Post-quantum cryptography: why encryption is changing even before the advent of quantum computers

A quantum computer capable of breaking today’s internet encryption does not yet exist. Nevertheless, encryption is already changing. The reason is simple: encrypted data can be intercepted today and read later. What risk does this pose to the average user, and what changes are already taking place in web browsers?

Why Quantum Computers Pose a Threat to Today’s Encryption

Most secure communication on the internet relies on public-key cryptography. Algorithms such as RSA or elliptic curve cryptography (ECC) are used, for example, to establish a shared key between a browser and a server. Their security depends on mathematical problems that are intractable for today’s computers.

In theory, a sufficiently large quantum computer could solve them using the so-called Shor’s algorithm. However, the exact time—often described as “a few seconds”—depends on the machine’s parameters and is not guaranteed. More importantly, such a machine does not yet exist. Estimates of when it might be built vary: optimistic estimates suggest 10 to 20 years, while pessimistic ones suggest less than ten.

What quantum computers do not threaten in the same way

This is common knowledge, not a claim from a single source: public-key encryption and key exchange are particularly at risk. Symmetric encryption, which protects the data content itself, is considered less vulnerable.

Harvest Now, Decrypt Later

Experts refer to this risk as “harvest now, decrypt later.” An attacker intercepts encrypted communications now, stores them, and reads them only when a sufficiently powerful quantum machine becomes available. This means they don’t have to wait for a quantum computer to get started.

Who Is Most Affected

The risk is most serious for data that must remain secret for years: state secrets, intellectual property, or long-term financial records. For a message whose content will be of no interest to anyone in ten years, the consequences are much less severe. The claim that every secret sent today will be public in a few years is therefore an exaggeration.

What We Know About Data Collection

Several sources indicate that government actors collect such data. We did not find the scope or concrete evidence of this in primary sources during our research; therefore, we do not present it as a verified fact. However, the mere possibility of such an attack typically leads experts and authorities to view migration as an urgent priority.

What Post-Quantum Cryptography Looks Like

Post-quantum cryptography (PQC) consists of algorithms designed to withstand attacks by both classical and future quantum computers. In August 2024, the U.S. National Institute of Standards and Technology (NIST) published the first standards: ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures. In March 2025, it also selected the fallback algorithm HQC, which is based on different mathematics.

Hybrid Approach

Instead of immediately replacing the old algorithms, a combination is now used. The browser and server agree on a key using both the classical method and the post-quantum method simultaneously. If one of them proves to be weak, the other still protects the connection. According to available overviews, NIST permits hybrid key exchange.

What Is Already Deployed in Browsers

Unlike many technologies that are merely being discussed, this one is already in use. According to reports, most current browsers automatically use the hybrid key exchange designated X25519MLKEM768 if the server also supports it. This has been confirmed for Chrome and Firefox. Sources differ on when and exactly how this applies to Safari, so we cannot confirm it here.

According to data from a large content delivery network, more than two-thirds of traffic from users to its network used this hybrid key exchange from April through June 2026. At the end of 2025, approximately 52% of TLS 1.3 traffic was using this method. The deployment comes at a cost: the transition from classic key exchange to hybrid adds approximately 1,600 bytes of data to the connection.

What’s Still to Be Done

The protection pertains to the key exchange, meaning it prevents the retroactive decryption of recorded communications. According to sources, post-quantum certificates and signatures are still a long way off. U.S. national security requirements call for the exclusive use of post-quantum algorithms in critical systems by 2035, and the recommended phase-out of classical public-key algorithms is projected for around 2030.

What Can the Average User Do?

• Update your browser, operating system, and applications. Post-quantum key exchange is primarily implemented through updates.
• You don’t need to configure anything. Protection applies only if the server you’re connecting to also supports it.
• Don’t rely on guarantees. Deployment is still incomplete and primarily concerns key exchange. Therefore, no single service can guarantee that today’s data will still be secure a decade from now.
• Data that remains sensitive over the long term requires organizations’ attention: an inventory of the algorithms used and a migration plan.

Conclusion

The quantum threat is not immediate, but the risk of data being collected today and decrypted later has changed the timeline. Post-quantum standards exist and are already being used in browsers in a hybrid form. The most important thing is to distinguish between them: key exchange is significantly more advanced than certificates and signatures, and the average user can help, above all, by not delaying updates.