On the Origins of Quantum Money

Throughout history a key challenge in monetary design has been preventing counterfeiting. Physical currencies use security features like holograms and watermarks to make forgery difficult. Digital currencies rely on cryptographic signatures and distributed ledgers to protect against double spending. These protections have worked well so far but they are not unbreakable, as evidenced by advances in quantum computing. Instead of relying on digital analogs of security, what if we returned to physical principles to secure value?
In 1969, Stephen Wiesner proposed a scheme to make money impossible to duplicate. His idea laid the foundation for what we now call “Quantum Money”. It was the first known proposal to apply the principles of quantum uncertainty to information security and introduced the world to the concept of “money that is physically impossible to counterfeit” [1].


Conjugate Coding

Quantum mechanics provides us with interesting phenomena that allows us to build novel primitives on top of. Wiesner's scheme is based on pairs of physical properties, called conjugate observables, that cannot be precisely measured at the same time. This is formalized by Heisenberg’s famous uncertainty principle [2] which provides a fundamental limit on how precisely conjugate observables can be known at the same time. A classic example is single-slit diffraction, where localizing a particle’s position by narrowing the slit leads to a corresponding increase in the spread of its momentum. This trade-off is a direct consequence of an uncertainty relation showing how measuring one observable inherently disturbs its conjugate pair [3]. Other common examples of conjugate observables include:

• Energy and time

• Different polarizations of a photon

• Spin along different axes

Two observables are conjugate if their corresponding operators do not commute, meaning the order in which they are applied produces different outcomes. This relationship is captured by the commutator, defined as:
[A, B] = AB−BA

If this expression is nonzero, the observables are said to be incompatible or conjugate. For example, we know in quantum mechanics the position operator x̂ and momentum operator p̂ obey the canonical commutation relation:
[x̂, p̂] =x̂p̂-p̂x̂ = iħ

For any two observables A and B, the Robertson uncertainty relation states:
ΔA × ΔB ≥ (1⁄2) × |⟨[A, B]⟩|

where ΔA is the standard deviation (uncertainty) of observable A, ΔB is the standard deviation of observable B and ⟨[A, B]⟩ is the expectation value of the commutator in a given quantum state. By substituting A=x̂ and B = p̂ into the uncertainty relation we get:
Δx × Δp ≥ (1/2) × |⟨[x̂, p̂]⟩|

This is the value we plug into the uncertainty relation:
Δx × Δp ≥ (1/2) × ħ, thus
Δx × Δp ≥ ħ⁄2

his inequality tells us that the more precisely a particle’s position is known, the less precisely its momentum can be known — and vice versa. In other words, conjugate observables encode an inherent quantum trade-off in information. Wiesner’s scheme leveraged the incompatibility of conjugate bases to purpose a quantum banknote, where attempting to extract information from the note using a measurement basis inconsistent with its preparation would irreversibly disturb the state and make counterfeiting immediately obvious and detectable. We can consider a toy example using polarized light. Imagine a sender who wants to transmit one of two binary messages. Each bit is encoded in the polarization of a photon, either in a linear basis (horizontal or vertical) or a circular basis (spinning left or right). These two bases are conjugate, meaning that measuring a photon in the "wrong" basis yields a random result and disturbs the encoded information. The receiver can choose which message to read, but not both. Attempts to extract both messages result in the destruction of information from both sequences.
"There is no way that the receiver can recover the complete contents of more than one of the conjugately coded messages so long as it is confined to making measurements on one burst of photons at a time." [1]


Constructing a Quantum Banknote from the Uncertainty Principle

Wiesner's quantum banknote scheme is composed of multiple independent qubits, each of which are prepared on a random basis and state known only to the issuing authority. Each note consists of n two-level qubits (e.g., spin-½ particles or polarized photons), each initialized in one of four possible states:
|0⟩ or |1⟩ in the Z basis (standard computational basis)

|↑⟩ or |→⟩ in the X basis (superposition basis)

The mint records the basis and value (bit) for each qubit alongside a unique serial number. The banknote can be verified by measuring each qubit in its original basis and checking that the results match the expected values. Any attempt to measure or clone the note without this secret information inevitably introduces detectable errors.
“Let us suppose... the money contains twenty isolated systems... placed in one of the four states a, b, α or β in accordance with the scheme... The money is also given a serial number... and the sequences describing its initial state are kept on record at the mint.” [1]
This was the first formal proposal of quantum-secured physical value. The key in Wiesner’s scheme is using the uncertainty principle to provide a form of informational security. Without knowledge of the original preparation basis, any measurement has a 50 percent chance of being in the wrong basis, yielding a random result and irreversibly altering the state. Suppose a counterfeiter attempts to duplicate a quantum banknote without knowing which basis to use for measurement. For each of the n qubits:

• 50 percent chance of using the wrong basis

• 50 percent chance of measuring the wrong bit in those cases

This results in an expected 25 percent error rate per qubit. The probability of producing a perfect forgery across all n qubits is:
P_success = (3/4)^n

For a 20-qubit note, the probability is:
P_success ≈ (3/4)^20 ≈ 0.00317,
making forgery practically impossible.


Advancements in Quantum Coherence and Error Correction

At the time Wiesner proposed his quantum money concept, the experimental tools necessary to realize it were not yet available. Maintaining long-term quantum coherence was unachievable, and the precise preparation, isolation, and measurement of individual quantum systems was out of reach.
"There is no device... in which the ‘phase coherence’ of a two-state system is preserved for longer than about a second; however, the continuing advance of cryogenic technique will surely change this." [1]
Today, with significant progress in quantum optics, trapped ions, and superconducting qubits, we are much closer to realizing elements of Wiesner's vision. Modern quantum systems can maintain coherence for timescales up to several minutes. In parallel, the development of quantum error correction is enabling the encoding of logical qubits that can, in principle, be preserved indefinitely. Trapped ion experiments have demonstrated coherence times exceeding 10 minutes in individual qubits. For instance, Wang et al. reported a coherence time of over 10 minutes for a single trapped ion qubit [4]. This was later improved to over one hour by addressing dominant error sources such as magnetic-field fluctuations, phase noise of the local oscillator, and microwave leakage [5]. In superconducting architectures, Google's Quantum AI team reported in 2022 the suppression of quantum errors by scaling a surface code logical qubit [6]. They demonstrated that increasing the size of the code can lead to improved logical qubit performance, a crucial step toward scalable quantum error correction. These advancements bring us closer to practical implementations of quantum authentication and memory systems, echoing Wiesner's original vision of quantum-secured information.

Google’s Roadmap for building a useful error-corrected quantum computer with key milestones. We are currently building one logical qubit that we will scale in the future [7].

Wiesner imagined a world where value was enforced not by law or signatures, but by the irreversibility of quantum measurement. His quantum banknote was a conceptual breakthrough that continues to inspire. In future articles, we will explore how to extend Wiesner’s blueprint into publicly verifiable quantum money and complexity-theoretic quantum tokens. But it all began with a deceptively simple idea. Money that cannot be copied, because nature won’t allow it.


Addendum

Technical note on why [x̂, p̂] = iħ.
We mentioned that position and momentum do not commute and that this leads directly to the uncertainty principle. In quantum mechanics, position and momentum are defined as operators that act on wavefunctions:

The position operator multiplies the wavefunction by x:
x̂ ψ(x) = x × ψ(x)

The momentum operator takes a derivative:
p̂ ψ(x) = −iħ × dψ/dx

To understand the commutator [x̂, p̂], we compute the difference between applying these operators in different orders to a wavefunction ψ(x).

First order:
x̂ p̂ ψ(x)

Start by applying p̂:
p̂ ψ(x) = −iħ × dψ/dx

Then apply x̂:
x̂ p̂ ψ(x) = x × (−iħ × dψ/dx)
= −iħ × x × dψ/dx

Second order:
p̂ x̂ ψ(x)

Start by applying x̂:
x̂ ψ(x) = x × ψ(x)

Then apply p̂:
p̂ x̂ ψ(x) = −iħ × d/dx (x × ψ(x))

Using the product rule:
= −iħ × [ψ(x) + x × dψ/dx]

3. Subtracting the two orders
Now compute the commutator:
[x̂, p̂] ψ(x) = x̂ p̂ ψ(x) − p̂ x̂ ψ(x)

Substitute in the two results:
= (−iħ × x × dψ/dx) − (−iħ × [ψ(x) + x × dψ/dx])
= −iħ × x × dψ/dx + iħ × ψ(x) + iħ × x × dψ/dx
= iħ × ψ(x)

So we find:
[x̂, p̂] ψ(x) = iħ × ψ(x)
Since this holds for any wavefunction ψ(x), we conclude:

References