what is post quantum encryption post quantum cryptography explained harvest now decrypt later ML-KEM post quantum encryption vpn quantum computing

What is post-quantum encryption? A plain-English guide

Adrian Maverick · · 8 min read

Somewhere, someone is saving encrypted data they cannot read yet: login sessions, medical portal traffic, old email. They are betting that a future machine will open it. That bet is why "post-quantum" keeps showing up in your app updates.

Post-quantum encryption is encryption built on math problems that quantum computers are not expected to solve. It runs on ordinary phones and computers, replaces or backs up today's RSA and elliptic-curve methods, and protects data now against attackers who record it today and try to decrypt it once large quantum computers exist.

Post-quantum cryptography explained without the jargon

Almost all encryption you rely on uses a problem that is easy one way and extremely hard in reverse. RSA relies on the fact that multiplying two huge prime numbers is easy, but working out which two primes made the result would take a normal computer an impractically long time. Elliptic-curve cryptography (ECC), which protects most modern apps, uses a different hard problem with the same idea.

Quantum computers attack some problems in a fundamentally different way. A method called Shor's algorithm, run on a large enough quantum machine, could reverse both the RSA and the elliptic-curve tricks. Post-quantum cryptography swaps in different hard problems, mostly built on lattices and hash functions, for which no fast quantum attack is known.

Two points worth being clear on:

  • It is not quantum technology. Post-quantum encryption is ordinary software. You do not need special hardware.
  • The machine does not exist yet. Today's quantum computers are nowhere near strong enough to break real encryption, and nobody can give you the year one arrives.

Post-quantum vs RSA: what actually changes

Today's public-key encryption Post-quantum encryption
Common names RSA, ECC, X25519 ML-KEM, ML-DSA, SLH-DSA
Hard problem Factoring, discrete logarithms Lattice problems, hash functions
Threat from a large quantum computer Broken by Shor's algorithm No known efficient attack
Runs on Normal devices Normal devices
Typical deployment in 2026 Still everywhere Combined with X25519 as a "hybrid"

Most real deployments are hybrid: they combine a classical algorithm with a post-quantum one, so an attacker has to break both. If a flaw is ever found in the newer math, the classical layer still holds, and vice versa.

Why it matters before quantum computers exist: harvest now, decrypt later

Attackers do not need a quantum computer today. They only need your encrypted data today. The strategy is called harvest now, decrypt later: intercept encrypted traffic, store it, and decrypt the archive once a capable machine exists.

So the useful question is not "when will quantum computers arrive?" It is "how long does this need to stay secret?" A group chat about lunch, not long. Medical records, legal matters, financial history, and anything that could still hurt you in ten years are exactly what is worth harvesting now. That is why NIST, when it published the first standards, urged system administrators to "start integrating them into their systems immediately, because full integration will take time."

The standards are finished

After a public competition that began in 2016, the US National Institute of Standards and Technology published its first three finalized post-quantum standards on August 13, 2024:

  • ML-KEM (FIPS 203), for agreeing on a secret key between two devices. It came from an algorithm called CRYSTALS-Kyber.
  • ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), for digital signatures that prove a message or software update is genuine.

On March 11, 2025, NIST selected HQC as a backup for key agreement, built on different math so a weakness in one approach does not take out both.

You are probably already using it

This is the fact the enterprise guides skip.

  • iMessage. Apple's PQ3 protocol, announced in February 2024 and shipped with iOS 17.4, uses Kyber, the algorithm NIST standardized as ML-KEM, specifically to defend against harvest-now, decrypt-later attacks.
  • Signal. Signal added a post-quantum handshake called PQXDH in 2023 and, in October 2025, a post-quantum ratchet (SPQR) so the keys that rotate during a conversation are protected too.
  • Your browser. Chrome turned on hybrid post-quantum key agreement by default on desktop in 2024, Firefox followed, and Apple enabled it with its OS 26 releases in 2025. Cloudflare reported that by October 2025, more than half of human-initiated traffic through its network was post-quantum encrypted.

Check your own connection in 30 seconds

  1. Visit Cloudflare's test page at pq.cloudflareresearch.com. It checks whether the connection your browser just made used post-quantum key agreement.
  2. Or, in Chrome or Edge on desktop, open developer tools (F12), go to the Security (or Privacy and security) panel, and look at the connection details. A key exchange named X25519MLKEM768 means a hybrid of classical X25519 and post-quantum ML-KEM.

If the test comes back negative, update your browser. Post-quantum support arrives through ordinary updates.

Is post-quantum encryption worth it?

For most people there is nothing to buy and little to do. A few habits matter:

  1. Keep devices and apps updated. That is how these protections reach you.
  2. Ask about post-quantum when choosing tools for long-lived data, the same way you would ask about end-to-end encryption.
  3. Sort by shelf life. Move the things that must stay secret for a decade onto post-quantum tools first.
  4. Ignore "quantum-proof" gadgets. This is software. Nobody needs a special USB stick.

What about email and VPNs?

Messaging and browsers moved first. Email is where a lot of long-lived personal data sits, such as password resets, contracts, medical results, and tax documents, and most of it is still protected only by classical encryption, often with the provider holding the keys. If you are not sure what your inbox does, here is how to check whether your email is encrypted, and our earlier post covers why post-quantum email encryption matters in more depth.

Secria Mail uses hybrid post-quantum encryption, ML-KEM-1024 combined with X25519, on every plan, including the free one, with nothing to switch on. Stored mail sits under zero-access encryption, sealed with keys we never hold. Your mail is end-to-end encrypted, and mail arriving from other providers is encrypted to your key when it reaches us.

VPNs are the other common place you will see the term. A VPN's tunnel is a stream of encrypted traffic that is easy to record, which makes it a natural harvest target. Secria VPN adds ML-KEM-1024 to WireGuard for that reason.

Frequently asked questions

Is post-quantum encryption unbreakable?

No encryption is. "Post-quantum" means resistant to the quantum and classical attacks known today, after years of public review. That is why NIST picked a backup algorithm and why most deployments are hybrid.

When will quantum computers break encryption?

Nobody knows. Estimates range from about a decade to much longer. Because harvested data can be decrypted later, the timeline matters less than how long your data needs to stay private.

What does ML-KEM mean?

Module-Lattice-Based Key-Encapsulation Mechanism. It is NIST's standardized post-quantum method for two devices to agree on a secret key, published as FIPS 203.

Do I need to change anything today?

Mostly, keep your software updated. Be deliberate only about long-lived sensitive data, where it is worth choosing tools that already use post-quantum encryption.

The standards exist, some of your apps already use them, and the rest arrives through updates. The job left is making sure the data that matters most is not the data left behind.

Sources

Secria fact-checks every post against primary sources. Spotted something wrong or out of date? Email hq@secria.me and we will correct it.

Back to all posts