Quantum computational algorithms exploit quantum mechanics to solve problems exponentially faster than the best classical algorithms 1-3 . Shor's quantum algorithm 4 for fast number factoring is a key example and the prime motivator in the international effort to realise a quantum computer 5 . However, due to the substantial resource requirement, to date, there have been only four small-scale demonstrations 6-9 . Here we address this resource demand and demonstrate a scalable version of Shor's algorithm in which the n qubit control register is replaced by a single qubit that is recycled n times: the total number of qubits is one third of that required in the standard protocol [10][11][12] . Encoding the work register in higher-dimensional states, we implement a two-photon compiled algorithm to factor N = 21. The algorithmic output is distinguishable from noise, in contrast to previous demonstrations. These results point to larger-scale implementations of Shor's algorithm by harnessing scalable resource reductions applicable to all physical architectures.Shor's factoring algorithm consists of a quantum order finding algorithm, preceded and succeeded by various classical routines. While the classical tasks are known to be efficient on a classical computer, order finding is understood to be intractable classically. However, it is known that this part of the algorithm can be performed efficiently on a quantum computer. To determine the prime factors of an odd integer N , one chooses a coprime of N , x. The order r relates x to N according to x r mod N = 1, and can be used to obtain the factors, given by the greatest common divisor gcd(x r 2 ± 1, N ). The quantum order finding circuit involves two registers: a work register and a control register. In the standard protocol, the work register performs modular arithmetic with m = log 2 N qubits, enough to encode the number N , and the n qubit control register provides the algorithmic output, with n bits of precision.Measuring the control register in the computational basis will yield a result of k2 n /r where k is an integer between 0 and r − 1, with the value of k occurring probabilistically. Dividing the result by 2 n gives the first n bits of k/r and r may be found with classical processing, using the continued fraction algorithm. For large n, and a perfectly functioning circuit, the output probability distribution of the control register is a series of well defined peaks at values of k2 n /r (Fig. 1b). (See Appendix for details.)Here we implement an iterative version of the order finding algorithm 10,11 , in which the control register contains only a single qubit which is recycled n times, using a sequence of measurement and feed-forward operations, with each step providing an additional bit of precision (Fig. 1a). Reducing the number of qubits in quantum simulations and quantum chemistry has been achieved with recursive phase estimation 13-16 , while ground state projections have been demonstrated by exploiting similar techniques in NMR 17 .The iterative version of...