On the best machines engineers got two-qubit operations right about 99.9 per cent of the time. For many useful calculations, programmers needed error rates below one in ten billion.³3 Google Quantum AI and Collaborators, “Quantum error correction below the surface code threshold”, Nature 638, 920, 2025. nature.com Builders hoped to close the gap with logical qubits, each spread across many physical ones.

Mikhail Lukin’s group at Harvard and its partners at MIT, the atom builders who would later keep an array running for two hours, built theirs from rubidium atoms held in optical tweezers. Engineers cannot move circuits printed on a chip; physicists can move atoms. Dolev Bluvstein and his colleagues split their machine into storage, entangling and readout zones and shuttled blocks of atoms between them mid-computation. With up to 280 atoms they ran circuits on as many as 48 logical qubits, with 228 logical two-qubit gates. With their small code they could only detect errors, so they discarded runs with a fault. On the runs they kept, they beat bare physical qubits. They published in Nature on 6 December 2023.⁴4 D. Bluvstein et al., “Logical quantum processor based on reconfigurable atom arrays”, Nature 626, 58, 2024 (published online 6 December 2023). nature.com

Quantinuum’s teams, with Microsoft’s software group, reported on 3 April 2024 four logical qubits made from 30 ions in their H2 trap, with error rates up to 800 times lower than the physical ones’.⁵5 Quantinuum, “Quantinuum and Microsoft announce new era in quantum computing with breakthrough demonstration of reliable qubits”, press release, 3 April 2024. quantinuum.com They reached the largest gains by discarding runs in which their checks had flagged an error.⁶6 A. Paetznick et al., “Demonstration of logical qubits and repeated error correction with better-than-physical error rates”, arXiv:2404.02280, 2024. arxiv.org

In November teams at Microsoft and Atom Computing of Boulder announced 24 entangled logical qubits, encoded in 48 atoms of a 256-atom ytterbium machine.⁷7 B. W. Reichardt et al., “Fault-tolerant quantum computation with a neutral atom processor”, arXiv:2411.11822, 2024. arxiv.org⁸8 Matt Swayne, “A closer look into the Microsoft–Atom Computing logical qubit study”, The Quantum Insider, 23 November 2024. thequantuminsider.com

13.2Quieter qubits

Michael Biercuk attacked errors in the physical qubits. At NIST in Boulder he had learned to protect stored ions with timed pulses. At the University of Sydney, where he led the Quantum Control Laboratory, he founded Q-CTRL on 22 November 2017, with seed money from investors including Main Sequence Ventures and Sequoia China.⁹9 Q-CTRL, “From quantum startup to scaleup: celebrating five years of Q-CTRL”, November 2022; Q-CTRL, “Sydney’s Q-CTRL wins backing from global technology funds”, 10 July 2018. q-ctrl.com q-ctrl.com His engineers wrote software to apply such control to other people’s machines, IBM’s and IonQ’s among them: Fire Opal for programmers, Boulder Opal for the teams that tune the hardware. They shaped pulses and laid out circuits to prevent errors without giving up extra qubits to a code.¹⁰10 Q-CTRL, “Supported hardware providers”, Fire Opal documentation, accessed October 2026. docs.q-ctrl.com

Pranav Mundada, Biercuk and colleagues ran their automated workflow on IBM machines of up to 16 qubits and reported gains of up to more than a thousandfold over expert-configured methods.¹¹11 Pranav S. Mundada et al., “Experimental benchmarking of an automated deterministic error suppression workflow for quantum algorithms”, Physical Review Applied 20, 024034, 2023. arxiv.org From November 2023 users of IBM’s pay-as-you-go service could switch it on at no extra cost.¹²12 Q-CTRL, “Q-CTRL integrates its error suppression technology into IBM Quantum services”, press release, 28 November 2023. q-ctrl.com With suppression, programmers got cleaner runs from noisy qubits, but no calculation of unlimited length; for that they still needed a code.

13.3Willow

Hartmut Neven, who had founded Google Quantum AI, announced Willow on 9 December 2024: 105 qubits, made in his engineers’ own plant, with an average lifetime of 68 microseconds, against about 20 for Sycamore.¹³13 Michael Newman and Kevin Satzinger, “Making quantum error correction work”, Google Research blog, 9 December 2024. research.google Peter Shor had spread one qubit across nine in 1995. On Willow the engineers built surface-code memories of distance 3, 5 and 7 and divided the logical error rate by 2.14 with each step. With their distance-7 code, on 101 qubits, they lost the information on 0.143 per cent of cycles and kept it 2.4 times as long as on the chip’s best single qubit. With their distance-5 code they decoded in real time, at an average delay of 63 microseconds on cycles of 1.1 microseconds.¹⁴14 Google Quantum AI and Collaborators, “Quantum error correction below the surface code threshold”, Nature 638, 920, 2025 (published online 9 December 2024). nature.com

The team also reported a limit. With simpler repetition codes run up to distance 29, they found rare bursts of correlated errors, about once an hour. Neven led his announcement with a random-circuit benchmark that his engineers had run in under five minutes and that, by their estimate, programmers would need 10²⁵ years to repeat on a supercomputer. He took it as support for David Deutsch’s idea of computation in many parallel universes.¹⁵15 Hartmut Neven, “Meet Willow, our state-of-the-art quantum chip”, Google blog, 9 December 2024. blog.google

Physicists outside Google answered him that month. Ethan Siegel, an astrophysicist and science writer, argued that Neven had mistaken the mathematical space in which physicists describe quantum states for a set of real universes. Physicists could account for Willow equally well, he wrote, with any of the rival readings of quantum mechanics.¹⁶16 Ethan Siegel, “Ask Ethan: Does quantum computation occur in parallel universes?”, Big Think, December 2024. bigthink.com Scott Aaronson of the University of Texas at Austin wrote that the experiment confirmed quantum mechanics once more but added nothing to the old dispute over what it means.¹⁷17 Scott Aaronson, “The Google Willow thing”, Shtetl-Optimized, 10 December 2024. scottaaronson.blog

When Clarke, Devoret and Martinis shared the Nobel Prize in Physics in October 2025 for their Berkeley circuit, the Swedish academy’s officers listed Google Quantum AI among Devoret’s affiliations.¹⁸18 Nobel Prize Outreach, “Press release: The Nobel Prize in Physics 2025”, 7 October 2025. nobelprize.org

In November 2025 Lukin’s collaboration reported surface codes running 2.14 times below threshold in a four-round test, on arrays of up to 448 atoms. By their account they had shown every main element of a universal fault-tolerant design.¹⁹19 D. Bluvstein et al., “Architectural mechanisms of a universal fault-tolerant quantum computer”, arXiv:2506.20661, 2025; published as “A fault-tolerant neutral-atom architecture for universal quantum computation”, Nature, 10 November 2025. arxiv.org On 5 November Quantinuum’s engineers launched Helios, a machine of 98 barium ions. They reported running two-qubit gates correctly 99.921 per cent of the time; they had switched from ytterbium to use visible lasers.²⁰20 Quantinuum, “Introducing Helios: the most accurate quantum computer in the world”, 5 November 2025. quantinuum.com

13.4The Majorana bet

Microsoft’s researchers had pursued a different qubit since the mid-2000s. Theorists predicted that physicists could create Majorana zero modes, paired states at the two ends of a thin semiconductor wire coated with a superconductor, cooled and placed in a magnetic field. From the pair, experimenters could read whether there was an odd or an even number of electrons in the wire. With four such ends, on wires joined in the shape of an H, engineers could store one qubit.²¹21 Microsoft, “Microsoft’s Majorana 1 chip carves new path for quantum computing”, 19 February 2025. news.microsoft.com Because engineers would store the information at both ends, the theorists argued, engineers would need far less error correction for such a topological qubit. A Delft team led by Leo Kouwenhoven had published “Quantized Majorana conductance” in Nature in March 2018. They retracted it in 2021, after they recalibrated their data and found the key plateau about 8 per cent off the predicted value.²²22 Nature, “Retraction Note: Quantized Majorana conductance”, Nature 591, E30, 2021. nature.com

On 19 February 2025 Microsoft’s quantum team announced Majorana 1, a chip with eight topological qubits, they said, designed to scale to a million. Microsoft’s writers promised useful machines “in years, not decades”.²³23 Microsoft, “Microsoft’s Majorana 1 chip carves new path for quantum computing”, 19 February 2025. news.microsoft.com In Nature the same day they reported a fast measurement of parity, whether an odd or even number of electrons sat in an indium arsenide wire coated with aluminium. They wrote that they could not tell from these measurements alone whether the states they had detected were topological.²⁴24 Microsoft Azure Quantum, “Interferometric single-shot parity measurement in InAs–Al hybrid devices”, Nature 638, 651, 2025. nature.com

Critics pressed that point. Henry Legg, a theorist at the University of St Andrews, argued that Microsoft’s researchers got different answers from their test for a topological phase depending on which settings they analysed. At the Global Physics Summit in Anaheim on 18 March, Chetan Nayak, a Microsoft technical fellow, showed for the first time a second kind of measurement that a working qubit needs. To many in the room the plot looked like random jitter; Nayak said that his team had found the expected two-state pattern in it by statistical analysis. Sergey Frolov of Pittsburgh said the pattern was noise. Sankar Das Sarma of the University of Maryland found the first measurement convincing and said that “people of goodwill could disagree”. Kartiek Agarwal of Argonne thought the test sound but the device not yet a qubit. Roman Lutchyn of Microsoft said his team stood by its results.²⁵25 Emily Conover, “Physicists are mostly unconvinced by Microsoft’s new topological quantum chip”, Science News, 27 March 2025. sciencenews.org

13.5Defences before the attack

Cryptographers did not wait for anyone to build a machine able to run Shor’s algorithm against the RSA and elliptic-curve methods that engineers use to protect web traffic. Staff at NIST began looking for replacements in 2015 and assessed 82 algorithms from 25 countries. On 13 August 2024 NIST’s team published the first three standards. With FIPS 203 (ML-KEM) two parties can agree a secret key; with FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) they can sign documents. The designers of the first two built them on lattice problems, such as finding a very short step between points of a vast grid in hundreds of dimensions. Nobody has found a fast method for these on any computer. NIST’s team kept the third, built on hash functions, in reserve in case attackers broke the lattices.²⁶26 NIST, “NIST releases first 3 finalized post-quantum encryption standards”, 13 August 2024. nist.gov

Outside cryptographers attacked the candidates before anyone relied on them. In February 2022 Ward Beullens of IBM Research in Zurich recovered the secret key of Rainbow, a finalist for signatures, from its public key in about 53 hours on a laptop.²⁷27 Ward Beullens, “Breaking Rainbow Takes a Weekend on a Laptop”, IACR Cryptology ePrint Archive 2022/214, 2022. eprint.iacr.org That July Wouter Castryck and Thomas Decru of KU Leuven broke SIKE, a key-agreement scheme that NIST had kept for a fourth round. With their published program they recovered a key on a single processor core in about ten minutes.²⁸28 Wouter Castryck and Thomas Decru, “An efficient key recovery attack on SIDH”, IACR Cryptology ePrint Archive 2022/975, 2022. eprint.iacr.org Neither attacker had used a quantum computer. NIST’s team left both schemes out of its standards.

These finalized standards include instructions for incorporating them into products and encryption systems. We encourage system administrators to start integrating them into their systems immediately, because full integration will take time. … There is no need to wait for future standards. Go ahead and start using these three. We need to be prepared in case of an attack that defeats the algorithms in these three standards, and we will continue working on backup plans to keep our data safe. But for most applications, these new standards are the main event.

The cryptographers hurried because an adversary can record encrypted traffic today and decrypt it later. In November 2024 Moody and four NIST colleagues proposed that NIST deprecate the weaker RSA and elliptic-curve keys after 2030 and disallow all of them after 2035.²⁹29 Dustin Moody et al., NIST IR 8547 (initial public draft), “Transition to Post-Quantum Cryptography Standards”, 12 November 2024. csrc.nist.gov

Theorists kept cutting the attackers’ requirements. In 2019 Craig Gidney of Google and Martin Ekerå had estimated that someone with 20 million noisy qubits could factor a 2048-bit RSA number in eight hours. In May 2025 Gidney cut the count to fewer than a million qubits running for less than a week, at 0.1 per cent error per gate.³⁰30 Craig Gidney, “How to factor 2048 bit RSA integers with less than a million noisy qubits”, arXiv:2505.15917, 21 May 2025. arxiv.org That was still nearly ten thousand times as many qubits as Google’s engineers had put on Willow. Nobody had yet built a machine with a tenth as many, or decoders to keep pace with one. At IBM, Jay Gambetta, who had helped answer Google’s supremacy claim in 2019, ran the engineers who had to fit that many qubits and wires into refrigerators.

14.1Two refrigerators

There was no refrigerator large enough for Gidney’s million qubits and their wiring. Jay Gambetta’s engineers at Yorktown Heights, New York, planned to hold large machines in many joined refrigerators, not one vast one. By August 2026 they had joined two box-shaped cryogenic modules, together more than eight feet tall and eight feet wide. They brought the shared interior to 4 kelvin in under five days, then to below 15 thousandths of a degree above absolute zero. They gave each module up to twelve times the usual wiring space, to join chips across modules with short couplers. On 19 August Gambetta, IBM’s research director, announced the result and restated the plan to deliver Starling, a fault-tolerant machine, in 2029.¹1 IBM, “IBM connects its first modular cryogenic systems in milestone toward fault-tolerant quantum computing”, press release, 19 August 2026. newsroom.ibm.com In June 2025 IBM’s managers had promised that on Starling programmers would run 100 million operations on 200 logical qubits.²2 IBM, “IBM sets the course to build world’s first large-scale, fault-tolerant quantum computer at new IBM Quantum Data Center”, 10 June 2025. newsroom.ibm.com

Quantinuum’s researchers reported on 19 October a logical fidelity of 99.9995 per cent on Helios, or five errors in a million operations. They used a colour code, another code laid out on a flat grid, with up to 37 ions per logical qubit. With each step up in code distance, they said, they cut the remaining errors twelvefold. Robin Blume-Kohout of Sandia National Laboratories, an outsider, judged the logical qubit nearly 100 times better than its physical parts. The company’s executives said the result kept them on course for Apollo, a fault-tolerant machine promised for 2029.³3 Quantinuum, “Quantinuum breaks error-correction world record by 10x”, press release, 19 October 2026. quantinuum.com Quantinuum’s managers had raised $1.68 billion when they listed the company on Nasdaq in June.⁴4 IPO Scoop, “The IPO Buzz: Quantinuum priced upsized IPO at $60, $5 above range”, 4 June 2026. iposcoop.com

Google’s team worked on another cost. For some operations, programmers must use up specially prepared qubits called magic states. By some estimates, engineers could spend as much as 95 per cent of a future machine on making them. In Science on 15 October the team reported that they had cut errors in preparing these states about forty-fold on Willow, to a logical fidelity of 99.99 per cent among the attempts they kept. They used a method that Craig Gidney, Noah Shutty and Cody Jones had devised in 2024. In one storage test they saw errors about seven times higher than predicted.⁵5 Matt Swayne, “Google demonstrates method to cut errors in quantum computing’s ‘magic states’”, The Quantum Insider, 16 October 2026. thequantuminsider.com In March Hartmut Neven had added neutral atoms to Google’s work, under Adam Kaufman in Boulder. Engineers, he wrote, found long circuits easier on chips and large numbers of qubits easier in atom arrays.⁶6 Hartmut Neven, “Building superconducting and neutral atom quantum computers”, Google blog, 24 March 2026. blog.google

Microsoft’s researchers announced Majorana 2 on 2 June, in a paper that referees had not yet reviewed. With lead in place of aluminium, they reported, they had kept the parity of a device fixed for about 20 seconds, a thousand times longer than in the first generation. They moved their target for a scalable machine to 2029. Kartiek Agarwal of Argonne called the new work “fantastic progress”.⁷7 Emily Conover, “Microsoft’s quantum chip got an upgrade. Critics are still skeptical”, Science News, 2 June 2026. sciencenews.org On 24 June Nature’s editors published Henry Legg’s critique of the 2025 paper, with Microsoft’s reply.⁸8 Henry Legg, “On the robustness of topological gap detection via transport”, Nature, 24 June 2026. doi.org Marin Ivezic, an analyst, noted that the new paper reported only the first of the two kinds of measurement a qubit needs.⁹9 Marin Ivezic, “Microsoft’s Majorana 2 chip achieves 20-second parity lifetime, but the topological qubit debate rages on” (page title “Microsoft Majorana 2: 20-second qubits, same questions”), PostQuantum, 3 June 2026. postquantum.com In September Microsoft’s team opened a centre at the University of Maryland and gave DARPA’s evaluators on-site access to a Majorana 2 system.¹⁰10 The Quantum Insider, “Microsoft gives DARPA access to Majorana system, opens Maryland quantum research center”, 22 September 2026. thequantuminsider.com

14.2Claims and counter-claims

Michael Biercuk, the former NIST ion trapper, set out to get useful answers from machines without full error correction. On 6 May his team at Q-CTRL reported that, with their error-suppression software, they had simulated electrons moving along a chain of atoms, a textbook model of a material, on up to 120 qubits of an IBM processor. By their account they reached an answer in about two minutes, against more than 100 hours for a leading classical method: a 3,000-fold speed-up.¹¹11 Q-CTRL, “Q-CTRL delivers 3,000x speedup in materials discovery for the energy sector with quantum computing, demonstrates evidence of practical quantum advantage”, press release, 6 May 2026. q-ctrl.com Classical programmers raced to answer, as they had answered Google in 2019. On 3 June Román Orús and colleagues at Multiverse Computing posted a run in which they reached the same point in about 100 minutes on one graphics processor. Even on their reckoning, Biercuk’s team had finished about 36 times faster on a noisy machine.¹²12 Roman Rausch et al., “Pushing the Classical Frontier of 1D Fermi–Hubbard Quench Dynamics Beyond Current Quantum Simulations”, arXiv:2606.04771, 3 June 2026. arxiv.org

In a July revision Biercuk’s team reported about 500-fold against a second standard package.¹³13 Gavin S. Hartnett et al., “Fast, accurate, high-resolution simulation of large-scale Fermi-Hubbard models on a digital quantum processor”, arXiv:2605.04025v2, 15 July 2026. arxiv.org On 13 August Garnet Chan, a theoretical chemist at Caltech, and two colleagues reported that, with another tensor-network method, they could compute all 7,260 quantities that Biercuk’s team had measured, in less than the processor’s 166 seconds of running time. They based that time on an estimate for 120 graphics processors working in parallel; referees had not yet reviewed their paper.¹⁴14 Xiao-Yu Ouyang, Runze Chi and Garnet Kin-Lic Chan, “Fast classical simulation of ‘Fast, accurate, high-resolution simulation of large-scale Fermi-Hubbard models on a digital quantum processor’”, arXiv:2608.13805, 13 August 2026. arxiv.org Each classical group cut the margin; if Chan’s result held, his group had removed it. Multiverse’s programmers also found close agreement between their figures and the quantum data across the hardest stretch of the run. Biercuk’s team took that as independent confirmation that their results, obtained with suppression software and no code, were accurate.

Independent testers judged the software itself. On 5 August Daniel Sierra-Sosa and three colleagues at universities compared error-management tools on a 156-qubit IBM processor. With Q-CTRL’s software they cut errors about threefold against unaided runs, in about the same processor time as IBM’s own error mitigation. With a rival tool from Qedma they cut errors further but used 7.5 to 11 times as much processor time.¹⁵15 Daniel Sierra-Sosa et al., “Quantum Error Management in Practice: A Cross-Stack Benchmark”, arXiv:2608.05202, 5 August 2026. arxiv.org

Biercuk’s engineers also built navigation systems from quantum sensors, for ships and aircraft that cannot rely on GPS. In April 2025 they reported flight trials in which, by matching magnetometer readings to maps of the earth’s magnetic field, they had fixed an aircraft’s position up to 46 times more accurately than a strategic-grade inertial system.¹⁶16 Murat Muradoglu et al., “Quantum-assured magnetic navigation achieves positioning accuracy better than a strategic-grade INS in airborne and ground-based field trials”, arXiv:2504.08167, 10 April 2025. arxiv.org DARPA’s managers awarded them contracts worth $24.4 million in August 2025 to build sturdier sensors.¹⁷17 The Quantum Insider, “DARPA selects Q-CTRL to develop next-generation quantum sensors for navigation on advanced defense platforms”, 27 August 2025. thequantuminsider.com In August 2026 Q-CTRL’s engineers reported a trial in the Coral Sea in which they navigated a 29-metre vessel by gravity, with positions good to about a nautical mile over most of the route. The company’s own scientists wrote both trial reports.¹⁸18 Q-CTRL, “Q-CTRL achieves world’s first GPS-free quantum gravimetric navigation demonstration in maritime field trial”, press release, 27 August 2026. q-ctrl.com

Google’s team had said in October 2025 that it ran its Quantum Echoes algorithm on Willow 13,000 times faster than the best classical method on a leading supercomputer.¹⁹19 Hartmut Neven and Vadim Smelyanskiy, “Our Quantum Echoes algorithm is a big step toward real-world applications for quantum computing”, Google blog, 22 October 2025. blog.google Researchers at IBM and Algorithmiq claimed in July 2026 an advantage in simulating an irregular quantum material on an IBM Heron processor.²⁰20 IBM and Algorithmiq, “IBM and Algorithmiq demonstrate quantum advantage”, press release, 30 July 2026. newsroom.ibm.com

14.3The judges

DARPA’s managers judged the builders from outside. In their Quantum Benchmarking Initiative, begun in mid-2024, they asked whether anyone could build by 2033 a quantum computer worth its cost. They offered companies up to $1 million to describe a design, up to $15 million to plan it and up to $300 million in Stage C, in which government teams test the hardware.²¹21 DARPA, “Quantum Benchmarking Initiative”, programme page, current as of 8 October 2026. darpa.mil On 7 October 2026 they moved Atom Computing, Diraq, IBM and IonQ into Stage C, where Microsoft and PsiQuantum already were.²²22 DARPA, “Four more teams enter Quantum Benchmarking Initiative’s final stage”, 7 October 2026. darpa.mil

The six teams worked with six kinds of qubit, from neutral atoms to photons. IonQ’s engineers had trapped ions in prototype 256-qubit chips from a semiconductor foundry. PsiQuantum’s managers had signed a $125 million agreement with DARPA on 22 July 2026 for testing of their photonic designs.²³23 Marin Ivezic, “DARPA advances four more quantum companies to Stage C”, PostQuantum, 9 October 2026. postquantum.com Quantinuum and QuEra remained in Stage B and Google in Stage A; DARPA’s managers expected more to reach Stage C soon.

14.4The defenders’ calendar

Federal officials did not wait for that verdict. On 22 June President Trump signed Executive Order 14412. Two days later officials at the Office of Management and Budget told agencies to move their most sensitive systems to post-quantum key exchange by 31 December 2030 and to post-quantum signatures by the end of 2031. On 27 October 2026 Dustin Moody and his colleagues at NIST published their final transition plan. They kept the years from their 2024 draft: deprecate RSA and elliptic-curve cryptography after 2030, now at every key size, and disallow them after 2035.²⁴24 Dustin Moody et al., NIST IR 8547, “Transition to Post-Quantum Cryptography Standards”, October 2026. doi.org

Measured against the 10 to 20 years that previous cryptographic transitions have taken, these deadlines leave little margin: meeting them will require immediate and sustained action by federal agencies and by the technology providers, standards organizations, and infrastructure operators on which federal systems depend. Organizations should treat the migration to PQC as a current operational priority, beginning with cryptographic inventories, migration planning, and early deployments of PQC-enabled products and services.

14.5The work left

The sceptics had not gone away. Gil Kalai, who had doubted supremacy in 2018, said in an interview published in August 2026 that he still expected error correction to fail because of correlated noise in entangled qubits. He added that experimenters’ machines were at last good enough to test his conjecture.²⁵25 Yuval Boger, “Gil Kalai (Hebrew University / Reichman University): why noise may doom quantum computers”, interview, The Quantum Insider, 1 August 2026. thequantuminsider.com Nobody had yet run a calculation of commercial value that no classical computer could match.

Theorists had also learned to test the promised uses. In 2018 Ewin Tang, an 18-year-old who had just graduated from the University of Texas at Austin, where Aaronson had advised her research, found a classical method for recommending products to customers. Her method was only polynomially slower than Iordanis Kerenidis and Anupam Prakash’s quantum algorithm of 2016. She had removed what many had counted among the clearest exponential speed-ups.²⁶26 Kevin Hartnett, “Teenager Finds Classical Alternative to Quantum Recommendation Algorithm”, Quanta Magazine, 31 July 2018. quantamagazine.org In 2023 Torsten Hoefler, Thomas Häner and Matthias Troyer of Microsoft were among the specialists who sorted the candidates. They judged chemistry and materials, whose problems are themselves quantum, the most promising uses. For most other proposed uses, they found, programmers would need bigger speed-ups than anyone could expect from a quantum computer.²⁷27 Torsten Hoefler, Thomas Häner and Matthias Troyer, “Disentangling Hype from Practicality: On Realistically Achieving Quantum Advantage”, Communications of the ACM, May 2023. arxiv.org

The builders had a list of problems. Decoder programmers needed to keep pace with a correction cycle every microsecond. Google’s team and others needed cheap magic states. Atom physicists had to replace lost atoms during a long calculation. Harvard’s team had kept an array of atoms filled for two hours while preserving the qubits stored in it. IBM’s engineers needed couplers to carry quantum information between refrigerators. IonQ’s and Diraq’s engineers needed foundries to make qubits as they make transistors. Q-CTRL’s engineers, and others claiming advantage without error correction, wanted results that classical programmers could not soon match. By 2026 teams on three kinds of hardware had shown logical qubits improving below threshold, which the Paris sceptics of 1996 had doubted anyone could do. Nobody had yet kept enough of them coherent to factor a useful number. IBM’s, Quantinuum’s and Microsoft’s leaders had all named 2029, the first two for a fault-tolerant machine and Microsoft’s for a scalable one; DARPA’s evaluators had named 2033 for a useful one.