Post-Quantum Encryption: Your Browser Already Switched

TL;DR (Direct Answer): Post-quantum encryption is a new kind of digital lock designed to resist future quantum computers. Attackers can record your encrypted traffic today and wait to decrypt it later, so the web is upgrading before that becomes possible. Chrome, Firefox, Cloudflare, Signal and Apple already combine an old lock with a new one by default. For most people the switch has already happened with no action required.

The Stolen Diary Problem: Harvest Now, Decrypt Later

Imagine a thief steals your locked diary. He can't open it today. But he's heard a master key will exist in about ten years, so he puts it on a shelf and waits.

That is harvest now, decrypt later (HNDL): attackers record encrypted internet traffic today and plan to decrypt it once quantum computers are strong enough. A quantum computer is a machine that uses quantum physics to solve certain math problems far faster than normal computers.

Why should you care? Some secrets stay valuable for a long time. Health records, legal documents, banking details and private messages could still hurt you in 2035. The encryption that protects them has to survive not just today's attackers, but tomorrow's.

How It Works: Old Math, New Mazes

Why today's locks are at risk

RSA and elliptic-curve cryptography (ECC) are the math behind most of today's secure connections. They rely on problems that are easy to create but very hard to reverse, such as factoring huge numbers. In 1994, Peter Shor described a quantum method, now called Shor's algorithm, that solves exactly these problems quickly. A large enough quantum computer would unlock them.

The new locks: lattices

Lattice-based cryptography hides secrets inside a huge, noisy grid of points in hundreds of dimensions. Think of a maze with a few deliberate wrong turns added. No known shortcut, quantum or classical, solves it efficiently.

In 2024, NIST (the U.S. standards agency) published official standards for these algorithms. ML-KEM (formerly Kyber) agrees on a shared secret key. ML-DSA (formerly Dilithium) creates digital signatures.

Why "hybrid" uses two locks

New math is less battle-tested. So hybrid key exchange combines the proven X25519 (a fast elliptic-curve method) with ML-KEM. An attacker must break both locks to read your data.

Comparing the Options

Approach	Safe from quantum?	Size on the wire	Speed	Maturity risk	Where you'll find it
Classic ECC (X25519)	No	Tiny (32 bytes)	Very fast	Very low	Everywhere, legacy
Pure post-quantum (ML-KEM)	Yes	Larger (~1.1 KB)	Fast	New math, less tested	Specialized and government systems
Hybrid (X25519 + ML-KEM)	Yes	Larger (~1.2 KB)	Fast	Lowest overall	Chrome, Firefox, Cloudflare, OpenSSH 10

Messaging apps use the same idea. Signal's PQXDH (2023) and Apple iMessage PQ3 (2024) both add post-quantum keys alongside classic ones. The trade-off is small: about a kilobyte of extra data per connection buys protection against a future threat.

Try It Yourself: Seeing the Hybrid Handshake

A TLS handshake is the quick "hello" in which your browser and a website agree on a secret key before any page loads.

 Browser                                  Server
   |-- ClientHello -------------------------->|
   |   "I speak X25519MLKEM768"               |
   |   + X25519 share + ML-KEM public key     |
   |                                          |
   |<-- ServerHello --------------------------|
   |   X25519 share + ML-KEM ciphertext       |
   |                                          |
   | secret = combine(X25519, ML-KEM)         |
   |== encrypted traffic (AES / ChaCha20) ===>|

The diagram shows both locks traveling together, then merging into one shared secret.

Check it in your browser: in Chrome, open DevTools (F12), go to the Privacy and security panel and look for X25519MLKEM768 under the connection's key exchange.

Check your SSH client: run ssh -Q kex | grep mlkem. This lists the post-quantum key-exchange methods your SSH client supports. If mlkem768x25519-sha256 appears, you're ready. On a homelab server, update to OpenSSH 9.9 or newer, where version 10 uses it by default. To experiment with ideas like this hands-on, visit our Interactive Engineering Simulations.

Myths, Middleboxes, and the Quiet Switch

Common myths

• "Quantum computers already break everything." They don't. Today's machines are far too small and error-prone.
• "AES-256 is dead too." No. AES is the symmetric cipher that encrypts your actual data. Quantum attacks only weaken it modestly, so AES-256 stays strong.
• "Just make RSA keys bigger." Shor's algorithm scales too well for bigger keys to help much.
• "Post-quantum means quantum hardware." It's ordinary software running on your existing devices.

The day the handshake got heavier

In 2024, Chrome turned on hybrid key exchange by default, first with Kyber and then with ML-KEM. The browser's opening message grew past a single network packet. Some old enterprise proxies and firewalls had assumed it never would, so they dropped the connection. Google offered a temporary admin setting to switch it off while vendors shipped fixes.

The lesson is crypto agility: systems should be able to swap algorithms without breaking. For billions of users, nothing visible happened at all. Explore more explainers like this in our AI Playground.

Frequently Asked Questions (FAQ)

When will a quantum computer break RSA?

No one knows for certain. Most expert estimates range from the early 2030s to well beyond 2040, and some think it may take longer. Breaking RSA-2048 would need many thousands of stable, error-corrected qubits, which is far beyond today's machines. Because recorded data can be decrypted later, the industry is upgrading now instead of waiting for a firm date.

Do I need to do anything on my phone or computer?

Mostly, just keep your software updated. Current versions of Chrome, Edge, Firefox and Safari, along with updated iOS, Android, macOS and Windows systems, handle post-quantum key exchange automatically. You don't need special settings or apps. If you use an outdated browser, or a work network with an old proxy, you may not get the protection yet, so updates matter most.

Are my old WhatsApp/Signal messages safe?

Signal added post-quantum protection (PQXDH) in 2023, so newer conversations resist harvest-now-decrypt-later attacks. Messages sent before that relied only on classic elliptic curves. In theory, recorded copies of those could be exposed someday. WhatsApp's encryption is based on the Signal Protocol, but check its current announcements for post-quantum status. Disappearing messages limit how long any stored copy is useful.

Is my VPN or password manager post-quantum ready?

It depends on the product. Some VPNs, including certain WireGuard-based services and providers offering post-quantum options, already add quantum-resistant key exchange. Others are still testing it. Password managers usually encrypt your vault with AES-256, which remains strong. Their sync connections rely on TLS, which improves as browsers and servers upgrade. Check each vendor's security page for an explicit "ML-KEM" or "post-quantum" mention.

What should homelab and self-hosting owners upgrade first?

Start with SSH, since it guards admin access. Upgrade to OpenSSH 10 or newer to get hybrid ML-KEM by default. Next, update your reverse proxy or web server, such as nginx, Caddy or HAProxy, and its TLS library, such as OpenSSL 3.5 or newer, to enable X25519MLKEM768. Finally, update VPN software. Keep classic algorithms enabled as a fallback so older devices can still connect.