A five-qubit state-vector simulator you can wire up by hand, Grover's search checked against its closed form, teleportation as six explicit state vectors, a surface code you can break and let the decoder fix, a threshold Monte Carlo, a variational eigensolver on the hydrogen molecule, and a circuit rewrite pass that proves it changed nothing. Every number on the page is computed here, in the browser, when you load it.
A register of n qubits is a unit vector in \mathbb{C}^{2^n}. Wire k owns bit n-1-k of the basis index, so a single-qubit unitary acts on every pair of amplitudes whose indices differ in that bit, and a controlled gate touches only the pairs whose control bits are set. That is the whole simulator: two Float64Arrays and a loop.
|\psi\rangle = \sum_{i=0}^{2^n-1} a_i\,|i\rangle, \qquad \sum_i |a_i|^2 = 1Gate on wire k with stride s = 2^{\,n-1-k}, for every i with bit k clear:
\begin{pmatrix} a_i' \\ a_{i+s}' \end{pmatrix} = \begin{pmatrix} u_{00} & u_{01} \\ u_{10} & u_{11} \end{pmatrix} \begin{pmatrix} a_i \\ a_{i+s} \end{pmatrix}The palette is H, X, Y, Z, S, T, the rotations R_x(\theta), R_y(\theta), R_z(\theta), \mathrm{CNOT}, \mathrm{CZ}, \mathrm{SWAP}, the three-wire \mathrm{CCX} and \mathrm{CCZ}, and a projective measurement:
H = \tfrac{1}{\sqrt 2}\begin{pmatrix} 1 & 1 \\ 1 & -1 \end{pmatrix}, \quad R_z(\theta) = \begin{pmatrix} e^{-i\theta/2} & 0 \\ 0 & e^{i\theta/2} \end{pmatrix}, \quad \mathrm{CNOT} = \begin{pmatrix} 1&0&0&0\\0&1&0&0\\0&0&0&1\\0&0&1&0 \end{pmatrix}Each wire's Bloch vector comes from its reduced density matrix, \rho_k = \mathrm{Tr}_{\bar k}\,|\psi\rangle\langle\psi|, with (x, y, z) = (2\,\mathrm{Re}\,\rho_{01},\, -2\,\mathrm{Im}\,\rho_{01},\, \rho_{00}-\rho_{11}). Its length is 1 for a product state and shrinks as the wire entangles; the Bell pair leaves both wires at the centre of the sphere.
Reading the figure
Load the Bell preset: two nonzero amplitudes, both real and positive, both Bloch vectors at zero length, a histogram that splits between 00 and 11 within sampling noise of a half. Load GHZ on three wires and the same happens with 000 and 111. Load the three-qubit Grover preset and the marked state carries 25/32 of the probability after one iteration, which is the closed-form value the self-check table compares against.
Rotations show the phase colour doing its work: an R_z on a wire in superposition moves the hue of half the bars without moving their height, and a measurement gate collapses the wire on one sampled trajectory; resample to see another one.
The engine and its tests are the same code that runs the Grover, teleportation, transpilation and VQE figures below, so a defect in it would show in all of them at once.
| basis | Re | Im | |a|² | arg |
|---|---|---|---|---|
| |00⟩ | 0.7071 | 0.0000 | 0.5000 | 0° |
| |11⟩ | 0.7071 | 0.0000 | 0.5000 | 0° |
| Bell |00⟩, |11⟩ | 0.5000, 0.5000 | pass |
| GHZ |000⟩, |111⟩ | 0.5000, 0.5000 | pass |
| Grover 3q, k = 1, P(|101⟩) | 0.78125 | pass |
| Oracle + diffusion vs sin²(3θ) | 0.78125 | pass |
| Teleportation, Bob vs |ψ⟩ (12 trajectories) | 1.000000 | pass |
With one marked item among N = 2^n, the uniform superposition makes an angle \theta = \arcsin(1/\sqrt N) with the unmarked subspace, and each oracle-plus-diffusion step rotates the state by 2\theta toward the marked one:
P_k = \sin^2\big((2k+1)\theta\big), \qquad k_{\mathrm{opt}} = \Big\lfloor \frac{\pi}{4\theta} \Big\rceil \approx \frac{\pi}{4}\sqrt NThe figure runs the actual operators on the state vector and plots what it measures over that formula. The agreement is at the level of floating-point rounding, and the curve keeps going past k_{\mathrm{opt}} to show why stopping matters.
The protocol rests on an identity: a message qubit next to a Bell pair can be rewritten in Alice's Bell basis, with Bob's qubit carrying the message up to a Pauli that the Bell label names.
|\psi\rangle \otimes |\Phi^+\rangle = \tfrac12 \sum_{m_0 m_1} |\beta_{m_0 m_1}\rangle \otimes X^{m_1} Z^{m_0} |\psi\rangleAlice's CNOT and Hadamard turn the Bell basis into the computational basis, her measurement picks a branch with probability exactly 1/4, and Bob undoes the Pauli when the two bits arrive. The figure carries the eight complex amplitudes through every step and evaluates Bob's fidelity in each branch.
| basis | Re | Im | |a|² | arg |
|---|---|---|---|---|
| |000⟩ | 0.8144 | -0.2519 | 0.7268 | -17° |
| |001⟩ | 0.4993 | 0.1545 | 0.2732 | 17° |
| m₀m₁ | P | Bob before | fix | F before | F after |
|---|---|---|---|---|---|
| 00 | 0.250 | (0.74, 0.50, 0.45) | I | 1.000 | 1.000000 |
| 01 | 0.250 | (0.74, -0.50, -0.45) | X | 0.541 | 1.000000 |
| 10 | 0.250 | (-0.74, -0.50, 0.45) | Z | 0.206 | 1.000000 |
| 11 | 0.250 | (-0.74, 0.50, -0.45) | XZ | 0.253 | 1.000000 |
A stabilizer code stores one logical qubit in the joint +1 eigenspace of a set of commuting Pauli products. On the rotated surface code those products are the faces of a square lattice,
S_X = \prod_{q \in \square} X_q, \qquad S_Z = \prod_{q \in \square} Z_q, \qquad Z_L = \prod_{\text{row}} Z_q, \quad X_L = \prod_{\text{col}} X_qMeasuring the stabilizers does not disturb the logical state, but an error on a data qubit flips the faces it touches, and a decoder has to guess the most likely error consistent with the pattern of flipped faces. Minimum-weight matching is the standard choice: pair the flipped faces (or pair a face with the boundary) along the shortest paths. Below threshold, longer codes fail less often; the logical error rate of a distance-d code scales roughly as (p/p_{\mathrm{th}})^{(d+1)/2} (Fowler, Mariantoni, Martinis and Cleland, Phys. Rev. A 86, 032324, 2012). The Monte Carlo panel measures that crossing for d = 3 and 5 under the simplest noise model, independent X and Z flips with perfect syndrome measurement; on hardware, Google Quantum AI reported a suppression factor \Lambda = 2.14 \pm 0.02 per distance step from d = 3 to 7 on the Willow processor (Nature 638, 920, 2025).
A variational algorithm prepares a parametrised state on the quantum device, measures the energy, and lets a classical optimiser move the parameters. The energy is a sum of Pauli expectation values, each of which a device measures directly:
E(\theta) = \langle \psi(\theta) | H | \psi(\theta) \rangle = \sum_j c_j\, \langle \psi(\theta) | P_j | \psi(\theta) \rangle, \qquad \frac{\partial E}{\partial \theta_k} = \frac{E(\theta + \tfrac{\pi}{2} e_k) - E(\theta - \tfrac{\pi}{2} e_k)}{2}The second identity is the parameter-shift rule, exact when each parameter enters through a single rotation gate; it turns a gradient into two extra energy evaluations per parameter with no finite-difference error. The figure runs that loop on the two-qubit hydrogen Hamiltonian, one gradient step per animation frame, and draws the exact ground energy from diagonalising the same Hamiltonian as the target.
| P_j | c_j (Ha) | ⟨P_j⟩ | c_j⟨P_j⟩ |
|---|---|---|---|
| II | -1.0523732 | 1.0000 | -1.052373 |
| ZI | 0.3979374 | 0.6896 | 0.274415 |
| IZ | -0.3979374 | 0.6948 | -0.276500 |
| ZZ | -0.0112801 | 0.9941 | -0.011213 |
| XX | 0.1809312 | -0.7190 | -0.130085 |
| E(θ) = Σ c_j⟨P_j⟩ | -1.195756 | ||
| spectrum of H: -1.857, -1.245, -0.883, -0.225 Ha | |||
| nuclear repulsion 1/R: 0.719969 Ha | |||
A transpiler rewrites a circuit into one a device can run: fewer gates, shorter depth, a native gate set, a connectivity the chip has. The rules here are the exact ones, the ones that leave the unitary untouched, and the figure verifies that by running both circuits and comparing the outputs. Build something redundant in the simulator above and send it through; the QFT preset is the counter-example that these three rules cannot shorten.
| inverse cancellation | 8 removed |
| rotation merge | 2 removed, 3 merged |
| CNOT ladder to SWAP | 2 removed, 1 merged |
Shor's algorithm factors integers and takes discrete logarithms in polynomial time on a fault-tolerant machine, which is why RSA and elliptic-curve key exchange have replacements standardised before such a machine exists. NIST published the first three on 13 August 2024: FIPS 203, ML-KEM, a key-encapsulation mechanism derived from CRYSTALS-Kyber; FIPS 204, ML-DSA, a signature scheme derived from CRYSTALS-Dilithium; and FIPS 205, SLH-DSA, the stateless hash-based signature derived from SPHINCS+. The first two rest on the hardness of Module-LWE over structured lattices, the third only on the security of its hash function, which is why its signatures are large and its keys tiny. In March 2025 NIST selected HQC, a code-based scheme, as a second KEM. The parameter sets below are transcribed from the three standards; the security category is NIST's scale where 1, 3 and 5 track AES-128, AES-192 and AES-256 key search.
| standard | parameter set | category | public key | private key | ciphertext / signature | hard problem |
|---|---|---|---|---|---|---|
| FIPS 203 · ML-KEM | ML-KEM-512 | 1 | 800 | 1,632 | 768 ciphertext | Module-LWE |
| FIPS 203 · ML-KEM | ML-KEM-768 | 3 | 1,184 | 2,400 | 1,088 ciphertext | Module-LWE |
| FIPS 203 · ML-KEM | ML-KEM-1024 | 5 | 1,568 | 3,168 | 1,568 ciphertext | Module-LWE |
| FIPS 204 · ML-DSA | ML-DSA-44 | 2 | 1,312 | 2,560 | 2,420 signature | Module-LWE / SIS |
| FIPS 204 · ML-DSA | ML-DSA-65 | 3 | 1,952 | 4,032 | 3,309 signature | Module-LWE / SIS |
| FIPS 204 · ML-DSA | ML-DSA-87 | 5 | 2,592 | 4,896 | 4,627 signature | Module-LWE / SIS |
| FIPS 205 · SLH-DSA | SLH-DSA-128s | 1 | 32 | 64 | 7,856 signature | hash functions |
| FIPS 205 · SLH-DSA | SLH-DSA-128f | 1 | 32 | 64 | 17,088 signature | hash functions |
| FIPS 205 · SLH-DSA | SLH-DSA-192s | 3 | 48 | 96 | 16,224 signature | hash functions |
| FIPS 205 · SLH-DSA | SLH-DSA-192f | 3 | 48 | 96 | 35,664 signature | hash functions |
| FIPS 205 · SLH-DSA | SLH-DSA-256s | 5 | 64 | 128 | 29,792 signature | hash functions |
| FIPS 205 · SLH-DSA | SLH-DSA-256f | 5 | 64 | 128 | 49,856 signature | hash functions |
On this page
Every figure above executes in the visitor's browser: the state-vector and qutrit engines, the surface-code decoder and its Monte Carlo, the Jacobi eigensolver and the parameter-shift loop, the rewrite pass, and the SU(2)k anyon algebra on the ternary page. There is no server behind them and no quantum hardware; they are the reference implementations we use to reason about these algorithms, published as the page itself. The self-check table in the first figure runs on every load.
Three-valued verifier judgements, true, false or abstain, are part of the arbiter lanes in the SOPHIA XT stack today; the ternary page carries the measured routing results and the qutrit and anyon mathematics that direction rests on.
Open problems
The threshold plot uses code-capacity noise with perfect syndrome measurement. Circuit-level noise, where the stabilizer measurements themselves fail and the decoder has to match across rounds in time, lowers the threshold to below one percent and is the next figure to build.
The eigensolver uses exact expectation values. On a device each Pauli term is estimated from shots, and the gradient signal competes with shot noise; the figure does not yet model that.
Five qubits is the limit of a state vector that redraws at animation rate on a phone. Tensor-network or Clifford simulation would extend the reach for structured circuits, and the transpiler needs routing to a fixed coupling graph before it resembles a hardware pass.