Post-quantum cryptography (PQC) is encryption designed to resist future quantum computers, and the migration is already underway. NIST finalised its first PQC standards in August 2024 (ML-KEM, ML-DSA and SLH-DSA). Chrome, Cloudflare and other major platforms already use hybrid key exchange (classic X25519 combined with ML-KEM) for a large share of HTTPS traffic. A 2026 measurement study found roughly half of analysed domains already show partial post-quantum readiness through hybrid key exchange.
Why act before quantum computers exist
"Harvest now, decrypt later": attackers can record encrypted traffic today and decrypt it once quantum computers are capable. Data that must stay secret for years, like health, financial and legal records, is at risk now, not later.
The timeline
- 2024: NIST standards finalised.
- 2026: hybrid key exchange widespread in browsers and CDNs. Signatures and certificates lag behind.
- 2027: Let's Encrypt is working toward post-quantum certificate approaches, with production readiness targeted for 2027.
- 2030–2035: NIST's draft transition plan deprecates and then disallows quantum-vulnerable algorithms like RSA and elliptic-curve cryptography. Check NIST for final dates.
What website owners should do
- Use a modern host or CDN. If your site sits behind Cloudflare or a major platform, you may already get hybrid post-quantum key exchange with no changes.
- Keep TLS libraries and servers updated, since PQC support arrives through updates.
- Inventory your cryptography: where your app signs tokens, encrypts data or calls APIs, and with which algorithms.
- Prefer crypto-agile designs: algorithms configured in one place, not hard-coded across the codebase.
- Prioritise long-lived secrets: data that must stay confidential for 10+ years should be reviewed first.
For most small business websites, step 1 does most of the work. For apps handling sensitive long-term data, plan properly.
Secure websites by default
At NextGen Fusion, our web development company in Lucknow, we deploy on modern, regularly updated infrastructure and keep cryptography configurable, so clients benefit from security upgrades like PQC without rebuilds.
