Factoring, from Eratosthenes to ShorBig Numbers,
Split
Multiply two big primes: a millisecond. Get them back out of the product: past a certain size, nobody can. Every RSA lock on the web rests on that gap, and the lock on a bitcoin wallet is the same gap in a different coat. This is the history of the gap, who has narrowed it, and what is left of it as of 2026-09-23.
The whole numbers wound into a square spiral, 1 in the middle, and every prime lit. Stanisław Ulam drew it on a scratch pad during a dull talk in 1963. The diagonal streaks are real — primes crowd some quadratic lines and shun others — and nobody has explained them. Drawn here from a sieve, not copied.
If you came about the wallet
Nobody has broken a real key. The largest number ever split by Shor's algorithm on a physical machine is 21, in 2012, with the answer wired into the circuit [44][47]. The largest wallet-style curve key broken on hardware is 15 bits (April 2026), and Bitcoin developers matched that result with random coin flips within a day [95][96]. A wallet key is 256 bits.
The bill keeps falling, on paper. Qubits said to be needed for a 2048-bit RSA key: a billion in 2012, twenty million in 2019, under a million in 2025, under a hundred thousand in February 2026 on a code nobody has built at scale [50][51][58][88]. For a wallet key: under half a million, in minutes, on a fast superconducting machine — Google, March 2026 [91].
The machines are far behind the paper. The biggest have a hundred to a thousand physical qubits, and the best error-corrected count is 48 logical qubits [86][62]. The papers want more than a thousand logical qubits running for hours.
Some coins are more exposed than others. About 30% of all bitcoin sits in outputs whose public key is already visible on the chain — Satoshi-era coins, Taproot, and any address that was used twice [106][104]. A hash-only address that has never spent shows its key only for the ten minutes or so while its transaction waits to be confirmed.
The timelines people put their names to: experts surveyed in 2025 put a 28–49% chance on a one-day RSA-2048 break within ten years; NIST retires RSA-2048 and 256-bit curves after 2030 and bans them after 2035; Google will finish its own move by 2029 [119][64][90]. Bitcoin has proposals and no roadmap [121].
The whole wallet page — which outputs are exposed, what the proposals say, and a lock small enough to see.
The short version
Take two boards and glue them face to face. Anyone can do it, and you cannot tell afterwards where the seam is. Now hand the block to a stranger and ask them to split it back into the two boards. If the block is small they can find the seam by tapping along it. If the block is big enough, tapping takes longer than they have.
A prime is a whole number that nothing divides but 1 and itself. Glue two of them together by multiplying and you get a semiprime. Every RSA key is one: a number of 617 digits that is exactly two primes of about 309 digits each. The public key is the block. The private key is the two boards. The bet the whole web makes is that nobody can find the seam.
Tapping along the block is trial division: try 2, try 3, try 5, and so on up to the square root. For a 20-digit number that is ten billion taps. For a 617-digit number it is a 1 with 308 zeros after it. The methods on this site are the clever ways of tapping, from a Greek librarian's sieve to a 1994 idea that needs a machine that does not exist yet. They shorten the job, a lot. None of them, on any computer built so far, gets through a 2048-bit block.
A wallet key is not a semiprime. It is a hop count on a curve — start at a fixed point, hop k times, show everyone where you landed, keep k. Finding k from the landing spot is the discrete logarithm, and it is hard in the same way and for the same reason, and the same 1994 idea breaks both. That is why a site about factoring is the site for the wallet question.
Where to go
Records
Every general-purpose record since 1991
The table, the chart, and a ruler for how far 2048 bits is from the record.
Now
The ledger to 2026-09-23
40 dated rows since 2024, each with what it does not mean; and a weekly feed nobody has read.
Words
30 terms
Prime, semiprime, discrete logarithm, qubit, soft fork — each in a sentence or two.
Sources
124 numbered
Every citation on the site, with a link.
How to read this site
Every number on these pages comes from one of two places. The computed ones — the count of primes, the
zeta zeros, the cost curve, the worked examples — are produced by tools/compute.py at build
time, and 25 checks run before the site will
publish (0 failing as of 2026-09-23). The historical and recent ones live in data
files with a source on every row, and the source list is one page.
Where a claim reached the press, the claims table gives what was said and what was done, side by side. Where a fact rests on a single secondary source it is marked unconfirmed.
The pictures are computed too: the spiral, the sieve, the strip, the curve. No photograph, no stock.