Quantum Error Correction Explained: Surface Codes, Logical Qubits

Quantum error correction protects a qubit by spreading its information across many physical qubits, measuring parity checks that reveal errors without revealing the data, and letting a classical decoder undo the most likely errors. It works only below a threshold error rate, roughly 0.5 to 1 percent for surface codes, a line published experiments crossed in December 2024.

That is the whole idea in three sentences. This post goes one level deeper than our overview of how quantum computers work, from the 1995 codes to the 2025 resource estimates, with every figure tied to the paper or government page cited for it. For the security consequences, see quantum computers and cryptography and what a cryptographically relevant quantum computer is.

Key takeaways

• Qubits cannot simply be backed up. They suffer bit flips, phase flips and continuous mixtures of both, measuring them destroys the state, and the no-cloning theorem (Nature, 28 October 1982) rules out copies.
• Shor's 1995 nine qubit code proved correction was possible, and Gottesman's 1997 stabilizer thesis turned the trick into the framework nearly every code now uses.
• A surface code is a grid of repeated parity checks. Code distance d is the smallest number of physical errors that can silently flip the logical qubit; a rotated patch uses 2d² minus 1 qubits, 97 at d = 7.
• The threshold is a phase boundary. Below it, each +2 in distance divides the logical error by a factor Λ; above it, bigger codes are worse. Fowler and colleagues' 2012 model puts it at 0.57 percent per operation.
• Below threshold has been shown for memories. Google Quantum AI's Willow paper (Nature, online 9 December 2024) reported Λ = 2.14 and a distance 7 memory at 0.143 percent error per cycle.
• qLDPC codes promise lower overhead: 12 logical qubits in 288 physical qubits versus nearly 3,000 for surface codes, per a Nature paper of 27 March 2024, at the price of longer range links.
• RSA-2048 estimates keep falling: about a billion physical qubits (2012), 20 million (2019), fewer than a million (May 2025), each under stated assumptions.
• Plan around standards dates, not qubit headlines. NIST published FIPS 203, 204 and 205 on 13 August 2024; its draft IR 8547 proposes disallowing RSA and ECDSA after 2035.

Why do qubits lose information?

A qubit is a single quantum system, one trapped ion, one neutral atom, one superconducting circuit, and its state is a pair of complex amplitudes that must stay coherent with each other. Anything in the environment that couples to it nudges those amplitudes, and every operation adds its own small error.

Decoherence: relaxation and dephasing

Two numbers on every qubit spec sheet describe how fast a qubit forgets.

• Relaxation (T1). An excited qubit in state one gives its energy to the environment and drops to state zero. In computational terms, that is a bit flip that happens preferentially in one direction.
• Dephasing (T2). The relative phase between the zero and one components drifts randomly, because the qubit's frequency jitters with stray fields, temperature or charge noise. The populations stay the same, but the interference that quantum algorithms depend on washes out. In computational terms, that is a phase flip.

A superposition can lose its phase information well before the qubit relaxes. Classical memory has no counterpart to phase errors, which is one reason quantum codes need roughly twice the machinery of classical ones.

Gate, measurement and leakage errors

Even a perfectly isolated qubit would accumulate errors from the operations applied to it.

• Gate errors. A gate is a calibrated pulse of microwaves or laser light. Over-rotations, timing jitter and crosstalk with neighbouring qubits leave the state slightly off target. Two qubit gates are typically several times worse than single qubit gates.
• Measurement errors. Readout can report the wrong value, and on some platforms the act of measuring one qubit disturbs its neighbours.
• Leakage. Many physical qubits have more than two levels. A superconducting transmon can be kicked into its third energy level, which is outside the zero and one space the code assumes. Leakage is dangerous because it can spread through later two qubit gates.
• Correlated errors. Most error correction theory assumes errors are independent. Real hardware has events that hit many qubits at once. Google Quantum AI's 2023 paper reported that a distance 25 repetition code hit a floor of 1.7 × 10⁻⁶ logical error per round set by "a single high-energy event"; its December 2024 paper found repetition codes limited by correlated events "approximately once every hour, or 3 × 10⁹ cycles".

Why not just copy the qubit?

The obvious classical fix for noise is redundancy: store three copies and take a majority vote. Quantum mechanics blocks the obvious version of that in two ways.

First, the no-cloning theorem. William Wootters and Wojciech Zurek showed in a one and a half page letter in Nature (volume 299, published 28 October 1982) that no physical process can take an arbitrary unknown quantum state and produce two independent copies of it. The proof is short: copying would have to be a linear operation, and linearity is incompatible with copying superpositions faithfully.

Second, measurement. To vote, you would have to read the copies, and reading a qubit collapses it to zero or one. The amplitudes, which carry the computation, are gone.

The way around both problems is subtle. You do not copy the state; you entangle it with other qubits so the information is stored in correlations across the group. Then you measure only joint properties of the group, such as "do qubits one and two agree?", which reveal where an error occurred without revealing what the encoded value is. That is the core of every quantum code in this post.

How did Shor's nine qubit code start the field?

Until 1995, many physicists believed large quantum computations were impossible in principle, because errors would accumulate faster than any fix could remove them. Peter Shor, then at AT&T Bell Laboratories, changed that with a short paper titled "Scheme for reducing decoherence in quantum computer memory", published in Physical Review A on 1 October 1995 (volume 52, page R2493). The abstract states the problem plainly: decoherence "destroys the information in a superposition of states contained in a quantum computer, thus making long computations impossible."

The three qubit bit flip code

Start with the simplest building block. Encode a logical zero as three physical zeros and a logical one as three physical ones. A superposition of logical zero and logical one becomes an entangled state of three qubits, not three copies of a superposition. No cloning is involved.

Now measure two parities: does qubit one agree with qubit two, and does qubit two agree with qubit three? Each parity measurement returns a single bit and tells you nothing about whether the logical state is zero or one. Together the two bits, the syndrome, point to the qubit that flipped:

Worked example 1: what the repetition code buys you. Suppose each qubit independently suffers a bit flip with probability p = 0.01 between checks. The code fails only if two or three qubits flip. The failure probability is 3p²(1 minus p) + p³, which simplifies to 3p² minus 2p³. With p = 0.01 that is 3 × 0.0001 minus 2 × 0.000001 = 0.000298, or about 0.03 percent. One unprotected qubit fails 1 percent of the time, so encoding cut the error rate by a factor of about 34. Run the same numbers with p = 0.4 and the code fails 35.2 percent of the time, barely better than the unprotected 40 percent, and at p = 0.5 it fails exactly half the time, no better at all. Above 0.5 the encoded qubit is worse than a bare one. That crossover is the first glimpse of a threshold.

Adding phase protection: nine qubits

The three qubit code does nothing for phase flips. Shor's insight was that a phase flip in the usual basis is a bit flip in the Hadamard rotated basis, so the same repetition idea works for phase if you apply it in that basis. His nine qubit code nests the two: three blocks of three qubits, where each block protects against bit flips and the three blocks together protect against phase flips. The result corrects an arbitrary error, bit flip, phase flip or both, on any single one of the nine qubits.

There is one more step that makes this work for real, continuous errors. When you measure the syndrome, a small rotation on one qubit is projected either to "no error" or to "full flip on that qubit", and the syndrome tells you which. Correcting discrete Pauli errors therefore corrects every error that is a combination of them. This is sometimes called the digitization of errors, and it is why quantum error correction is possible at all.

Steane, CSS and the stabilizer formalism

Within months, the field had general tools. Robert Calderbank and Peter Shor posted "Good Quantum Error-Correcting Codes Exist" on 30 December 1995 (later Physical Review A 54, 1098), showing families of codes with a constant encoding rate exist. Andrew Steane's "Multiple Particle Interference and Quantum Error Correction", posted 29 January 1996 (Proceedings of the Royal Society A 452, 2551), presented a seven qubit code. Codes built this way from two classical codes, one for bit flips and one for phase flips, are now called CSS codes after the three authors.

Daniel Gottesman's Caltech PhD thesis, "Stabilizer Codes and Quantum Error Correction" (arXiv quant-ph/9705052, posted 28 May 1997), gave the framework that almost every later code uses. The idea fits in a paragraph:

• Pick a set of commuting multi qubit Pauli operators, such as Z on qubit 1 times Z on qubit 2. These are the stabilizers.
• The code space is every state that each stabilizer leaves unchanged (eigenvalue +1).
• An error that anticommutes with some stabilizers flips those stabilizers' measured values to −1. The list of flipped stabilizers is the syndrome.
• Logical operators commute with every stabilizer but are not themselves stabilizers. They act on the encoded information. The weight of the smallest logical operator is the code distance.

Codes are written with the notation [[n, k, d]]: n physical qubits, k logical qubits, distance d. A distance d code corrects any (d minus 1)/2 errors, rounded down.

What is a surface code?

The surface code is the stabilizer code most hardware groups have built toward for a decade, because it asks only for what a flat chip can offer: qubits on a square grid, each talking to its four nearest neighbours.

From Kitaev's toric code to a practical planar code

Alexei Kitaev's "Fault-tolerant quantum computation by anyons" (arXiv quant-ph/9707021, posted 9 July 1997, later Annals of Physics 303) introduced codes defined on a lattice where errors behave like particles that appear in pairs. The original version lived on a torus, which is not something you can fabricate. Eric Dennis, Kitaev, Andrew Landahl and John Preskill's "Topological quantum memory" (arXiv quant-ph/0110143, posted 24 October 2001, Journal of Mathematical Physics 43, 4452) analysed these surface codes in depth and found what makes them special: an "order-disorder phase transition" at a nonzero error rate, below which "encoded information can be protected arbitrarily well in the limit of a large code block." Planar versions with boundaries replaced the torus.

Austin Fowler, Matteo Mariantoni, John Martinis and Andrew Cleland's tutorial "Surface codes: Towards practical large-scale quantum computation" (arXiv 1208.0928, posted 4 August 2012, Physical Review A 86, 032324) is the reference most engineers learned from. It estimates the size and speed of a surface code computer, builds stabilizers up from two qubits, shows how logical qubits are formed and moved, and completes a universal gate set with Hadamard, S and T operations.

The layout: data qubits and measure qubits

Picture a d by d checkerboard. The d² data qubits sit at the corners where squares meet; together they hold one logical qubit. Each square, called a plaquette, has a measure qubit in its centre that checks the four data qubits at its corners. Plaquettes alternate between two types:

• Z type checks measure the product of Z on four data qubits. They flip when an odd number of those qubits have suffered a bit flip.
• X type checks measure the product of X on four data qubits. They flip when an odd number have suffered a phase flip.

Along the edges, checks of weight two close off the patch. In the common "rotated" layout there are d² minus 1 measure qubits, so a patch uses 2d² minus 1 physical qubits in all.

Google Quantum AI's December 2024 paper describes its distance 7 memory as a 101 qubit code run on a 105 qubit Willow processor. Full algorithm estimates budget more, because logical qubits need room to move and interact; the section on code breaking machines below gives those figures.

How a syndrome measurement works

One round of error correction, often called a cycle, does the following for every plaquette at once:

1. Reset the measure qubit to zero.
2. For an X type check, rotate the measure qubit with a Hadamard gate.
3. Apply four two qubit CNOT gates between the measure qubit and its four data qubits, in a fixed order chosen so that errors in the middle of the sequence do not spread into a weight two error along the logical direction.
4. For an X type check, rotate back.
5. Measure the measure qubit. The result is the parity of the four data qubits in the Z or X basis.

The data qubits are never measured during the computation. Only the parities are.

A single round of syndromes is not trustworthy, because the measure qubits and the measurements are noisy too. So the code repeats the cycle many times and looks at changes. A detection event is a check whose value differs from the previous round. An isolated data qubit error produces a pair of detection events in space (two adjacent checks change at the same time). A measurement error produces a pair in time (one check changes and changes back). Errors at the boundary produce a single event.

Decoding: from detection events to a correction

The syndrome history goes to a classical decoder, which has to guess the most likely set of physical errors consistent with the detection events. For the surface code, the standard approach treats detection events as points in a three dimensional space time graph and pairs them up with the shortest total path, an algorithm called minimum weight perfect matching. Dennis and colleagues proposed it in 2001; the open source PyMatching library implements it, and the walkthrough below uses it.

Decoding has to keep up. Google Quantum AI's December 2024 paper reports an average decoder latency of 63 microseconds at distance 5, held up to a million cycles, with a cycle time of 1.1 microseconds. If a decoder falls behind, the backlog grows without limit and the computation stalls, which is why decoding hardware is now a research field of its own.

What code distance really means

The code distance is the smallest number of physical errors that forms an undetectable logical error. In a surface code, a logical X operator is a string of X flips running from one boundary of the patch to the opposite one; a logical Z runs across the other way. Any chain of errors shorter than d leaves a detection event somewhere, so the decoder sees it. A chain of d errors stretching boundary to boundary leaves no trace and flips the logical qubit.

What is the threshold theorem, and what physical error rates are needed?

The threshold theorem says that if every physical component fails with probability below some constant threshold, you can make a quantum computation of any length as reliable as you like, at a cost in extra qubits and time that grows only polylogarithmically with the size of the computation.

Where the theorem came from

Three groups proved versions of it within about a year.

• Peter Shor's "Fault-tolerant quantum computation" (arXiv quant-ph/9605011, posted 13 May 1996) showed how to compute on encoded data so a circuit of t gates tolerates error per gate of order 1/(log t)^c. That is fault tolerance with an error budget that still shrinks as computations grow.
• Dorit Aharonov and Michael Ben-Or's "Fault Tolerant Quantum Computation with Constant Error" (arXiv quant-ph/9611025, posted 14 November 1996) removed the shrinking budget using concatenated codes. Their abstract puts their threshold at "about 10^(-6)", and notes the result holds even for nearest neighbour circuits.
• Emanuel Knill, Raymond Laflamme and Wojciech Zurek's "Resilient Quantum Computation: Error Models and Thresholds" (arXiv quant-ph/9702058, posted 26 February 1997) showed "arbitrarily accurate quantum computations are possible provided that the error per operation is below a threshold value", under physically realistic error assumptions.

How the surface code threshold is estimated

The Fowler 2012 tutorial simulated the surface code with every operation failing at rate p, including initialisation, single and two qubit gates, idling and measurement, and found a threshold of p_th = 0.57 percent per step. It notes this is lower than earlier estimates (it cites 0.75 percent for an earlier fully planar analysis) "mostly because we include more types of errors". It then gives an empirical formula for the logical error rate per cycle below threshold:

P_L ≈ 0.03 × (p / p_th)^((d + 1)/2)

Worked example 2: plugging in numbers. Take a physical error rate of 0.1 percent, the figure the main RSA resource estimates assume, so p / p_th = 0.001 / 0.0057 ≈ 0.175.

Each increase of 2 in distance divides the logical error rate by about 5.7 (that is p_th / p, the inverse of 0.175). Now halve the physical error rate to 0.05 percent. At distance 7 the formula gives about 1.8 × 10⁻⁶, sixteen times better than before, because the improvement compounds with the exponent. That is why hardware groups chase small improvements in physical fidelity so hard: a factor of two at the bottom becomes a factor of sixteen at distance 7 and much more at distance 25.

Two cautions. First, the formula is a fit to one noise model; other models give different constants, and Gidney's 2025 estimate uses its own simulations, which say distance 25 reaches 10⁻¹⁵ per round for a normal patch. Second, the formula says nothing about correlated errors, which can set a floor that no amount of distance removes.

Λ: the number to watch in every experiment

Experiments report the suppression factor directly. Λ is the factor by which the logical error per cycle drops when the distance goes up by 2. Λ above 1 means you are below threshold; Λ of 2 means each size step halves the error; Λ of 10 would be spectacular.

Worked example 3: what Λ = 2.14 implies. The December 2024 Willow paper measured Λ = 2.14 and a distance 7 logical error of 0.143 percent per cycle. If Λ stayed exactly at 2.14 as the code grew, the logical error after k further steps would be 0.00143 / 2.14^k.

At Λ = 4 the 10⁻¹² target would need distance 39 (3,041 qubits); at Λ = 10, distance 27 (1,457 qubits). This is the arithmetic behind every roadmap: overhead per logical qubit is set by how far below threshold the hardware sits, and a modest gain in Λ shrinks the machine dramatically. This extrapolation is ours, not the paper's, and it ignores the correlated error floor the same paper reports.

So what physical error rates are needed?

Pulling the sources together:

• To be below threshold at all: below roughly 0.57 percent per operation in Fowler's full noise model for the surface code, and about 0.8 percent in the circuit noise model the 2024 qLDPC paper uses.
• To get useful suppression: well below threshold. Fowler's factoring estimate assumes a rate "approximately one-tenth the threshold rate". The Gidney and Ekerå (2019) and Gidney (2025) RSA estimates assume a uniform 0.1 percent gate error.

What have hardware groups demonstrated below threshold?

All dates below are online publication dates on the journal page, or the arXiv posting date for preprints, as listed under Sources.

Reading these results correctly

A few distinctions decide what each result actually means.

• Memory versus computation. The surface code results above are quantum memories: they store one logical qubit through many rounds of error correction. A computer also needs logical gates between logical qubits, including the expensive non-Clifford T or Toffoli gates.
• Break even. "Beyond break even" means the logical qubit outlives the best physical qubit in the same device. Willow's distance 7 memory reported a factor of 2.4.
• Post-selection. Some experiments discard runs where an error was detected but not corrected. That is error detection, useful for research but not the same as correcting every run. The trapped ion abstract states its range of improvements depends on "the judicious use of post-selection".

None of these is a fault tolerant computer running a long algorithm. They are the first measurements showing the scaling the threshold theorem predicts, in real devices.

What are qLDPC codes, and why are they attracting attention?

The surface code has one big weakness: it encodes one logical qubit per patch, and the patch grows as d². A thousand logical qubits at distance 25 means about 1.35 million physical qubits before you count anything else. Quantum low density parity check (qLDPC) codes aim to do much better.

An LDPC code is one where each check touches only a few qubits and each qubit sits in only a few checks. The surface code qualifies, but qLDPC today usually means codes freed from the flat local layout, which can pack many logical qubits into one block with good distance.

Why theorists got excited

• In October 2013, Daniel Gottesman's "Fault-Tolerant Quantum Computation with Constant Overhead" (arXiv 1310.2984) showed that, in the asymptotic limit, "the ratio of physical qubits to logical qubits can be a constant", using qLDPC codes. Surface codes cannot do that; their ratio grows with the required distance.
• In November 2021, Pavel Panteleev and Gleb Kalachev's "Asymptotically Good Quantum and Locally Testable Classical LDPC Codes" (arXiv 2111.03654) constructed qLDPC code families with constant rate and linear distance, proving what the abstract calls "the qLDPC conjecture."

Why practitioners got excited

On 27 March 2024, Nature published "High-threshold and low-overhead fault-tolerant quantum memory" (volume 627, page 778), by a team led by Sergey Bravyi. It describes a family of codes now often called bivariate bicycle codes, with a full syndrome measurement and decoding protocol. The headline numbers from the abstract:

• A threshold of 0.8 percent under the standard circuit noise model, "on par with the surface code".
• 12 logical qubits preserved for nearly one million syndrome cycles using 288 physical qubits in total, at a physical error rate of 0.1 percent.
• The same protection for 12 logical qubits with the surface code "would require nearly 3000 physical qubits".
• The cost: each qubit must connect to six others, through "two edge-disjoint planar subgraphs", which means some links are long range.

For neutral atoms, which can be physically moved, Qian Xu and colleagues' "Constant-Overhead Fault-Tolerant Quantum Computation with Reconfigurable Atom Arrays" (arXiv 2308.08648, posted 16 August 2023) proposed implementing the non-local checks by rearranging atoms and found their qLDPC architecture "starts to outperform the surface code with as few as several hundred physical qubits" at a 0.1 percent error rate.

The trade-offs

There is a middle path, too. Gidney's 2025 RSA estimate stores idle logical qubits in "yoked surface codes" (arXiv 2312.04522, posted 7 December 2023), which concatenate surface code patches with extra parity checks along rows and columns. That "nearly triple[s]" logical qubits per physical qubit for storage while keeping the nearest neighbour grid.

How many physical qubits per logical qubit would a code breaking machine need?

Breaking 2048 bit RSA with Shor's algorithm is the benchmark everyone uses, because it is concrete and the arithmetic is well understood. The three estimates below are the most cited ones from authors who build surface code architectures. Each states its assumptions; none is a prediction of when such a machine will exist.

How the 2025 number adds up

Gidney's paper lays the machine out in three regions, and the arithmetic is worth reproducing because it shows where the overhead goes:

• Cold storage: 1,280 input logical qubits in yoked surface codes at 430 physical qubits each, which is 550,400 physical qubits.
• Hot storage: 131 logical qubits as normal distance 25 patches at 2 × 26² = 1,352 each, which is 177,112.
• Compute region: a 7 by 18 block of hot patches, 170,352 physical qubits, with room for six magic state factories using "magic state cultivation" (arXiv 2409.17595, posted 26 September 2024).

The total is 897,864. The paper targets a logical error of 10⁻¹⁵ per logical qubit per round, because one 12 hour attempt involves about 6.9 × 10¹³ logical qubit rounds, which gives a 93.3 percent chance that an attempt has no logical error.

Same assumptions as 2019, one twentieth of the qubits. The reduction came from better arithmetic (approximate residue arithmetic published in 2024), denser storage (yoked surface codes) and cheaper magic states (cultivation), not from a change in physics. That is the pattern to expect: algorithmic and architectural gains can move the estimate as much as hardware does.

What those assumptions mean in practice

All three estimates assume a planar grid of qubits with nearest neighbour links, a 1 microsecond surface code cycle and, in the Gidney papers, a 10 microsecond control system reaction time. Compare that with the largest published below threshold surface code: one logical qubit, 101 physical qubits, 0.143 percent logical error per cycle. A machine at Gidney's 2025 estimate needs a logical error rate roughly twelve orders of magnitude lower, on about 1,500 logical qubits at once, running continuously for days. The gap is large, and it is measured in engineering problems (fabrication yield, wiring, cooling, control electronics, decoders, correlated errors), not in a single missing idea.

What does this mean for post-quantum migration timelines?

The honest answer: quantum error correction progress tells you the direction, not the date. Nobody can read a year off a Λ value. What you can do is plan around the dates that are fixed, which are standards and policy dates, and treat error correction milestones as signals for whether to go faster.

The fixed dates

Note that IR 8547 was still an initial public draft when we checked its CSRC page; the comment period closed on 10 January 2025.

Why the timeline starts now, whatever the hardware does

The NIST draft gives the reason directly: "harvest now, decrypt later", in which "adversaries collect encrypted data now with the goal of decrypting it once quantum technology matures." The same draft notes that authentication is different: a signature only has to be secure at the moment it is checked, so key establishment is the urgent part and signatures can follow on their own schedule.

So the practical reading of the error correction literature is:

1. Key exchange first. Data you encrypt today with RSA or elliptic curve key exchange is exposed to anyone who records it and later gets a large enough machine. Hybrid ML-KEM key exchange is already the default in current OpenSSL and OpenSSH, so much of this is an upgrade and configuration job.
2. Signatures on a planned schedule. Code signing, certificates and firmware signing roots have long lifetimes. Those need inventory now and migration well before 2035.
3. Watch three numbers in new papers. Logical error per cycle, Λ across at least two distances, and the number of logical qubits operated together with logical gates between them. A jump in any of those, or a resource estimate that falls again, is a reason to move your own milestones earlier.

For the cryptography details, including what Grover's algorithm does and does not do to symmetric keys, see does quantum computing break AES-256.

Step by step: simulate a surface code on your laptop

Reading about thresholds is one thing; watching the logical error rate fall as distance grows is another. Stim, a fast stabilizer circuit simulator, and PyMatching, a minimum weight perfect matching decoder, are both open source Python packages that let you reproduce the shape of the threshold curve in a few minutes. This is a classical simulation of a noise model, not a quantum computer.

1. Create an isolated, pinned environment

Research environments tend to accumulate packages. Start clean, pin versions and record what you installed.

python3 -m venv qec-env
source qec-env/bin/activate
python -m pip install --upgrade pip
python -m pip install "stim==1.16.0" "pymatching==2.4.0" numpy
python -m pip freeze > requirements.lock.txt

Those were the current releases on PyPI when we ran this (stim 1.16.0 and PyMatching 2.4.0, both Apache 2.0 licensed); check PyPI for newer ones. Commit requirements.lock.txt so a colleague gets the same versions. For stricter installs, generate hashes and install with pip install --require-hashes -r requirements.lock.txt.

2. Generate a noisy surface code memory circuit

Stim can generate a standard rotated surface code memory experiment with a uniform noise model on every operation.

import stim

def surface_code_circuit(distance: int, p: float) -> stim.Circuit:
    return stim.Circuit.generated(
        "surface_code:rotated_memory_z",
        distance=distance,
        rounds=distance,
        after_clifford_depolarization=p,
        before_round_data_depolarization=p,
        before_measure_flip_probability=p,
        after_reset_flip_probability=p,
    )

c = surface_code_circuit(3, 0.001)
print(c.num_qubits, c.num_detectors, c.num_observables)

On our run this printed 26 24 1. Stim numbers qubits by their grid coordinates, so the first figure is the highest index used plus one, not the 17 qubits a distance 3 patch needs; the 24 detectors and 1 logical observable are the numbers that matter. The circuit resets the qubits, runs d rounds of X and Z checks, measures the data qubits and declares detectors (comparisons between consecutive syndrome values) and one logical observable.

3. Build the decoder and sample shots

import numpy as np
import pymatching

def logical_error_rate(distance: int, p: float, shots: int = 100_000) -> float:
    circuit = surface_code_circuit(distance, p)
    dem = circuit.detector_error_model(decompose_errors=True)
    matcher = pymatching.Matching.from_detector_error_model(dem)
    sampler = circuit.compile_detector_sampler()
    detections, observables = sampler.sample(shots, separate_observables=True)
    predictions = matcher.decode_batch(detections)
    errors = np.sum(np.any(predictions != observables, axis=1))
    return errors / shots

The detector error model is Stim's description of which physical faults flip which detectors. PyMatching turns it into a matching graph, decodes every shot, and you count how often the decoder's guess for the logical observable is wrong.

4. Sweep distance and physical error rate

for p in (0.001, 0.003, 0.005, 0.008, 0.012):
    rates = [logical_error_rate(d, p) for d in (3, 5, 7)]
    print(f"p={p:.3f}  " + "  ".join(f"d{d}={r:.2e}" for d, r in zip((3, 5, 7), rates)))

5. Read the result

We ran exactly this code with 100,000 shots per point on a laptop (about 13 seconds in total). Each number is the fraction of shots where the logical qubit was wrong after d rounds of error correction:

Your numbers will differ slightly because sampling is random, and with 100,000 shots the d = 7 figure at 0.1 percent rests on about 30 failures, so treat it as approximate. The crossover in this run sits between 0.5 and 0.8 percent, consistent with the 0.57 percent Fowler and colleagues report for a similar full circuit noise model. The rows also show why a Λ of about 2, the value the Willow experiment reached, corresponds to hardware that is below threshold but not far below it: in this simulation a Λ near 2 appears around 0.3 percent noise.

Step by step: check where your own stack stands on post-quantum key exchange

The second walkthrough is the practical one for security teams. These commands are read only.

1. Check your OpenSSL version and its post-quantum algorithms

openssl version
openssl list -kem-algorithms
openssl list -tls-groups | tr ':' '\n' | grep -i mlkem

OpenSSL 3.5.0 and later list ML-KEM among the key encapsulation mechanisms and offer hybrid groups such as X25519MLKEM768 for TLS. Older versions return nothing for the grep.

2. Check what a server negotiates

openssl s_client -connect example.com:443 -groups X25519MLKEM768 -brief </dev/null

Replace example.com with a host you operate. If the handshake succeeds and reports the hybrid group, the server supports it. If it fails, the server or a middlebox in front of it does not.

3. Check SSH

ssh -V
ssh -Q kex | grep -i mlkem

OpenSSH 10.0 and later use mlkem768x25519-sha256 by default. On servers, check the effective configuration with sudo sshd -T | grep -i kexalgorithms.

4. Find every copy of every crypto library you ship

The hard part of migration is rarely the algorithm; it is finding the dozens of places a crypto library is bundled: language runtimes, container base images, vendored copies, mobile apps and appliances. A software bill of materials (SBOM) for each repository and image lists those libraries and their versions, so you can see which builds still carry a pre-3.5 OpenSSL or an old language level crypto package. The next section covers the Safeguard side of that honestly.

Common mistakes

• Treating physical qubit counts as capability. A chip with a thousand physical qubits might hold zero useful logical qubits. Ask for logical qubits and logical error rates.
• Quoting a threshold without its noise model. "The surface code threshold is 1 percent" is a slogan. Fowler's full circuit model gives 0.57 percent; other models give other numbers. The decoder and the circuit matter.
• Assuming below threshold means fault tolerant. Below threshold memories prove the scaling works. Fault tolerant computation also needs logical gates, magic states, fast decoding and many logical qubits at once.
• Using a resource estimate as a forecast. Gidney's under a million qubit figure is a cost under stated assumptions, not a date. Its own abstract frames it as input for "planning the transition to quantum-safe cryptosystems".
• Delaying key exchange migration because signatures are harder. NIST's draft separates the two for a reason. Key establishment carries the harvest now risk; it is also the easier part.
• Upgrading the library but not the defaults. A system can ship OpenSSL 3.5 and still pin an old TLS groups list in configuration. Test the handshake, not just the version string.

FAQ

What is quantum error correction in simple terms?

It stores one qubit's worth of information across many physical qubits in an entangled pattern, repeatedly measures parity checks that reveal errors but not the data, and uses a classical decoder to undo the most likely errors. It works only if the hardware's error rate is below a threshold.

What is the difference between a physical qubit and a logical qubit?

A physical qubit is one hardware element, such as an ion or a superconducting circuit, with its own error rate. A logical qubit is an encoded qubit made of many physical qubits plus repeated measurement and decoding. Logical qubits are what an algorithm actually uses.

How many physical qubits make one logical qubit?

It depends on the code, the physical error rate and the target logical error rate. A rotated surface code patch uses 2d² minus 1 qubits: 97 at distance 7. Published RSA estimates budget about 1,352 to 1,568 per logical qubit for active surface code patches at distances 25 to 27, or 430 using yoked storage, and Fowler's 2012 paper used about 14,500.

What is the surface code threshold?

It is the physical error rate below which making the surface code bigger lowers the logical error rate. Fowler and colleagues' 2012 model puts it at 0.57 percent per operation; other noise models and decoders give values around 0.5 to 1 percent.

Did Google achieve quantum error correction below threshold?

Google Quantum AI reported surface code memories below threshold in Nature, published online 9 December 2024, with a suppression factor of 2.14 per distance step and a distance 7 memory that outlived its best physical qubit. It was a memory experiment, not a fault tolerant computation.

What are qLDPC codes?

Quantum low density parity check codes are stabilizer codes whose checks each touch a few qubits but are not restricted to a flat local layout. They can hold many logical qubits per block; one 2024 Nature paper reports 12 logical qubits in 288 physical qubits.

How many qubits are needed to break RSA-2048?

The most recent widely cited estimate, Gidney's May 2025 preprint, puts it at fewer than a million noisy physical qubits running for under a week, assuming 0.1 percent gate errors and a 1 microsecond cycle. Earlier estimates were 20 million (2019) and about a billion (2012).

Should I wait for quantum error correction to mature before migrating to post-quantum cryptography?

No. NIST's standards are final, its draft transition report proposes disallowing RSA and ECDSA after 2035, and the "harvest now, decrypt later" risk applies to data encrypted today. Start with key exchange, which current OpenSSL and OpenSSH already support.

Where Safeguard fits

Safeguard does not build quantum hardware, model qubits or run error correction, and its models are single purpose security models, not physics tools. The fit is indirect and sits in the software around this topic. Post-quantum migration is mostly an inventory and upgrade problem: knowing which repositories and container images carry which versions of OpenSSL, language level crypto packages and TLS libraries, and moving them forward. Safeguard scans repositories, container images and SBOM files (safeguard scan --dir ., --image IMAGE, --sbom FILE, with JSON results under ./output), shows which projects contain a given component and version, matches components against vulnerability databases, and can open fix pull requests through autonomous remediation, which ships switched off. It does not discover cryptographic algorithm usage inside your code or negotiate TLS for you; the handshake tests above remain your job.

Fix it without waiting for upstream

A post-quantum migration means upgrading crypto libraries across every build you ship, and each upgrade pulls dependencies again, so it is also a moment when old vulnerable versions can slip back in. Simulation and research stacks are open source too, which makes the usual dependency hygiene below relevant even though Safeguard has no role in the physics.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

To try it on your own machine, download Safeguard from https://safeguard.sh/download and see the CLI documentation at https://docs.safeguard.sh/docs/cli .

The first demo sets up Safeguard's local runner on your own machine, approves it with its device code, and runs a scan from the terminal. Pointed at a service repository or a research environment like the one in the walkthrough, the same flow lists the crypto and numerical packages it found and their versions, which is the first step of a migration inventory.

Click through it at your own pace, or open it full screen.

The second demo is a real Safeguard CLI session: asked to fix a lodash CVE, it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, prints a summary and pushes nothing. The same approve each step flow fits a crypto library upgrade, where you want tests to run before anything changes.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. That lets you ask which projects still carry a given OpenSSL version while controlling what the assistant can touch.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Wootters and Zurek, A single quantum cannot be cloned, Nature 299, 802 (28 October 1982)
• Shor, Scheme for reducing decoherence in quantum computer memory, Physical Review A 52, R2493 (1 October 1995)
• Calderbank and Shor, Good Quantum Error-Correcting Codes Exist, arXiv quant-ph/9512032
• Steane, Multiple Particle Interference and Quantum Error Correction, arXiv quant-ph/9601029
• Shor, Fault-tolerant quantum computation, arXiv quant-ph/9605011
• Aharonov and Ben-Or, Fault Tolerant Quantum Computation with Constant Error, arXiv quant-ph/9611025
• Knill, Laflamme and Zurek, Resilient Quantum Computation: Error Models and Thresholds, arXiv quant-ph/9702058
• Gottesman, Stabilizer Codes and Quantum Error Correction (PhD thesis), arXiv quant-ph/9705052
• Kitaev, Fault-tolerant quantum computation by anyons, arXiv quant-ph/9707021
• Dennis, Kitaev, Landahl and Preskill, Topological quantum memory, arXiv quant-ph/0110143
• Fowler, Mariantoni, Martinis and Cleland, Surface codes: Towards practical large-scale quantum computation, arXiv 1208.0928 (Physical Review A 86, 032324)
• Gottesman, Fault-Tolerant Quantum Computation with Constant Overhead, arXiv 1310.2984
• Panteleev and Kalachev, Asymptotically Good Quantum and Locally Testable Classical LDPC Codes, arXiv 2111.03654
• Google Quantum AI, Suppressing quantum errors by scaling a surface code logical qubit, Nature 614, 676 (2023)
• Google Quantum AI, Suppressing quantum errors by scaling a surface code logical qubit, arXiv 2207.06431
• Bluvstein et al., Logical quantum processor based on reconfigurable atom arrays, Nature 626, 58 (online 6 December 2023)
• Xu et al., Constant-Overhead Fault-Tolerant Quantum Computation with Reconfigurable Atom Arrays, arXiv 2308.08648
• Bravyi et al., High-threshold and low-overhead fault-tolerant quantum memory, Nature 627, 778 (27 March 2024)
• Demonstration of logical qubits and repeated error correction with better-than-physical error rates, arXiv 2404.02280
• Google Quantum AI and Collaborators, Quantum error correction below the surface code threshold, Nature 638, 920 (online 9 December 2024)
• Quantum error correction below the surface code threshold, arXiv 2408.13687
• Hardware-efficient quantum error correction via concatenated bosonic qubits, Nature 638, 927 (online 26 February 2025)
• Scaling and logic in the color code on a superconducting quantum processor, arXiv 2412.14256 (Nature 645, 614)
• Gidney, Newman, Brooks and Jones, Yoked surface codes, arXiv 2312.04522
• Gidney, Shutty and Jones, Magic state cultivation, arXiv 2409.17595
• Gidney and Ekerå, How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits, arXiv 1905.09749 (Quantum 5, 433, 2021)
• Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv 2505.15917
• NIST CSRC: Post-Quantum Cryptography project
• NIST: NIST Releases First 3 Finalized Post-Quantum Encryption Standards (13 August 2024)
• NIST: NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption (11 March 2025)
• NIST IR 8547 (Initial Public Draft), Transition to Post-Quantum Cryptography Standards
• NIST IR 8547 ipd PDF
• OpenSSL 3.5 release notes
• OpenSSL 3.5 manual: openssl-list
• OpenSSH release notes
• PyPI: stim
• PyPI: PyMatching

Last reviewed: 23 October 2026.