Quantum Money

Every banknote in your wallet relies on the same basic trick: hard-to-copy physical features — special inks, holograms, watermarks — that a counterfeiter cannot easily reproduce. But "hard" is not the same as "impossible." Given enough time and equipment, classical security features can always be faked.

In 1969 Stephen Wiesner had a radical idea: what if a banknote's secret were encoded in a quantum state? Quantum mechanics has a fundamental rule called the no-cloning theorem — it is physically impossible to make a perfect copy of an unknown quantum state. Not merely difficult. Impossible, as a consequence of the laws of physics.

A quantum banknote would therefore be uncopyable by nature, not merely by convention. Wiesner's idea sat unpublished for more than a decade (it was ahead of its time even for physics), but it planted the seed for an entire field. Today, quantum money sits at the intersection of quantum computing, cryptography, and complexity theory — asking not "how hard is it to counterfeit?" but "is counterfeiting physically allowed at all?"

Each quantum banknote holds a serial number and a string of qubits — quantum bits set in a secret basis chosen by the bank. To spend the note, a shop sends it to the bank, which measures each qubit in the original basis: if the results match, the note is genuine.

<p class="hint">{{hint}}</p>
<div class="banknote" id="note">
  <div class="note-header">
    <span class="serial" id="serial">{{serial_init}}</span>
    <span class="badge" id="badge">{{genuine}}</span>
  </div>
  <div class="qubits" id="qubits"></div>
</div>
<div class="status" id="status">{{initial_status}}</div>
<div class="btns">
  <button id="btnIssue" type="button">{{btn_issue}}</button>
  <button id="btnVerify" type="button" disabled>{{btn_verify}}</button>
  <button id="btnClone" type="button" disabled>{{btn_clone}}</button>
</div>
<div class="log" id="log"></div>

* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; }
.hint { font-size: .88rem; color: #444; margin: 0 0 .8rem; line-height: 1.5; }
.banknote { background: linear-gradient(135deg,#e8f5e9,#f1f8e9); border: 2px solid #81c784;
            border-radius: 12px; padding: .8rem 1rem; margin-bottom: .7rem; min-height: 90px; }
.banknote.invalid { background: linear-gradient(135deg,#ffebee,#fce4ec); border-color: #e57373; }
.banknote.clone { background: linear-gradient(135deg,#fff3e0,#fce4ec); border-color: #ffb74d; }
.note-header { display: flex; justify-content: space-between; align-items: center; margin-bottom: .5rem; }
.serial { font: 700 .85rem ui-monospace, monospace; color: #2e7d32; }
.badge { font: 700 .75rem system-ui; padding: .2rem .5rem; border-radius: 20px;
         background: #2e7d32; color: #fff; letter-spacing: .05em; }
.badge.fail { background: #c62828; }
.badge.warn { background: #e65100; }
.qubits { display: flex; gap: 6px; flex-wrap: wrap; }
.qubit { width: 38px; height: 38px; border-radius: 8px; display: flex; align-items: center;
         justify-content: center; font: 700 18px ui-monospace, monospace;
         border: 1.5px solid #bbb; background: #fff; transition: all .2s; }
.qubit.rec { border-color: #1565c0; color: #1565c0; background: #e3f2fd; }
.qubit.diag { border-color: #6a1b9a; color: #6a1b9a; background: #f3e5f5; }
.qubit.err { border-color: #c62828; color: #c62828; background: #ffebee; }
.status { font-size: .95rem; font-weight: 600; margin: .5rem 0; min-height: 1.4em; line-height: 1.4; }
.status.ok { color: #2e7d32; } .status.bad { color: #c62828; } .status.warn { color: #e65100; }
.btns { display: flex; gap: .5rem; flex-wrap: wrap; margin-bottom: .6rem; }
button { font: 600 14px system-ui; padding: .45rem .9rem; border: 1.5px solid #1d3557;
         background: #1d3557; color: #fff; border-radius: 8px; cursor: pointer; }
button:disabled { opacity: .4; cursor: not-allowed; }
button.ghost { background: #fff; color: #1d3557; }
.log { font: .8rem ui-monospace, monospace; color: #555; max-height: 130px; overflow-y: auto;
       border: 1px solid #ddd; border-radius: 8px; padding: .4rem .6rem; line-height: 1.6;
       background: #fafafa; }
.log:empty { display: none; }
.log .ok { color: #2e7d32; } .log .bad { color: #c62828; } .log .warn { color: #e65100; }

// Code not found

Notice what happens when a counterfeiter tries to clone the note. Without knowing which basis each qubit uses, any measurement collapses the state — and the copy comes out wrong roughly half the time. The bank's verification then rejects it. Checking authenticity is easy; duplicating the state without the secret basis is physically forbidden.

Quantum money comes in two flavors with very different security guarantees:

Private-key (Wiesner, 1969/1983). The bank keeps the secret basis and is the only entity that can verify a note. Security is information-theoretic: no counterfeiter, however powerful, can clone an unknown quantum state. The no-cloning theorem is not a computational assumption — it follows directly from the linearity of quantum mechanics. The catch: you must go back to the bank to verify every transaction.

Public-key (Aaronson-Christiano, 2012). Anyone can verify a note without contacting the bank. Here security rests on computational hardness: the scheme hides a classical serial number in a quantum superposition over a secret linear subspace of a vector space over a finite field. Verifying membership is easy (just apply the bank's public quantum circuit), but finding a new valid state — or cloning an existing one — requires solving a problem believed to be hard even for quantum computers.

• The hardness assumption is related to distinguishing random subspaces from structured ones — a problem with no known efficient quantum algorithm.
• Unlike classical public-key cryptography (which relies on factoring or discrete log), quantum money's security does not collapse under Shor's algorithm.
• The no-cloning theorem ensures that even unlimited classical computation cannot copy a note by re-running the quantum circuit, because the state itself cannot be fully read out.

The field is still young: proving unconditional security for public-key quantum money is an open problem, making it one of the most intriguing frontiers in quantum cryptography.

The no-cloning insight that powers quantum money reaches far beyond banknotes:

• Quantum authentication tokens: the same "quantum state as unforgeable credential" idea applies to one-time passwords and access tokens that cannot be duplicated even if intercepted.
• Quantum copy-protection: Aaronson (2009) proposed using quantum states to distribute software so that no pirate can copy it — the program runs, but cannot be cloned. This remains an active research direction.
• Quantum key distribution (QKD): the no-cloning theorem is also the backbone of QKD protocols like BB84, ensuring that an eavesdropper cannot copy qubits in transit without leaving detectable traces.
• Lightning (payment channels): researchers have proposed quantum-money-inspired "quantum lightning" — bills that can be minted without a central bank and verified publicly, a potential quantum analogue of a trustless digital currency.
• Complexity lower bounds: proving that quantum money is secure requires showing that certain quantum states are hard to prepare, connecting to deep questions in quantum simulation and the difficulty of learning quantum states.

Each application inherits the same beautiful property: security backed not by computational effort alone, but by the physical structure of the universe.

Quantum money inverts the usual story of security. Classical cryptography says: counterfeiting is computationally hard, and we hope that hardness is real. Quantum money says: counterfeiting is physically forbidden, and the proof is a theorem of quantum mechanics.

Wiesner's 1969 insight — encode the secret in a quantum state — was simple enough to state in a sentence and deep enough to inspire decades of research. The public-key variant by Aaronson and Christiano showed that anyone, not just the bank, could verify a note, turning quantum money from a curiosity into a potential primitive for quantum cryptography.

What makes the field remarkable is that the hard part is not "can it be broken?" but "can we prove it cannot?" Establishing unconditional security for public-key quantum money remains open — a reminder that even when physics forbids copying, proving it to a mathematician's satisfaction takes a different kind of effort.