Blog ·

Oct 27, 2026 · 4 min read

Are you already using post-quantum encryption?

A slanted three-dimensional grid of white dots with two points marked by large dots. A bright path joins them in three steps from point to point, and a dim path wanders between them the long way round.

“Post-quantum encryption” sounds like something you’d have to go out and buy, or at least switch on in a settings menu you’ve never opened. Most people who hear about it assume they don’t have it yet.

Most of them do. If your phone and browser are up to date, they already use encryption that a future quantum computer isn’t known to be able to break, whenever they talk to most large websites. Signal and iMessage use it for messages too. It arrived through ordinary software updates, so you didn’t have to do anything to get it, and the work that’s still left is up to the companies that run websites and apps rather than you.

Your phone and a website agree on a secret key before anything else

When your phone connects to a website, the two sides first agree on a secret key, and everything sent after that is locked with it. The tricky part is that they have to agree on that key over the open internet, where anyone might be listening.

For years they did it using a method called elliptic-curve cryptography. It lets the two sides swap numbers in a way that leaves an eavesdropper unable to work out the key, at least with an ordinary computer. A large enough quantum computer could work out the key from a recording of that first exchange, then unlock everything sent with it.

A new method, approved in 2024, replaces the weak step

In 2024 the US standards agency, NIST, approved a replacement for that key-agreeing step, called ML-KEM. It’s built on a different kind of math puzzle, one that nobody knows how to speed up with a quantum computer.

Browsers don’t throw the old method away. They run both together and combine the results, so an attacker would have to break both to get the key. That’s a sensible precaution: if someone ever finds a flaw in the new method, your connection is still as safe as it was before the switch.

You might wonder why anyone bothered so early, years before any quantum computer can break anything. The reason is that encrypted traffic can be recorded today and unlocked later, once a big enough machine exists. This is called harvest now, decrypt later. A key agreed with the new method can’t be recovered from a recording, however good quantum computers get, so anything sent this way today stays private in the future too.

Most browsers and the biggest secure messaging apps already use it

  • Chrome and Edge: since 2024.
  • Firefox: since late 2024.
  • Safari, and every app on an iPhone or Mac: since iOS 26 and macOS 26, in September 2025.
  • iMessage: since March 2024.
  • Signal: since September 2023.

WhatsApp is the big gap among messaging apps. Can quantum computers read my text messages? goes through which messaging apps are protected and what that means for you.

About two-thirds of web traffic to Cloudflare now uses it

A browser that supports the new method is only half the story. Both sides of a connection have to support it, so it depends on websites as much as on your browser. Cloudflare, a company that sits in front of about a fifth of all websites and handles the traffic people send them, publishes the share of that traffic using the new method:

Share of web traffic people sent to Cloudflare that used post-quantum encryption. Full width is 100%.

January 2025

about 32% · Cloudflare Radar

October 2025

about 50% · Cloudflare

Mid 2026

about two-thirds · Cloudflare Radar

Most of the remaining third comes from older phones and computers that haven’t been updated. Those get replaced over time, and browser updates did most of the work of getting this far, so the share should keep climbing.

Three things still aren’t protected

Only the connection between your phone and the nearest big network has been fixed. Three other pieces haven’t been.

The website’s own computers. Cloudflare often passes your request on to the website’s own server, and far fewer of those servers support the new method yet. The same goes for a bank’s internal systems and for email traveling between mail servers. What would Q-Day mean for your bank? covers the banking side.

Proof that a website is real. When you visit your bank’s website, it proves it really is your bank using a digital signature, a kind of stamp only the real bank can make. Those signatures still use the old, quantum-breakable method everywhere. This is less urgent than the key, because faking a signature needs a working quantum computer at the moment of the attack, so a recording made today is no use to anyone. It still has to be fixed before such a machine exists. The new signatures are much bigger than today’s, which would make every connection slower to set up, so Google said in March 2026 that Chrome will switch to a more compact design, rolling out through 2027.

Anything already recorded. Messages and pages sent before a service switched were protected the old way. Switching now doesn’t change recordings someone already made.

The switch has been fast on your devices and slow everywhere else

A method approved in August 2024 was protecting most browser traffic to the largest networks within two years. For comparison, the last big change of this kind, moving the web from unencrypted connections to encrypted ones, took most of a decade. On your side, the only thing to do is keep your phone and browser updated, and for most people that has happened already.

The slow part is everything you never see: servers, signatures, and systems built to run unchanged for decades. That’s where the risk sits now, and it’s why how close quantum computers are still matters.

Sources

Read next