Sums of Two Squares

Which whole numbers can be written as a sum of two perfect squares? The number 55 is, since 5=12+225 = 1^2+2^2. So is 50=12+72=52+5250 = 1^2+7^2 = 5^2+5^2. But 33, 66, and 2121 are not, no matter how one tries. This simple-looking question is decided by nothing more exotic than divisibility by primes of a certain congruence class. Yet it turns out to encode deep structure. That structure connects elementary number theory, the arithmetic of the Gaussian integers, and the theory of quadratic forms. The idea matters because it is the first genuinely arithmetic classification theorem. A global property of an integer — being a sum of two squares — is shown to be equivalent to a purely local, prime-by-prime condition. This local-to-global philosophy means checking the primes, then assembling the answer. It recurs throughout algebraic number theory, from Hasse's local-global principle to the modern theory of LL-functions. Fermat's discovery that a prime pp is a sum of two squares exactly when p≡1(mod4)p \equiv 1 \pmod 4 (or p=2p=2) is the seed. From it grows the entire theory of representations by quadratic forms. The big picture is that Z[i]\mathbb{Z}[i], the ring of Gaussian integers, behaves almost exactly like Z\mathbb{Z}. It has a division algorithm, unique factorization, and primes. A rational prime pp either stays prime in Z[i]\mathbb{Z}[i], or splits into a product of two conjugate Gaussian primes. This splitting behavior is governed precisely by whether −1-1 is a quadratic residue mod pp. That question is already answered by the Supplementary Laws of quadratic reciprocity. Sums of two squares are norms of Gaussian integers. So the multiplicativity of the norm converts a question about representability into a question about factorization. This article proves Fermat's two-square theorem via Gaussian integers and unique factorization. It states and proves the full characterization of sums of two squares for arbitrary integers. It also gives an alternative descent-style argument for the prime case. It closes by pointing toward the natural generalizations. These include sums of four squares (where every integer succeeds) and the general theory of Binary Quadratic Forms.

Key takeaways
  • Fermat's theorem: an odd prime pp is a sum of two squares iff p≡1(mod4)p \equiv 1 \pmod 4.
  • The proof uses the Gaussian integers Z[i]\mathbb{Z}[i], a unique factorization domain where the norm N(a+bi)=a2+b2N(a+bi)=a^2+b^2 is multiplicative.
  • p≡1(mod4)p \equiv 1 \pmod 4 splits in Z[i]\mathbb{Z}[i] because −1-1 is then a quadratic residue mod pp; p≡3(mod4)p\equiv 3\pmod 4 stays prime.
  • The general theorem: nn is a sum of two squares iff every prime p≡3(mod4)p\equiv 3\pmod 4 divides nn to an even power.
  • The set of sums of two squares is closed under multiplication — the Brahmagupta–Fibonacci identity is the algebraic shadow of N(zw)=N(z)N(w)N(zw)=N(z)N(w).
  • Key idea: representability by x2+y2x^2+y^2 is a local, prime-by-prime condition, made transparent by working in the ring Z[i]\mathbb{Z}[i] instead of Z\mathbb{Z}.

Where this lives today

The splitting behavior of primes in Z[i]\mathbb{Z}[i] — inert, split, or ramified according to congruence mod 44 — is the prototype for the general theory of splitting of primes in Binary Quadratic Forms and quadratic number fields, itself a special case of class field theory describing how primes factor in arbitrary Galois extensions. In cryptography, fast algorithms for expressing a prime p≡1(mod4)p \equiv 1 \pmod 4 as a sum of two squares (via continued fractions or Cornacchia's algorithm) are used in elliptic-curve point-counting and in constructing curves with prescribed complex multiplication. In computational number theory, the sum-of-two-squares theorem underlies efficient primality-related tests and factorization heuristics tied to Gaussian integer arithmetic. In physics and combinatorics, the function r2(n)r_2(n) counting representations of nn as an ordered sum of two squares (with signs) appears in lattice point counting problems, the Gauss circle problem, and the theory of modular forms, where r2(n)r_2(n) is essentially a Fourier coefficient of a weight-one theta series. The broader technique — passing to a larger ring with unique factorization to resolve a Diophantine question in Z\mathbb{Z} — reappears throughout algebraic number theory, and directly foreshadows Lagrange's theorem on Sums of Four Squares, where every nonnegative integer succeeds because the relevant ring (Hurwitz quaternions) has no analogous obstruction from inert primes.

:::quiz[Why does Z[i]\mathbb{Z}[i] being a UFD matter in the proof that p≡1(mod4)p\equiv1\pmod4 implies pp is a sum of two squares?]

  • It guarantees that irreducibles are prime, letting us conclude p∣m+ip\mid m+i or p∣m−ip\mid m-i from p∣(m+i)(m−i)p\mid(m+i)(m-i) ✓
  • It is only needed to define the norm function
  • It ensures Z[i]\mathbb{Z}[i] has infinitely many units
  • It is irrelevant; the result only uses quadratic reciprocity

:::quiz[What role does q≡3(mod4)q \equiv 3 \pmod 4 staying irreducible in Z[i]\mathbb{Z}[i] play in the general theorem?]

  • It forces the power of qq in any norm N(z)N(z) to be even, since N(q)=q2N(q)=q^2 and qq contributes in matched pairs ✓
  • It shows qq can never divide any Gaussian integer
  • It implies qq is always a sum of two squares itself
  • It has no role; only split primes matter

:::faq[What breaks if we replace Z[i]\mathbb{Z}[i] with a non-UFD analog, like Z[−5]\mathbb{Z}[\sqrt{-5}]?] The entire argument leans on unique factorization to conclude that if a prime divides a product it divides one of the factors. In Z[−5]\mathbb{Z}[\sqrt{-5}], unique factorization fails: 6=2⋅3=(1+−5)(1−−5)6 = 2\cdot 3 = (1+\sqrt{-5})(1-\sqrt{-5}) gives two genuinely different factorizations into irreducibles. Consequently the clean splitting dichotomy (inert vs. split, controlled by a single congruence) does not directly characterize representability by x2+5y2x^2+5y^2; one instead needs the full machinery of class numbers and genus theory for binary quadratic forms of discriminant −20-20, which is a strictly harder, richer subject building on this simpler UFD case.

Ask the tutor: Can you show me step-by-step how to find a,ba,b with a2+b2=1234a^2+b^2=1234 or prove it's impossible?

DefinitionSum of two squares; Gaussian integers

A nonnegative integer nn is called a sum of two squares if there exist integers a,ba, b (possibly zero or negative, only a2,b2a^2, b^2 matter) with

n=a2+b2.n = a^2 + b^2.

The Gaussian integers form the ring

Z[i]={ a+bi:a,b∈Z }⊂C,i2=−1.\mathbb{Z}[i] = \{\, a + bi : a, b \in \mathbb{Z} \,\} \subset \mathbb{C}, \qquad i^2 = -1.

The norm N:Z[i]→Z≥0N : \mathbb{Z}[i] \to \mathbb{Z}_{\ge 0} is defined by

N(a+bi)=(a+bi)(a−bi)=a2+b2.N(a+bi) = (a+bi)(a-bi) = a^2 + b^2.

A rational integer n≥0n \ge 0 is a sum of two squares if and only if n=N(z)n = N(z) for some z∈Z[i]z \in \mathbb{Z}[i].

Intuition

The norm turns multiplication in Z[i]\mathbb{Z}[i] into multiplication in Z\mathbb{Z}: N(zw)=N(z)N(w)N(zw) = N(z)N(w), because complex conjugation is a ring homomorphism, so N(zw)=zwzw‾=zzˉ wwˉ=N(z)N(w)N(zw) = zw\overline{zw} = z\bar z\, w \bar w = N(z)N(w). This one identity, unpacked in coordinates, is the classical Brahmagupta–Fibonacci identity:

(a2+b2)(c2+d2)=(ac−bd)2+(ad+bc)2.(a^2+b^2)(c^2+d^2) = (ac-bd)^2 + (ad+bc)^2.

It shows immediately that the set of sums of two squares is closed under multiplication. The subtler direction — which primes are sums of two squares, and what happens when we divide — needs the arithmetic of Z[i]\mathbb{Z}[i] itself. Picture Z[i]\mathbb{Z}[i] as the lattice of Gaussian integers in the plane. The norm of a lattice point is the squared Euclidean distance to the origin, so "nn is a sum of two squares" literally means some lattice point lies at squared-distance nn from the origin. A prime pp of ordinary arithmetic can behave in two ways inside this lattice: it can remain irreducible (a "Gaussian prime" with no smaller lattice-factors), or it can factor as p=ππˉp = \pi\bar\pi into two conjugate Gaussian primes, in which case p=N(π)p = N(\pi) is visibly a sum of two squares. Whether pp splits or stays prime is decided by a single congruence condition mod 4, which is exactly the statement that −1-1 is or is not a quadratic residue mod pp.

Figure
Gaussian integers as a lattice; norm = squared distance to origin
Re Im z = 2+3i, N(z)=13 0 1 2 -2 i 2i 3i 13 ≡ 1 (mod 4): 13 = 2² + 3², so 13 splits in ℤ[i]

Central results

TheoremFermat's Two-Square Theorem

Let pp be an odd prime. Then pp is a sum of two squares, i.e. p=a2+b2p = a^2+b^2 for some integers a,ba,b, if and only if

p≡1(mod4).p \equiv 1 \pmod 4.
LemmaGaussian integers form a Euclidean domain, hence a UFD

For any z,w∈Z[i]z, w \in \mathbb{Z}[i] with w≠0w \ne 0, there exist q,r∈Z[i]q, r \in \mathbb{Z}[i] with

z=qw+r,N(r)<N(w).z = qw + r, \qquad N(r) < N(w).

Consequently Z[i]\mathbb{Z}[i] is a Euclidean domain, hence a principal ideal domain, hence a unique factorization domain. Its units are exactly {1,−1,i,−i}\{1,-1,i,-i\}.

Proof

Division algorithm. Write z/w=x+yi∈Q(i)z/w = x + yi \in \mathbb{Q}(i) with x,y∈Qx, y \in \mathbb{Q}. Choose integers m,nm,n with ∣x−m∣≤1/2|x-m| \le 1/2 and ∣y−n∣≤1/2|y-n| \le 1/2; set q=m+niq = m+ni. Then

N(z/w−q)=(x−m)2+(y−n)2≤14+14=12<1.N(z/w - q) = (x-m)^2 + (y-n)^2 \le \tfrac14+\tfrac14 = \tfrac12 < 1.

Let r=z−qwr = z - qw, so z/w−q=r/wz/w - q = r/w and N(r/w)=N(r)/N(w)≤1/2N(r/w) = N(r)/N(w) \le 1/2, giving N(r)≤12N(w)<N(w)N(r) \le \frac12 N(w) < N(w).

Consequences. A Euclidean domain is a principal ideal domain: given an ideal I≠(0)I \ne (0), pick w∈Iw \in I nonzero of minimal norm; the division algorithm shows every z∈Iz \in I satisfies z=qw+rz = qw + r with r∈Ir \in I (since r=z−qwr = z-qw and II is an ideal) and N(r)<N(w)N(r) < N(w), forcing r=0r = 0 by minimality; hence I=(w)I = (w). Every PID is a UFD, by the standard argument that in a PID irreducibles are prime (if π\pi is irreducible and π∣ab\pi \mid ab but π∤a\pi \nmid a, then gcd⁡(π,a)=1\gcd(\pi,a)=1 since the only divisors of π\pi are units and associates, so by Bézout in the PID there are s,ts,t with sπ+ta=1s\pi + ta = 1, giving b=sbπ+tabb = sb\pi + tab, divisible by π\pi) and every element factors into irreducibles by strong induction on the norm (if zz is not a unit and not irreducible, z=z1z2z=z_1z_2 with N(z1),N(z2)<N(z)N(z_1),N(z_2)<N(z), both ≥1\ge 1, so induct).

Units. If u=a+biu=a+bi is a unit, N(u)N(u−1)=N(1)=1N(u)N(u^{-1})=N(1)=1 with both factors positive integers, so N(u)=1N(u)=1, i.e. a2+b2=1a^2+b^2=1, forcing (a,b)∈{(±1,0),(0,±1)}(a,b) \in \{(\pm1,0),(0,\pm1)\}, i.e. u∈{1,−1,i,−i}u \in \{1,-1,i,-i\}. Conversely each of these has an inverse in Z[i]\mathbb{Z}[i], so these are exactly the units. ■\blacksquare

∎

:::lemma[Splitting criterion for rational primes in Z[i]\mathbb{Z}[i]] Let pp be an odd prime. (a) If p≡1(mod4)p \equiv 1 \pmod 4, then pp is not irreducible in Z[i]\mathbb{Z}[i]: it factors as p=ππˉp = \pi \bar\pi for some Gaussian prime π\pi with N(π)=pN(\pi) = p. (b) If p≡3(mod4)p \equiv 3 \pmod 4, then pp remains prime (irreducible) in Z[i]\mathbb{Z}[i].

Proof

By the Supplementary Laws (specifically the first supplement to quadratic reciprocity), −1-1 is a quadratic residue mod pp if and only if p≡1(mod4)p \equiv 1 \pmod 4.

(a) Suppose p≡1(mod4)p \equiv 1 \pmod 4. Then there exists m∈Zm \in \mathbb{Z} with m2≡−1(modp)m^2 \equiv -1 \pmod p, i.e. p∣m2+1=(m+i)(m−i)p \mid m^2 + 1 = (m+i)(m-i) in Z[i]\mathbb{Z}[i]. If pp were irreducible in Z[i]\mathbb{Z}[i], then since Z[i]\mathbb{Z}[i] is a UFD, irreducibles are prime, so pp would divide m+im+i or m−im-i in Z[i]\mathbb{Z}[i]. But p∣m+ip \mid m+i would mean (m+i)/p=m/p+i/p∈Z[i](m+i)/p = m/p + i/p \in \mathbb{Z}[i], forcing 1/p∈Z1/p \in \mathbb{Z}, absurd since p>1p>1; likewise for m−im-i. So pp is not irreducible in Z[i]\mathbb{Z}[i]. Since pp is not a unit (as N(p)=p2≠1N(p) = p^2 \ne 1) and not irreducible, write p=αβp = \alpha\beta with α,β\alpha, \beta non-units. Taking norms, p2=N(α)N(β)p^2 = N(\alpha)N(\beta) with N(α),N(β)>1N(\alpha), N(\beta) > 1 (non-units have norm ≠1\ne 1, and norm 00 is impossible since p≠0p\ne 0), so the only possibility is N(α)=N(β)=pN(\alpha) = N(\beta) = p. Write α=π=a+bi\alpha = \pi = a+bi; then p=N(π)=a2+b2p = N(\pi) = a^2+b^2, and β\beta, having the same norm pp and satisfying αβ=p\alpha\beta = p, must equal πˉ\bar\pi up to a unit (concretely β=p/π=πˉ⋅p/N(π)=πˉ\beta = p/\pi = \bar\pi \cdot p/N(\pi) = \bar\pi). So p=ππˉp = \pi\bar\pi. Finally π\pi is irreducible: if π=γδ\pi = \gamma\delta nontrivially then N(γ)N(δ)=pN(\gamma)N(\delta) = p prime forces one factor to have norm 11, a unit — contradiction to nontriviality. So π\pi is a Gaussian prime.

(b) Suppose p≡3(mod4)p \equiv 3 \pmod 4 and suppose for contradiction pp is not irreducible in Z[i]\mathbb{Z}[i]. As in (a), p=αβp = \alpha\beta with α,β\alpha,\beta non-units, forcing N(α)=N(β)=pN(\alpha) = N(\beta) = p. Write α=a+bi\alpha = a+bi, so p=a2+b2p = a^2+b^2. Reducing mod 4: squares mod 4 are 00 or 11, so a2+b2  4∈{0,1,2}a^2+b^2 \bmod 4 \in \{0,1,2\}, never 33. But p≡3(mod4)p \equiv 3 \pmod 4, a contradiction. Hence pp is irreducible in Z[i]\mathbb{Z}[i]. ■\blacksquare

∎
Proof

(Proof of Fermat's Two-Square Theorem, using the two lemmas.) (⇐\Leftarrow) Suppose p≡1(mod4)p \equiv 1 \pmod 4. By the splitting lemma (a), p=a2+b2p = a^2+b^2 for some integers a,ba,b. This is exactly the statement that pp is a sum of two squares. (⇒\Rightarrow) Suppose pp is odd and p=a2+b2p = a^2+b^2 for integers a,ba,b. Reducing mod 4, a2,b2∈{0,1}(mod4)a^2, b^2 \in \{0,1\} \pmod 4. Since pp is odd, a2+b2a^2+b^2 is odd, so exactly one of a,ba,b is even and the other odd; hence a2+b2≡0+1=1(mod4)a^2+b^2 \equiv 0+1 = 1 \pmod 4. So p≡1(mod4)p \equiv 1 \pmod 4. Both directions established; the theorem is proved. ■\blacksquare

∎

The direction just given (p=a2+b2⇒p≡1(mod4)p=a^2+b^2\Rightarrow p\equiv1\pmod4) is a two-line congruence argument requiring no machinery; the substantive direction is the existence of a representation when p≡1(mod4)p\equiv1\pmod4, which is where unique factorization in Z[i]\mathbb{Z}[i] does the real work.

CorollaryWhich integers are sums of two squares

A positive integer nn is a sum of two squares if and only if, writing

n=2e0∏p≡1(4)pep∏q≡3(4)qfqn = 2^{e_0} \prod_{p \equiv 1 (4)} p^{e_p} \prod_{q \equiv 3 (4)} q^{f_q}

in prime factorization, every exponent fqf_q (on primes q≡3(mod4)q \equiv 3 \pmod 4) is even.

Proof

We use that 2=12+122 = 1^2+1^2 and, for p≡1(mod4)p \equiv 1 \pmod 4, p=ππˉp = \pi\bar\pi in Z[i]\mathbb{Z}[i] (splitting lemma), while for q≡3(mod4)q\equiv 3\pmod 4, qq stays prime in Z[i]\mathbb{Z}[i] (splitting lemma).

(⇐\Leftarrow) Sufficiency. If every fqf_q is even, write n=m⋅∏qfqn = m \cdot \prod q^{f_q} where m=2e0∏pepm = 2^{e_0}\prod p^{e_p} is (by the Brahmagupta–Fibonacci identity, applied repeatedly, since 22 and each p≡1 (4)p\equiv 1\,(4) are individually sums of two squares) itself a sum of two squares, say m=c2+d2m = c^2+d^2. Since each fqf_q is even, ∏qfq=(∏qfq/2)2=:k2\prod q^{f_q} = \left(\prod q^{f_q/2}\right)^2 =: k^2 is a perfect square. Then

n=mk2=(ck)2+(dk)2,n = m k^2 = (ck)^2 + (dk)^2,

a sum of two squares.

(⇒\Rightarrow) Necessity. Suppose n=a2+b2=N(a+bi)n = a^2+b^2 = N(a+bi) for some a,b∈Za,b\in\mathbb{Z}, and let q≡3(mod4)q \equiv 3\pmod 4 be a prime dividing nn; we must show qq divides nn to an even power. Let d=gcd⁡(a,b)d = \gcd(a,b) and write a=da′a = da', b=db′b=db' with gcd⁡(a′,b′)=1\gcd(a',b')=1; let qk∥d2q^k \| d^2 correspond to the power of qq dividing nn coming from d2(a′2+b′2)d^2(a'^2+b'^2). More directly: suppose q2s+1q^{2s+1} exactly divides... it is cleaner to argue as follows. Suppose, for contradiction, that qq divides n=a2+b2n = a^2+b^2 to an odd power fq=2t+1f_q = 2t+1. Consider z=a+bi∈Z[i]z = a+bi \in \mathbb{Z}[i], so N(z)=nN(z) = n. Since qq is inert (irreducible, and prime, by the splitting lemma) in Z[i]\mathbb{Z}[i], factor zz into Gaussian primes:

z=u⋅qc⋅π1⋯πrz = u \cdot q^{c} \cdot \pi_1 \cdots \pi_r

where uu is a unit, c≥0c \ge 0 is the exact power of the rational prime qq dividing zz in Z[i]\mathbb{Z}[i] (possible since qq is a Gaussian prime, so we may speak of qq-adic valuation on Z[i]\mathbb{Z}[i]), and each πj\pi_j is a Gaussian prime not associate to qq. Taking norms,

n=N(z)=N(q)c∏jN(πj)=q2c∏jN(πj),n = N(z) = N(q)^{c} \prod_j N(\pi_j) = q^{2c}\prod_j N(\pi_j),

using N(q)=q2N(q) = q^2 since qq is a rational integer. Since qq is a rational prime and none of the πj\pi_j is associate to qq, none of the primes dividing πˉj\bar\pi_j's or πj\pi_j's norm can equal qq arising from this factor in a way that contributes an odd extra power — more precisely, since q∤πjq \nmid \pi_j for each jj (else πj\pi_j would be an associate of qq, both being Gaussian primes with πj∣q\pi_j \mid q forcing πj\pi_j and qq to generate the same prime ideal), and qq is a rational prime, q∤N(πj)q \nmid N(\pi_j) (if q∣N(πj)=πjπˉjq \mid N(\pi_j) = \pi_j\bar\pi_j, then since qq is a Gaussian prime, q∣πjq \mid \pi_j or q∣πˉjq\mid \bar\pi_j, contradicting non-associateness after conjugating if needed). So the exact power of qq dividing nn in Z\mathbb{Z} is precisely 2c2c, an even number. This contradicts our assumption that fq=2t+1f_q = 2t+1 is odd. Hence fqf_q must be even for every prime q≡3(mod4)q \equiv 3 \pmod 4 dividing nn. ■\blacksquare

∎

Worked examples

Example 1: n=1025n = 1025. Factor: 1025=52⋅411025 = 5^2 \cdot 41. Check congruences: 5≡1(mod4)5 \equiv 1 \pmod 4 and 41≡1(mod4)41 \equiv 1 \pmod 4 (since 41=40+141 = 40+1); there are no prime factors ≡3(mod4)\equiv 3 \pmod 4 at all, so vacuously every such exponent is even. By the corollary, 10251025 is a sum of two squares. To find one explicitly, factor in Z[i]\mathbb{Z}[i]: 5=(2+i)(2−i)5 = (2+i)(2-i) and 41=(5+4i)(5−4i)41 = (5+4i)(5-4i) (check: 52+42=25+16=415^2+4^2 = 25+16=41 ✓.) Then

1025=52⋅41=(2+i)2(2−i)2(5+4i)(5−4i).1025 = 5^2 \cdot 41 = (2+i)^2(2-i)^2(5+4i)(5-4i).

Group as zzˉz\bar z with z=(2+i)2(5+4i)z = (2+i)^2(5+4i). Compute (2+i)2=4+4i−1=3+4i(2+i)^2 = 4+4i-1 = 3+4i. Then

z=(3+4i)(5+4i)=15+12i+20i+16i2=15+32i−16=−1+32i.z = (3+4i)(5+4i) = 15+12i+20i+16i^2 = 15+32i-16 = -1+32i.

So N(z)=(−1)2+322=1+1024=1025N(z) = (-1)^2+32^2 = 1+1024 = 1025. Indeed 1025=12+3221025 = 1^2+32^2. A second representation comes from pairing differently: take z′=(2+i)(2−i)(5+4i)z' = (2+i)(2-i)(5+4i) — but (2+i)(2−i)=5(2+i)(2-i)=5 is real, giving z′=5(5+4i)=25+20iz' = 5(5+4i)=25+20i, norm 625+400=1025625+400=1025, i.e. 1025=252+2021025 = 25^2+20^2. Both check out: 1+1024=10251+1024=1025 and 625+400=1025625+400=1025. (The multiplicity of representations reflects the number of ways to distribute conjugate factors among the two "sides" z,zˉz, \bar z — a phenomenon fully explained by Binary Quadratic Forms.)

Example 2: n=3969n = 3969. Factor: 3969=632=(9⋅7)2=34⋅723969 = 63^2 = (9\cdot 7)^2 = 3^4\cdot 7^2. Here the only odd prime factors are 33 and 77, both ≡3(mod4)\equiv 3 \pmod 4 (since 3≡33\equiv3, 7≡37\equiv3), and both appear to an even power (44 and 22 respectively). By the corollary, 39693969 is a sum of two squares — but since 3969=6323969=63^2 is itself a perfect square, the trivial representation 3969=632+023969 = 63^2+0^2 exists. Are there nontrivial ones? Since 39693969 has no prime factor ≡1(mod4)\equiv 1\pmod 4, the number of essentially distinct representations (up to order/sign) is exactly one — the trivial one — a fact explained by the formula for the number of representations r2(n)r_2(n) in terms of divisors of nn congruent to 11 and 33 mod 44. Direct check: one can verify computationally that no a,b>0a,b>0 with a≠0,b≠0a\ne 0, b\ne 0 satisfy a2+b2=3969a^2+b^2=3969 besides using b=0b=0. Contrast: n=21=3⋅7n=21 = 3\cdot7, both primes ≡3(mod4)\equiv 3\pmod4 to the first (odd) power. By the corollary, 2121 is not a sum of two squares — consistent with direct search: 21−0=21,21−1=20,21−4=17,21−9=12,21−16=521-0=21,21-1=20,21-4=17,21-9=12,21-16=5, none a perfect square.

CounterexampleDropping "p≡1(mod4)p\equiv1\pmod4" for a general modulus breaks the clean dichotomy

The theorem crucially uses the modulus 44; the analogous statement is false if one tries the naive guess "a prime pp is a sum of two squares iff p≡1(mod3)p\equiv 1\pmod3" or any other modulus not tied to −1-1 being a QR. Consider p=7p=7. We have 7≡1(mod3)7 \equiv 1 \pmod 3 (since 7=2⋅3+17 = 2\cdot3+1), so a false analogous theorem based on mod 33 would predict 77 is a sum of two squares. But checking all cases: 7−0=7,7−1=6,7−4=37-0=7,7-1=6,7-4=3, none are perfect squares, so 77 is not a sum of two squares. Indeed 7≡3(mod4)7 \equiv 3\pmod 4, correctly predicting failure via the true (mod 44) criterion. This shows the hypothesis "p≡1(mod4)p\equiv1\pmod4" cannot be replaced by an arbitrary congruence condition: it is special because 44 is precisely the modulus controlling whether −1-1 is a quadratic residue mod pp (via the first supplementary law), which is exactly the condition that makes x2≡−1(modp)x^2\equiv-1\pmod p solvable and hence pp reducible in Z[i]\mathbb{Z}[i]. Swapping in an unrelated modulus severs this connection and the theorem simply fails.

Scope, edge cases & common traps

SituationWhat happensWhy
p=2p=22=12+122 = 1^2+1^2, always a sum of two squares2=−i(1+i)22 = -i(1+i)^2 is ramified, not inert or split, in Z[i]\mathbb{Z}[i]
nn a perfect squareAlways a sum of two squares (n=n+02n=n_{}+0^2, or nontrivially if it has prime factors ≡1  4\equiv1\bmod4)Trivial representation always available
n=0n=00=02+020=0^2+0^2, sum of two squares by conventionDegenerate but consistent case
Negative "sums"Not considered; squares are ≥0\ge 0Definition restricted to n≥0n\ge 0
q≡3(mod4)q\equiv3\pmod4 to an odd power dividing nnnn is never a sum of two squaresProven via inert primes in Z[i]\mathbb{Z}[i]
Composite with mixed factorsMust check every prime ≡3(mod4)\equiv3\pmod4 individually, not just oneA single bad odd-power prime factor ruins representability

The mathematician behind it

Origins · 1 minPierre de Fermat and how this was discovered
PD
Pierre de Fermat
1607–1665 · Toulouse, France, Parlement counselor and amateur mathematician

Fermat announced the two-square theorem in a 1640 letter to Mersenne without publishing a proof, characteristic of his style of stating results and daring correspondents to find demonstrations. He claimed a proof by his method of infinite descent, though no written proof by Fermat survives; the first published proofs came later, notably by Euler. Fermat's parallel investigations into representability by x2+2y2x^2+2y^2, x2+3y2x^2+3y^2, and his famous Last Theorem all belong to the same broader program of understanding which integers arise from quadratic forms — a program that Euler, Lagrange, Gauss, and eventually Dedekind and Hilbert would turn into modern algebraic number theory.

History
- 1640 — Fermat states the two-square theorem in correspondence, claims a descent proof.
- 1747–1749 — Euler gives the first published rigorous proof, using infinite descent.
- 1801 — Gauss's Disquisitiones Arithmeticae systematizes quadratic forms and Gaussian integers, reproving and vastly generalizing the result.
- 1832 — Gauss introduces Z[i]\mathbb{Z}[i] explicitly and studies biquadratic reciprocity, cementing the Gaussian integers as a central object.
- 1840s–1850s — Dedekind's ideal theory recasts unique factorization of Z[i]\mathbb{Z}[i]-style rings in general number fields, situating the two-square theorem inside class field theory.
Why does the modulus 4 appear rather than some other number?

The modulus 44 arises because the question "is −1-1 a quadratic residue mod pp" is answered by the first supplementary law of quadratic reciprocity, which states (−1p)=(−1)(p−1)/2\left(\frac{-1}{p}\right) = (-1)^{(p-1)/2}. This expression depends only on p  4p \bmod 4: it equals +1+1 exactly when p≡1(mod4)p \equiv 1\pmod4 and −1-1 when p≡3(mod4)p\equiv3\pmod4. Since solvability of x2≡−1(modp)x^2\equiv-1\pmod p is precisely what makes pp reducible in Z[i]\mathbb{Z}[i] (via p∣(x+i)(x−i)p \mid (x+i)(x-i)), the congruence class mod 44 is not a arbitrary choice but is forced by the structure of quadratic residues. No smaller or unrelated modulus captures this dichotomy correctly.

Does every integer of the form 4k+14k+1 automatically become a sum of two squares?

No — this conflates a necessary condition for primes with a sufficient condition for all integers. For primes, p≡1(mod4)p\equiv1\pmod4 is exactly equivalent to being a sum of two squares. For composite nn, one must factor completely: n≡1(mod4)n\equiv1\pmod4 is neither necessary nor sufficient in general. For example 9=32≡1(mod4)9 = 3^2 \equiv 1\pmod4 is a sum of two squares only trivially (9=32+029=3^2+0^2; also fails to have a nontrivial one since 3≡3(mod4)3\equiv3\pmod4 appears to an even power here, so it's actually fine — but 21≡1(mod4)21\equiv1\pmod4 fails entirely since 33 and 77 each appear to odd power). The correct test always requires prime factorization.

How many ways can a number be written as a sum of two squares?

There is an exact formula, due to Jacobi: if n=2e0∏piei∏qjfjn=2^{e_0}\prod p_i^{e_i}\prod q_j^{f_j} with pi≡1(mod4)p_i\equiv1\pmod4 and qj≡3(mod4)q_j\equiv3\pmod4, then nn is a sum of two squares iff every fjf_j is even, and in that case the number of representations r2(n)r_2(n) (counting order and sign, i.e. (a,b)(a,b), (−a,b)(-a,b), (b,a)(b,a) all distinct) equals 4∏i(ei+1)4\prod_i(e_i+1). This connects directly to Binary Quadratic Forms, where r2(n)r_2(n) is computed via class numbers and divisor-counting arguments refining the qualitative theorem given here.

Is the representation of a prime p≡1(mod4)p\equiv1\pmod4 as a sum of two squares unique?

Yes, up to order and sign. If p=a2+b2=c2+d2p=a^2+b^2=c^2+d^2 with a,b,c,d>0a,b,c,d>0, then p=N(a+bi)=N(c+di)p=N(a+bi)=N(c+di), and since p=ππˉp=\pi\bar\pi with π\pi a Gaussian prime, unique factorization in Z[i]\mathbb{Z}[i] forces a+bia+bi to be a unit multiple of π\pi or πˉ\bar\pi. The four units {1,−1,i,−i}\{1,-1,i,-i\} only permute signs and swap a↔ba\leftrightarrow b, so {a,b}={c,d}\{a,b\}=\{c,d\} as unordered pairs. This uniqueness is special to primes; composite nn with several prime factors ≡1(mod4)\equiv1\pmod4 typically admit multiple genuinely different representations, as seen with n=1025n=1025 above.

How does this connect to sums of four squares?

Lagrange's four-square theorem states every nonnegative integer is a sum of four squares, with no congruence obstruction whatsoever — a striking contrast to the two-square case. The underlying reason is that the relevant "integers with norm," the Hurwitz quaternions, form a noncommutative analog of a Euclidean domain with enough units and enough flexibility that no prime is ever "inert" in the same obstructive sense; every prime factors compatibly. The two-square theorem is thus the delicate, obstruction-laden special case, while Sums of Four Squares is the unconditional generalization, and both sit inside the broader landscape of Binary Quadratic Forms and quaternionic arithmetic.

Where this leads