Being built

Methmailprivate email

What is post-quantum encryption?

Updated: · Sources checked:

In short. Post-quantum encryption uses algorithms that a future quantum computer is not expected to break. It matters now because encrypted mail can be copied today and decrypted years later. The standards are ready: NIST published the main ones in 2024 [1], and OpenPGP email got its own in June 2026 [4]. Services usually combine a new algorithm with a classical one, so that breaking one of them is not enough.

What a quantum computer would break

Email encryption today rests on two kinds of cryptography [5]:

  • Public-key algorithms: RSA and elliptic curves (ECDH, ECDSA, EdDSA). They are used to agree on keys and to sign messages. A large enough quantum computer could compute a private key from a public one [7], and then read or forge messages.
  • Symmetric encryption, such as AES. It encrypts the content itself. Quantum computers do not weaken it significantly: keys of 128 bits and more can stay in use [5].

So the weak point is the key exchange. Whoever recovers a private key can decrypt everything that key protected.

Harvest now, decrypt later

An attacker does not have to wait for a quantum computer to start. Encrypted traffic and copies of encrypted mail can be collected today and decrypted once such a machine exists [5] [7]. For messages that must stay secret for years, such as medical, legal or business ones, the risk is already here.

Nobody knows when such a computer will appear. Estimates of how big it must be keep falling: in 2019, breaking a 2048-bit RSA key was estimated to need 20 million noisy qubits; in 2025, one of the authors of that estimate put it at under a million, working for less than a week [6]. In a draft transition plan, NIST proposes to stop allowing today’s public-key signatures, RSA and ECDSA among them, after 2035 [3].

The new standards

  • August 2024. NIST published three standards: FIPS 203 (ML-KEM) for encryption, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures [1].
  • March 2025. NIST chose HQC as a backup for ML-KEM. It is built on different mathematics, so if a weakness is found in one, the other remains [2].
  • June 2026. RFC 9980 brought post-quantum algorithms to OpenPGP, the standard for encrypted email: ML-KEM combined with X25519 or X448 for encryption, and ML-DSA combined with Ed25519 or Ed448, plus SLH-DSA, for signatures [4].

Why hybrid

The new algorithms are young. So a classical algorithm and a post-quantum one are used together, and the key depends on both: to decrypt a message, an attacker has to break both of them [4].

On the web this is already the norm. Chrome, Firefox and Apple’s systems agree on keys this way by default, and by October 2025 more than half of the HTTPS traffic from people to Cloudflare used the hybrid X25519MLKEM768 [9]. Messengers moved earlier: Signal in September 2023 [7], iMessage in February 2024 [8].

Post-quantum encryption in email today

  • Between users of one service. Some email services already use a hybrid scheme: Tuta turned it on by default for new accounts in March 2024 [10], and Proton has offered it as an option since May 2026 [11].
  • Between different services. Only through OpenPGP, and only if both sides support RFC 9980 keys. Not every PGP program does yet: GnuPG, for example, does not by default [12]. More in What is PGP?
  • Mail without end-to-end encryption. Between mail servers it travels over TLS. Whether that hop is post-quantum depends on the servers at both ends.

What post-quantum encryption does not change

  • Metadata. Addresses, time and often the subject stay visible, just as with classical encryption. More in Email metadata.
  • Signatures. Where they stay classical, a future quantum computer could forge them. Signatures confirm authorship; they do not hide content.
  • Your device and your recipient. Encryption does not protect against malware on your device or against a recipient who forwards your email.

Post-quantum encryption and Methmail

Emails between Methmail users and all stored mail will be protected with hybrid post-quantum encryption (ML-KEM-768 plus X25519), on by default from day one. Decrypting a message would require breaking both algorithms. An external PGP recipient will get a post-quantum message only if their key supports RFC 9980. For external mail without PGP, protection in transit will depend on the recipient server’s TLS. A message from an external PGP sender without post-quantum protection will get it when Methmail first syncs it in your browser; until then it will be protected classically. Signatures and sign-in checks will stay classical for now: they confirm authorship and access and reveal no content. We will move to post-quantum signatures once major PGP programs support the standard. The other limits are under What Methmail won’t be able to do.

Sources

  1. NIST: NIST Releases First 3 Finalized Post-Quantum Encryption Standards. August 13, 2024. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards
  2. NIST: NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption. March 11, 2025. https://www.nist.gov/news-events/news/2025/03/nist-selects-hqc-fifth-algorithm-post-quantum-encryption
  3. NIST IR 8547, initial public draft: Transition to Post-Quantum Cryptography Standards. November 2024. https://csrc.nist.gov/pubs/ir/8547/ipd
  4. RFC 9980: Post-Quantum Cryptography in OpenPGP. IETF, June 2026. https://www.rfc-editor.org/rfc/rfc9980
  5. NCSC: Next steps in preparing for post-quantum cryptography (updated April 2026). https://www.ncsc.gov.uk/whitepaper/next-steps-preparing-for-post-quantum-cryptography
  6. Craig Gidney: How to factor 2048 bit RSA integers with less than a million noisy qubits. arXiv, May 2025. https://arxiv.org/abs/2505.15917
  7. Signal: Quantum Resistance and the Signal Protocol. September 19, 2023. https://signal.org/blog/pqxdh/
  8. Apple Security Research: iMessage with PQ3. February 21, 2024. https://security.apple.com/blog/imessage-pq3/
  9. Cloudflare: State of the post-quantum Internet in 2025. October 28, 2025. https://blog.cloudflare.com/pq-2025/
  10. Tuta: Celebrating one year of quantum-safe encryption in Tuta Mail & Tuta Calendar. March 11, 2025. https://tuta.com/blog/celebrating-one-year-pq-launch
  11. Proton: Proton Mail introduces post-quantum encryption. May 5, 2026. https://proton.me/blog/introducing-post-quantum-encryption
  12. GnuPG: GnuPG 2.5.24 and Gpg4win 5.1.1 released (the --allow-9980 option, off by default). September 23, 2026. https://lists.gnupg.org/pipermail/gnupg-announce/2026q3/000516.html