1991 to this monthRecords

Every general-purpose factoring record since the RSA challenge list was published, the curve they sit on, and a ruler for how far a 2048-bit key is from the biggest number anyone has split.

A line chart of factoring records in bits against year, rising from 330 bits in 1991 to 896 in 2026, with dashed lines at 512, 1024 and 2048. — Bits in the record number against the year. The 2026 pair are the first records set on GPUs and the first set with the help of AI coding agents; both authors said the mathematics did not change [99][101].

number	digits	bits	date	who	method	effort
RSA-100	100	330	1991-04-01	Arjen Lenstra	MPQS	a few days on a MasPar [29]
RSA-110	110	364	1992-04-14	Arjen Lenstra and Mark Manasse	MPQS	about a month [29]
RSA-120	120	397	1993-06-09	Denny, Dodson, Lenstra, Manasse	MPQS	about 830 MIPS-years [29]
RSA-129	129	426	1994-04-26	Atkins, Graff, Lenstra, Leyland and about 600 volunteers	MPQS	about 5,000 MIPS-years over eight months [23]
RSA-130	130	430	1996-04-10	Lenstra and others	GNFS	about 1,000 MIPS-years — the first RSA number by the number field sieve [29]
RSA-140	140	463	1999-02-02	te Riele and others (CWI)	GNFS	about 2,000 MIPS-years [29]
RSA-155	155	512	1999-08-22	Cavallar and seventeen others	GNFS	about 8,000 MIPS-years, seven months [24]
RSA-160	160	530	2003-04-01	Franke, Kleinjung and others (Bonn)	GNFS	a few months on a cluster [29]
RSA-576	174	576	2003-12-03	Franke, Kleinjung and others	GNFS	months on a cluster [29]
RSA-640	193	640	2005-11-02	Bahr, Boehm, Franke, Kleinjung	GNFS	about 30 years of a 2.2 GHz Opteron [29]
RSA-200	200	663	2005-05-09	Bahr, Boehm, Franke, Kleinjung	GNFS	about 55 years of a 2.2 GHz Opteron [29]
RSA-768	232	768	2009-12-12	Kleinjung and twelve others	GNFS	about 2,000 years of a 2.2 GHz Opteron core [25]
RSA-240	240	795	2019-12-02	Boudot, Gaudry, Guillevic, Heninger, Thomé, Zimmermann	GNFS (CADO-NFS)	about 900 core-years of a 2.1 GHz Xeon Gold 6130 [26]
RSA-250	250	829	2020-02-28	Boudot, Gaudry, Guillevic, Heninger, Thomé, Zimmermann	GNFS (CADO-NFS)	about 2,700 core-years of a 2.1 GHz Xeon Gold 6130 [27][26]
RSA-260	260	862	2026-09-03	Eric Lu (Cognition)	GNFS (CADO-NFS on GPUs)	4,923 GPU-days on B200-class GPUs, about 16 days elapsed, about $400k at list prices [99]
RSA-896	270	896	2026-09-19	Stephen Weis (Anthropic)	GNFS (CADO-NFS on GPUs)	about 30 GPU-years on up to 2,048 idle GPUs over ten days [101]
still open
RSA-270	270	895	270 digits, still open in the challenge list — RSA-896 (also 270 digits) was the one that fell [29]
RSA-1024	309	1024	the key size most of the web used until about 2013; still open [29]
RSA-2048	617	2048	the key size most of the web uses now; still open [29]
special form — a different, easier sieve; not comparable
2^1061 − 1	320	1061	2012-08-04	NFS@Home	SNFS	the special number field sieve works on numbers of a special form; the record for those is bigger, and says nothing about RSA keys [102]
Seventeen Mersenne numbers 2^n − 1, 1007 ≤ n ≤ 1199	361	1199	2014-08	Kleinjung, Bos, Lenstra	SNFS, shared sieving	the 'Mersenne factorization factory' — one sieving pass amortised across many numbers [102]

The two 2026 rows are not on the RSA challenge list's own cadence: RSA-260 was the next unsolved challenge number; RSA-896 was a 270-digit challenge number picked because it was a round number of bits. Effort units change with the era — MIPS-years, Opteron-years, Xeon core-years, GPU-years — and are not convertible without a footnote; the sources give each team's own figure.

The curve

The number field sieve's running time has a known shape [22]:

L(N) = exp( c · (ln N)^1/3 · (ln ln N)^2/3 ), c = (64/9)^1/3 ≈ 1.923

Reading it: not exponential in the number of bits (that would be 2 to the bits), and not a fixed power of the bits either; in between, with the 1/3 doing the work. Constants and lower-order terms are missing, which is why this is a ruler and not a forecast.

Anchor it on RSA-250 — 2,700 core-years for 829 bits [27] — and read off the rest:

bits	digits	times RSA-250	core-years, scaled	in words
512	155	2.67e-05	0.0721	about 26 days of one core
768	232	0.164	442	about 442 core-years — a big cluster for a year
829	250	1	2.7e+03	about 2,700 core-years — a big cluster for a year
1024	309	200	5.4e+05	about 540,014 core-years — every core in a large data centre for years
1536	463	1.99e+07	5.38e+10	5.4e+10 core-years — more computing than has been done on Earth
2048	617	2.33e+11	6.29e+14	6.3e+14 core-years — more computing than has been done on Earth
3072	925	8.82e+17	2.38e+21	2.4e+21 core-years — more computing than has been done on Earth
4096	1234	1.96e+23	5.29e+26	5.3e+26 core-years — more computing than has been done on Earth

A curve rising steeply from left to right: the estimated core-years to factor a key against its size in bits, marked at 512, 768, 1024, 2048 and 4096. — The same curve drawn. The RSA-768 team said 1024 bits was about a thousand times harder than 768; the ruler here says 1221×, which is the same order. The 2026 GPU runs do not move the curve; they move the price of a core-year.

The ruler

key size 2048 bits

What the 2026 records changed

Two things, and neither is the mathematics. Eric Lu's RSA-260 run in early September and Stephen Weis's RSA-896 run two weeks later both ported CADO-NFS to data-centre GPUs, with AI coding agents doing much of the port [99][101]. Weis's ran as a low-priority job on idle machines: about thirty GPU-years in ten days, at no marginal cost to anyone. His own conclusion: the running time of the sieve did not improve, deployed 2048-bit keys are not affected — and a 1024-bit key is now within reach of anyone with a large GPU fleet and a slow month. Old keys do not retire themselves; in 2015 a 512-bit key cost $75 of cloud time to break and hundreds were still in use [32].