What Is Post-Quantum Encryption? Why It Matters Even If You're Not a Programmer

Post-quantum encryption is cryptography designed to stay secure against an attacker holding a large quantum computer. It replaces the specific maths — RSA and elliptic-curve problems — that such a machine could solve, and it runs perfectly well on the ordinary laptop or phone you already own.

It matters to non-programmers for one unglamorous reason: some of the data you send today has a long shelf life, and an attacker does not need a quantum computer today in order to benefit from one later.

What quantum computers actually threaten

Almost every secure connection you make performs two separate jobs. First a public-key handshake agrees on a shared secret and proves the server's identity. Then a symmetric cipher — usually AES — encrypts the actual traffic with that secret.

Only the first job is in serious danger. Peter Shor showed in the mid-1990s that a sufficiently powerful quantum computer could factor large numbers and compute discrete logarithms efficiently, which is precisely what RSA and elliptic-curve cryptography rely on being hard. Symmetric encryption is affected far less; the practical answer there is larger keys, not new mathematics.

So the migration is targeted rather than total. What needs replacing is the handshake and the signature — the parts covered in what is encryption and how does it work and visible in every certificate you can inspect with our SSL checker.

Harvest now, decrypt later

This is the phrase that explains the urgency, and it involves no futurism at all. An adversary with the capacity to record traffic can store encrypted data now and simply wait. When a cryptographically relevant quantum computer exists, that archive becomes readable retroactively.

The exposure therefore depends on how long your data stays sensitive. A session cookie loses value in hours. Medical records, legal advice, source code, diplomatic cables, genetic data and financial histories stay sensitive for decades — which is why the US National Security Agency's Commercial National Security Algorithm Suite 2.0 advisory sets out a transition timeline for national security systems rather than waiting for a working machine to appear.

The standards that now exist: ML-KEM and ML-DSA

Post-quantum cryptography stopped being theoretical in 2024. On 13 August 2024 the US Secretary of Commerce approved three Federal Information Processing Standards published by NIST:

• FIPS 203 — ML-KEM, a module-lattice key-encapsulation mechanism derived from CRYSTALS-KYBER, used to agree on session keys.
• FIPS 204 — ML-DSA, a module-lattice digital signature algorithm derived from CRYSTALS-Dilithium, used to sign and verify.
• FIPS 205 — SLH-DSA, a stateless hash-based signature scheme derived from SPHINCS+, useful where a different security assumption is wanted.

NIST also selected FALCON, being published as FIPS 206, and later selected HQC as a backup key-encapsulation mechanism built on a different mathematical family — sensible insurance in case lattice assumptions weaken. The names look forbidding, but the roles are the familiar two: agree a key, sign a message.

Post-quantum cryptography explained simply: the lock analogy

Classical public-key cryptography works like a padlock whose combination is the product of two enormous prime numbers. Multiplying them is easy; recovering them from the product is not — for a classical computer. Shor's algorithm is a shortcut that only a quantum computer can run.

Lattice-based schemes change the puzzle rather than the lock size. Imagine an immense regular grid of points in hundreds of dimensions and a target point sitting slightly off-grid; the task is to find the nearest grid point. Adding dimensions makes this brutally hard for classical and quantum computers alike, and no shortcut comparable to Shor's is known. That is the whole idea behind ML-KEM.

It is already switched on in places you use

Deployment began ahead of the threat, using hybrid key exchange: a connection performs both a classical X25519 exchange and an ML-KEM exchange, and mixes both results. If either holds, the session is safe — so adopting post-quantum maths early costs nothing in security even if an implementation flaw is later found.

The hybrid named X25519MLKEM768 is the one you will see referenced in browser and network documentation, and Cloudflare's post-quantum documentation describes deploying it specifically to protect against harvest-now-decrypt-later attacks. Major messaging platforms have added post-quantum key agreement to their protocols on the same reasoning.

Practically, this means a current browser talking to an updated server is often already using post-quantum key exchange without any setting being touched — and without you noticing, since the performance difference is negligible on modern hardware.

What a non-programmer should actually do

1. Let updates install. Browser, phone and operating system updates are the delivery mechanism for post-quantum key exchange; an old browser simply cannot negotiate it.
2. Prefer end-to-end encrypted services for anything with a long confidentiality horizon — private messages, legal documents, health records.
3. Ask vendors about their timeline if you run a business. 'When will your service support ML-KEM?' is a reasonable procurement question in 2026.
4. Shorten the life of stored secrets where you can: rotate long-lived credentials, avoid archiving sensitive material in plaintext backups.
5. Keep the basics working. Quantum computing does not change the fact that most real-world breaches start with a stolen password or a convincing message, so two-factor authentication and password hygiene remain the highest-value defences.

The reassuring version is this: the cryptographers moved first. Standards exist, hybrid deployment is under way, and for most people the migration will arrive as a routine software update rather than as a crisis. The part worth attending to is anything you send today that still needs to be secret in fifteen years.