Post-quantum encryption is the replacement generation of public-key cryptography designed to resist quantum computers, which would break the RSA and elliptic-curve systems securing most internet traffic today. The standards now exist — NIST finalized the first post-quantum algorithms in August 2024 — and deployment has quietly begun: Chrome and Firefox already negotiate post-quantum key exchange for a large share of connections, and Apple's iMessage PQ3 protocol turned on by default in 2024. For organizations, the practical task is inventory and planning, because the migration touches every device, service, and certificate that uses cryptography, and the threat has a head start.
What exactly is the threat?
Today's encryption splits into two kinds. Symmetric encryption — AES, used to scramble files and disk volumes — is largely quantum-resistant, with its effective strength merely halved. Asymmetric, or public-key, cryptography — RSA and elliptic-curve — is the vulnerable part: it underpins TLS key exchange, certificate signatures, code signing, and identity systems, and a sufficiently large quantum computer running Shor's algorithm breaks it outright. The consensus of cryptographic agencies, including the U.S. National Security Agency's public guidance, is that such a machine is unlikely within a few years but plausible over the coming decades — and the timeline that actually matters is harvest now, decrypt later: adversaries recording encrypted traffic today to decrypt once the machine exists. Data that must stay confidential for ten-plus years is already at risk, which is why intelligence agencies do the recording and why standards bodies moved early.
What did NIST actually standardize?
After an eight-year public competition, NIST published the first final standards in August 2024: ML-KEM (based on the CRYSTALS-Kyber winner) for key encapsulation — the TLS handshake replacement — and ML-DSA (CRYSTALS-Dilithium) plus SLH-DSA (SPHINCS+) for digital signatures. A second key-establishment algorithm, HQC, was selected in March 2025 as a backup built on different mathematics, hedging against a future break in lattices. The design philosophy is conservatism: multiple algorithms from unrelated mathematical families, so that collapsing one does not collapse the system.
Where is deployment already happening?
Farther along than most reporting suggests. Google enabled post-quantum key exchange by default in Chrome in 2024, Mozilla followed in Firefox, and Cloudflare reported that a substantial share of its traffic already negotiates hybrid post-quantum key exchange — meaning the connection mixes a classical and a post-quantum algorithm, so it is no weaker than today even if the new math turns out flawed. Apple's PQ3 brought post-quantum protection to iMessage in 2024; Signal added its PQXDH handshake in 2023. The U.S. government set its own clock: NSA's CNSA 2.0 suite requires national-security systems to begin transitioning by 2025-2030, with full post-quantum adoption by 2033, and federal civilian guidance points the same direction.
What should organizations do now?
The migration is a decade-long program, but the 2026-era work is concrete:
- Build a cryptographic inventory. You cannot migrate what you cannot see: catalog where RSA and elliptic-curve are used — TLS termination, VPNs, code signing, payment HSMs, embedded firmware — including anything with a 10-year service life.
- Prioritize long-lived secrets and long-lived devices. Traffic that adversaries may be recording today, and hardware that cannot be upgraded in the field, lead the list.
- Prefer hybrid modes where offered. Hybrid classical-plus-post-quantum key exchange is available now in major cloud and TLS stacks and carries near-zero additional risk.
- Watch certificate lifetimes and crypto-agility. Shorter-lived certificates and the ability to swap algorithms without re-engineering turn the 2030s deadline from a crisis into routine maintenance.
- Include vendors in procurement. Ask every supplier for their post-quantum roadmap; the question is already standard in government RFPs and will reach commercial contracts whether or not you ask first.
What about individuals?
Nothing to do — the migration happens inside browsers, apps, and services, and the main consumer-grade action is keeping software current so post-quantum support arrives as it ships. The realistic personal-risk view: ordinary browsing and messaging gain protection automatically over the next few years; the harvest-now threat applies chiefly to traffic whose confidentiality must survive into the quantum era, which for most people means the handled-by-big-platforms categories above. The story to watch is institutional readiness, because the organizations that publish migration plans this decade will be boring; the ones that discover in 2031 that their payment terminals cannot be upgraded will not be.
For more context, read The cybersecurity skills shortage: how many jobs, and does it even exist?.
For more context, read school ransomware attacks.
For more context, read Who pays for the open source everything runs on?.