**Shor’s algorithm**, named after mathematician Peter Shor, is a quantum algorithm (an algorithm that runs on a quantum computer) for integer factorization formulated in 1994. Informally it solves the following problem: given an integer *N*, find its prime factors.

On a quantum computer, to factor an integer *N*, Shor’s algorithm runs in polynomial time (the time taken is polynomial in log *N*, which is the size of the input). Specifically it takes quantum gates of order O((log *N*)^{2}(log log *N*)(log log log *N*)) using fast multiplication, demonstrating that the integer factorization problem can be efficiently solved on a quantum computer and is thus in the complexity class **BQP**. This is substantially faster than the most efficient known classical factoring algorithm, the general number field sieve, which works in sub-exponential time – about O(e^{1.9 (log N)1/3 (log log N)2/3}). The efficiency of Shor’s algorithm is due to the efficiency of the quantum Fourier transform, and modular exponentiation by repeated squarings.

If a quantum computer with a sufficient number of qubits could operate without succumbing to noise and other quantum decoherence phenomena, Shor’s algorithm could be used to break public-key cryptography schemes such as the widely used RSA scheme. RSA is based on the assumption that factoring large numbers is computationally intractable. So far as is known, this assumption is valid for classical (non-quantum) computers; no classical algorithm is known that can factor in polynomial time. However, Shor’s algorithm shows that factoring is efficient on an ideal quantum computer, so it may be feasible to defeat RSA by constructing a large quantum computer. It was also a powerful motivator for the design and construction of quantum computers and for the study of new quantum computer algorithms. It has also facilitated research on new cryptosystems that are secure from quantum computers, collectively called post-quantum cryptography.

In 2001, Shor’s algorithm was demonstrated by a group at IBM, who factored 15 into 3 × 5, using an NMR implementation of a quantum computer with 7 qubits. After IBM’s implementation, two independent groups implemented Shor’s algorithm using photonic qubits, emphasizing that multi-qubit entanglement was observed when running the Shor’s algorithm circuits. In 2012, the factorization of 15 was performed with solid-state qubits. Also in 2012, the factorization of 21 was achieved, setting the record for the largest number factored with Shor’s algorithm. In April 2012, the factorization of 143 was achieved, although this used adiabatic quantum computation rather than Shor’s algorithm. In November 2014, it was discovered that this 2012 adiabatic quantum computation had also factored larger numbers, the largest being 56153.