The shortest accurate description of quantum computing: it is a machine that prepares a superposition of candidate solutions, evolves them through unitary operations (the algorithm), and measures the result in a way that the constructive interference of correct solutions amplifies the probability of getting the right answer. Everything else — qubit modalities, error correction, decoherence — is engineering. The model below contrasts what classical and quantum machines actually do.
The right question is not 'is quantum faster.' It is 'is your problem in one of the four families quantum is good at — Shor-shaped, Grover-shaped, simulation-shaped, or optimization-shaped (with caveats).' If yes, quantum will eventually dominate that workload. If no, you are in classical-computing territory for the foreseeable future. Most workloads are classical territory; the few that are not are very important.
DEEP READ 4 sections · cited primary sources · technical review pending
01 The qubit, properly explained
A classical bit is a switch — it is in state 0 or state 1 at any moment. A qubit is a vector in a 2-dimensional complex Hilbert space, written as α|0⟩ + β|1⟩, where α and β are complex numbers (probability amplitudes) and |α|² + |β|² = 1. The probability of measuring 0 is |α|², the probability of measuring 1 is |β|². Before measurement, the qubit is in neither state — it is in a superposition described by α and β. After measurement, it collapses to 0 or 1 and the superposition is destroyed.
What makes this powerful is what happens with multiple qubits. With n classical bits, you have 2^n possible states but only one of them is realized at any moment. With n qubits, you have 2^n complex amplitudes simultaneously — the system holds a full probability distribution over all 2^n classical states. A 50-qubit system has ~10¹⁵ amplitudes; a 300-qubit system has more amplitudes than atoms in the observable universe.
The misleading framing is 'quantum tries all answers at once.' What actually happens: quantum operations transform the whole amplitude distribution in correlated ways, and clever algorithms arrange the dynamics so that constructive interference amplifies the amplitude of the correct answer while destructive interference suppresses the wrong ones. When you measure, you most likely get the right answer. The art of quantum algorithm design is engineering those interference patterns.
- Bit vs qubit Bit: 0 or 1. Qubit: α|0⟩ + β|1⟩ with complex amplitudes. n bits: 1 state of 2^n. n qubits: amplitudes over all 2^n.
- What measurement does Collapses superposition to one classical outcome with probability |α|² or |β|². You cannot directly read the amplitudes — you can only sample from the distribution they define.
02 Entanglement — the resource that makes quantum quantum
Take two qubits. If they are not entangled, the state of the pair can be described as the product of two independent qubit states: (α|0⟩ + β|1⟩) ⊗ (γ|0⟩ + δ|1⟩). Four amplitudes total. If they are entangled, the joint state cannot be factored into two independent qubit states — there is correlation built into the very definition of the system. The Bell state (|00⟩ + |11⟩)/√2 is the simplest example: measuring one qubit guarantees the other will measure the same way, even though neither has a definite value before measurement.
Entanglement is not a 'spooky communication channel' — you cannot use it to send signals faster than light. But it is the resource that lets quantum algorithms achieve computational advantages classical machines cannot reach. Without entanglement, a quantum computer is just a probabilistic classical computer; with entanglement, it can compute things classical machines provably cannot.
Practical implication for buyers and engineers: entanglement is fragile. Maintaining it requires extraordinary isolation from environment noise (cryogenic temperatures for superconducting qubits, ultra-high vacuum for ion traps, laser-stable cavities for neutral atoms). Most engineering effort in quantum computing today is about extending coherence time — how long entanglement survives before noise destroys it.
03 Shor, Grover, simulation — what quantum is genuinely good at
Shor's algorithm (Peter Shor, 1994) factors integers and solves the discrete logarithm problem in polynomial time on a quantum computer. Classically, the best known algorithms are sub-exponential — RSA-2048 takes ~10²⁰ operations to factor classically; Shor's would do it in ~10⁸ operations on a sufficient quantum computer. This is the cryptographic threat. Every public-key cryptosystem based on factoring or discrete log (RSA, DH, ECC) is broken by Shor at sufficient scale.
Grover's algorithm (Lov Grover, 1996) searches an unstructured database of N items in O(√N) time vs O(N) classically. For symmetric crypto (AES, SHA-2/3) this halves the effective security level — AES-128 becomes ~64-bit strength against quantum, which is in attack range. The mitigation is easy: double the key length. AES-256 stays at ~128-bit quantum strength. SHA-512 stays strong. This is why NIST's recommended path is to bump symmetric key sizes (cheap) and replace asymmetric cryptography entirely (expensive).
Quantum simulation — simulating quantum mechanical systems — is the application area with the clearest commercial advantage. Simulating molecules, materials, chemical reactions, and condensed-matter physics is exponentially expensive classically; quantum computers do it polynomially because they are themselves quantum systems. May 6, 2026's Q-CTRL + IBM result on materials discovery for the energy sector, run on the IBM Quantum Platform with Q-CTRL's performance-management software, delivered a 3,000x speedup over classical methods — reducing a simulation that took over 100 hours classically down to roughly two minutes.
Outside these families, quantum computers do not provide useful speedup for most workloads. Optimization problems sometimes get modest speedups via quantum annealing or QAOA, but the picture is workload-specific and often not a clear win. Machine learning on quantum computers (QML) is an active research area but no production wins yet. The wide-area claim of 'quantum will revolutionize everything' is marketing; the narrow claim of 'quantum will dominate these four problem families' is the technical truth.
- Shor Polynomial-time factoring + discrete log → breaks RSA, DH, ECC at sufficient scale. The cryptographic threat.
- Grover Quadratic search speedup → halves symmetric key strength. Mitigation: double key length. AES-256 stays safe.
- Simulation Polynomial simulation of quantum systems → chemistry, materials, drug discovery. The clearest commercial application area.
- Optimization Mixed results. Quantum annealing + QAOA give workload-specific speedups, often modest. Not a guaranteed win.
04 Q-day — when does this break my cryptography
A cryptographically-relevant quantum computer (CRQC) is one large enough to run Shor's algorithm against RSA-2048 in a useful amount of time. This requires millions of physical qubits with sufficient error correction to expose thousands of logical qubits — orders of magnitude beyond today's hardware. As of mid-2026, the public roadmaps point to fault-tolerant quantum computing in the late 2020s to mid-2030s, with CRQC scale beyond that.
Harvard's May 4, 2026 research review argues these timelines are faster than the public roadmaps state. Error-correction thresholds are being crossed earlier than planned across multiple modalities (superconducting, neutral atom, ion trap); the gap between logical-qubit demonstrations and CRQC scale is narrowing faster than consensus estimates. The honest summary as of mid-2026: q-day is plausibly in the 2030s, possibly earlier, almost certainly within most enterprise data sensitivity horizons.
The harvest-now-decrypt-later threat means you do not need to wait until q-day to be at risk. Any data encrypted today with RSA or ECC — TLS-encrypted traffic, end-to-end encrypted messaging, signed financial records — could be captured by an adversary, stored, and decrypted when sufficient quantum hardware exists. If your data has a >5-year confidentiality requirement, your migration timeline already passed.
- Q-day estimate (mid-2026) 2030s plausible, possibly earlier. Faster than 2024 consensus per Harvard May 2026 review.
- Mosca's framework If data lifetime + migration time > time to CRQC, you are at risk now. Most enterprises fail this inequality.
- Harvest-now-decrypt-later Adversaries are collecting encrypted traffic today for future decryption. This is an active threat model, not speculation.