The algorithms that actually matter — what each one does, the speedup it really gives (not the headline), and whether it runs on today's hardware or waits for error correction. Every entry routes you to a full tutorial, the original paper, or a glossary definition.
A quantum algorithm is a recipe of gates that uses superposition and interference to reach an answer with fewer steps than a classical computer would need — for a specific problem. The catch is that "fewer steps" almost never means what the headlines imply. Most quoted speedups are asymptotic gate counts that ignore two brutal practical costs: getting classical data into the machine, and reading a useful answer back out.
The single most important distinction is the hardware era. The exponential-speedup algorithms — Shor's, phase estimation, HHL — need fault-tolerant, error-corrected qubits that today's NISQ devices do not have. The algorithms that do run now — VQE, QAOA — are variational heuristics with no proven advantage and a barren-plateau problem. So far, no quantum algorithm has beaten the best classical method on a useful, real-world task — practical quantum advantage is still ahead of us.
Each card below states the caveat plainly under "The catch". That is the part competitor overviews leave out.
Last verified: 2026-07-19 — the field moves; speedup claims and hardware timelines change.
Category:
Shor's algorithm
Cryptography & factoring
Fault-tolerant era
Factors large integers and computes discrete logarithms in polynomial time.
Speedup
Exponential (fault-tolerant only)
Reduces integer factoring to finding the period of a modular-exponentiation function, then extracts that period with quantum phase estimation over the Quantum Fourier Transform. Because factoring and discrete logarithms underpin RSA and elliptic-curve cryptography, an at-scale Shor's algorithm would break most of today's public-key encryption.
The catch
It is an exponential speedup only on paper today. Factoring RSA-2048 needs on the order of thousands of logical qubits and billions of gates — millions of noisy physical qubits after error correction — and no device is within orders of magnitude of that. The threat is real for stored data (harvest-now-decrypt-later), not imminent.
Where it's used
Breaking RSA and elliptic-curve public-key cryptography (at scale)
Motivating the migration to post-quantum cryptography
Finds a marked item in an unstructured search space with quadratically fewer queries.
Speedup
Quadratic
Given an oracle that recognises a solution, Grover's rotates the state toward the marked item using amplitude amplification, finding it in roughly (π/4)√N oracle calls instead of the classical ~N/2. For N = 1,000,000 that is about 785 queries versus 500,000.
The catch
Quadratic, not exponential — and the popular 'search a database' framing is misleading. You need an oracle that computes the test on a superposition, not a stored table; if your problem has any exploitable structure (sorting, indexing, a gradient), classical algorithms use it and beat Grover. On real hardware the √N advantage is easily erased by the cost of running the oracle under error correction.
Where it's used
Unstructured search where only a checker function is available
Speeding up brute-force sub-routines inside larger algorithms
Halving the effective key length of symmetric ciphers (informs AES-256 choices)
Given a unitary U and one of its eigenstates, QPE reads out the corresponding eigenphase θ to n bits of precision using phase kickback and an inverse QFT. Enormous numbers of questions are secretly eigenvalue questions — molecular ground-state energies, the order of a mod N — which is why QPE sits underneath Shor's factoring and quantum chemistry.
The catch
You must already have the eigenstate, or a state with good overlap with it, and preparing one is often the hard part (in chemistry it is frequently the binding constraint). The controlled-unitary powers and inverse QFT need deep, coherent circuits — this is squarely a fault-tolerant algorithm, not a NISQ one.
Where it's used
The readout engine inside Shor's algorithm (order finding)
Molecular and materials ground-state energy estimation
Moves information from computational-basis amplitudes into phases in O(n²) gates.
Speedup
None on its own
The QFT applies the discrete Fourier transform to the 2ⁿ amplitudes of an n-qubit state using only O(n²) gates, versus O(n·2ⁿ) for a classical FFT. It is the single most important subroutine in quantum computing — the engine inside Shor's, phase estimation and order finding.
The catch
That O(n²)-vs-O(n·2ⁿ) gap is not a usable speedup. You cannot load 2ⁿ arbitrary amplitudes in cheaply, and you cannot read the Fourier coefficients out — measuring a transformed state gives a uniformly random bitstring. The QFT is only useful in the middle of a larger algorithm that converts a hidden periodicity into a peak you can actually sample.
Where it's used
A subroutine inside Shor's algorithm and phase estimation
Order and period finding
Any algorithm that turns a hidden periodicity into a measurable signal
A hybrid quantum-classical loop that estimates a Hamiltonian's ground-state energy.
Speedup
Heuristic — no proven advantage
VQE prepares a parameterised trial state on the QPU, measures the energy ⟨ψ(θ)|H|ψ(θ)⟩, and lets a classical optimizer tune θ downward. The variational principle guarantees the result is an upper bound on the true ground-state energy, and the shallow circuits are designed to tolerate NISQ noise.
The catch
No proven speedup, and two hard obstacles in practice: barren plateaus, where gradients vanish exponentially as the circuit grows, and the enormous number of measurement shots needed to resolve chemical accuracy. VQE runs on today's hardware but has not demonstrated a clear advantage over classical methods on any useful problem.
Where it's used
Small-molecule ground-state energy (H₂ is the classic benchmark)
A variational algorithm that searches for good approximate solutions to combinatorial problems.
Speedup
Heuristic — no proven advantage
QAOA alternates a problem unitary that encodes a cost function with a mixer unitary, over p layers, and a classical optimizer tunes the 2p angles to maximise the expected objective. It maps cleanly onto NISQ hardware and is a genuine candidate for near-term advantage on problems like Max-Cut.
The catch
'Candidate' is the honest word — there is no proven advantage. Low-depth QAOA is matched or beaten by strong classical heuristics, useful depth demands more coherence than NISQ devices have, and it shares VQE's barren-plateau and optimization-hardness problems.
Where it's used
Max-Cut and other graph-partitioning problems
Portfolio, scheduling and routing formulated as QUBO/Ising problems
Benchmarking NISQ devices on optimization workloads
Prepares a quantum state proportional to the solution of a linear system Ax = b.
Speedup
Exponential — but only under heavy conditions
HHL (Harrow, Hassidim, Lloyd) uses phase estimation to invert the eigenvalues of a matrix A, producing a quantum state proportional to the solution x of Ax = b in time that scales polynomially in the number of qubits — exponentially better than classical solvers on paper.
The catch
The famous 'exponential speedup' comes with caveats that usually erase it. You need efficient loading of b into a quantum state, A must be sparse and well-conditioned (runtime scales with the condition number), and you get a quantum state, not the vector x — reading out all its entries costs exponentially, so it only helps when you want a single summary statistic. Same data-loading and readout traps as quantum machine learning.
Where it's used
Estimating a scalar functional of a linear-system solution (not the full vector)
Subroutines in some quantum machine-learning proposals
Differential-equation solvers built on quantum linear algebra
No deep dive on this one yet — the summary above is the honest short version.
Deutsch-Jozsa algorithm
Building blocks
NISQ-friendly
Decides whether a hidden function is constant or balanced in a single query.
Speedup
Exponential (query complexity, no practical use)
Given a promise that a black-box function is either constant or balanced, Deutsch-Jozsa answers which in exactly one query by evaluating it on a superposition of all inputs and using interference to cancel the wrong possibilities. Any deterministic classical algorithm may need exponentially many queries in the worst case.
The catch
The problem is artificial and has no practical use — a randomised classical algorithm solves it in a few queries with tiny error. Its importance is historical and pedagogical: it was the first ironclad proof that quantum computers are asymptotically more powerful for some tasks, setting the template Shor and Grover followed.
Where it's used
Teaching quantum parallelism, interference and phase kickback
The first proven quantum-classical separation
A stepping stone to Simon's and Shor's period-finding algorithms
Estimates the probability of a marked outcome quadratically faster than sampling.
Speedup
Quadratic
QAE generalises Grover's amplitude amplification: it runs phase estimation on the Grover operator to read out the amplitude of a marked subspace. To estimate a probability to precision ε it uses about 1/ε operations, against the 1/ε² samples classical Monte Carlo needs — a quadratic speedup for estimating expected values.
The catch
The quadratic gain assumes you can build the quantum circuit that loads the probability distribution and computes the quantity efficiently — often the hard part — and canonical QAE needs deep, coherent phase-estimation circuits that put it in the fault-tolerant era. Recent 'amplitude-estimation-without-phase-estimation' variants trade depth for more repetitions to soften this.
Where it's used
Monte Carlo estimation in finance (option pricing, risk / VaR)
Quantum counting — how many items an oracle marks
Any expectation-value estimate built on amplitude amplification
No deep dive on this one yet — the summary above is the honest short version.
The honest comparison table
The same nine algorithms at a glance. "Status" is our plain-English read on whether the speedup is real and usable today — not a marketing label.
Honest answers to what people actually ask about quantum algorithms.
Which quantum algorithm should I learn first?
Grover's algorithm. It is the most approachable — you can build a working version in about forty lines of Qiskit — and it teaches amplitude amplification, the idea behind several other algorithms. After that, learn the Quantum Fourier Transform and phase estimation together, because they unlock Shor's algorithm and quantum chemistry.
Do any quantum algorithms beat classical computers today?
Not on a useful task. Experiments have shown 'quantum advantage' on contrived sampling problems chosen to be hard for classical machines, but no quantum algorithm has yet outperformed the best classical method on a real-world problem people care about. The exponential-speedup algorithms need fault-tolerant hardware that does not exist yet, and the NISQ-era ones (VQE, QAOA) have not demonstrated a clear win.
Is Grover's algorithm exponentially faster?
No. Grover's gives a quadratic speedup — roughly √N versus N — not an exponential one. It also is not a database search: it needs an oracle that recognises a solution, and if your data has any structure a classical algorithm can exploit, classical wins. Only Shor's, phase estimation and HHL offer exponential speedups, and those require fault-tolerant hardware.
Does HHL really give an exponential speedup for linear systems?
Only under conditions that usually erase it. HHL needs your input vector loaded efficiently into a quantum state, the matrix to be sparse and well-conditioned, and — crucially — you only want a single summary statistic of the solution, not the full solution vector, because reading out every entry costs exponentially. Miss any of those and the advantage disappears. It is the same data-loading and readout trap that limits quantum machine learning.
What is the difference between NISQ and fault-tolerant algorithms?
NISQ algorithms (VQE, QAOA) are designed to run on today's noisy, uncorrected qubits with shallow circuits — but they are heuristics with no proven advantage. Fault-tolerant algorithms (Shor's, phase estimation, HHL) need deep circuits on error-corrected logical qubits, which require millions of physical qubits the field cannot yet build. That gap, not the math, is why exponential speedups remain theoretical.
Can I run these quantum algorithms on free hardware?
Yes, at small scale. You can run Grover, VQE and QAOA on free simulators and on free real-hardware tiers from providers like IBM Quantum. Shor's and phase estimation only work on trivially small inputs today because they demand more clean qubits and circuit depth than current devices provide. Our simulators and hardware pages list what is free to use.