Cybersecurity experts warn that about 10-20 years from now, quantum computers will have enough processing power to decipher common cryptography techniques like RSA and ECC, an event they call “Q-Day.” These encryption protocols are the current gold standard in VPN tech, but when Q-Day arrives, they’ll no longer be enough.
Post-quantum encryption (or PQE), which uses complex mathematical puzzles that even quantum computers struggle with, is your VPN provider’s answer to the Q-Day threat. But while Q-Day is still years away from actualization, PQE is a VPN feature you can enable today, to protect your data against hackers who might hold on to your encrypted data until quantum computers get strong enough to decrypt it.
NordVPN, ExpressVPN, Mullvad, and others let you enable PQE right away with the click of a button. But is this future-proof encryption protocol necessary or worth the investment today? I’ll explain how it works, what it protects against, and which providers offer it so you can make up your own mind.
How post-quantum encryption (PQE) works
When you access the internet through a VPN tunnel, it basically scrambles your traffic data into unreadable code that can only be unlocked using a cipher key. That key is then securely transmitted to your device using a VPN handshake. So anyone who doesn’t have access to the encryption key, including your ISP, will not be able to interpret any useful information from your network and data usage. However, this technology only works because hackers don’t have access to hardware that can decrypt the scrambled network data without the encryption key. With quantum computing evolving as quickly as it is, security researchers estimate that it will be powerful enough to fully decipher your encrypted data without access to the actual key.
Q-Day isn’t merely a distant threat. Attackers are already using “harvest now, decrypt later” (HNDL) attacks to hoard your encrypted network data so that they can decrypt it as soon as Q-Day arrives. That means they’ll suddenly gain access to years of private user data the second that quantum computers gain enough processing power through hardware improvements. That’s why in August 2024, the NIST standardized new encryption algorithms from an open competition that ran for years. Three models were found complex enough to resist attacks from quantum computers: ML-KEM (aka Kyber) for key exchange, along with ML-DSA and SLH-DSA for digital signatures.
If your work involves sensitive data, if you perform a lot of high-value financial transactions, or if you are in a regulated industry with strict compliance requirements, PQE is worth looking into. While its availability is limited to certain VPN providers on specific pricing tiers only, security-conscious businesses and professionals operating in sensitive industries will find it genuinely useful, so it’s not just a gimmick.
VPNs that support post-quantum encryption
A lot of companies use the phrase “quantum-safe” in their marketing terminology, but not all offer PQE as a standard VPN feature. Right now, NordVPN, ExpressVPN, and Mullvad are three mainstream providers who offer PQE as an opt-in feature on several plans.
NordVPN
Nord rolled out PQE in its Linux VPN app in 2024, followed by Windows, Android, and Apple operating systems. It runs on the NordLynx protocol with the ML-KEM algorithm layered on top of the existing Wireguard encryption. But that also means you can’t use PQE with NordVPN if you’re using a dedicated IP, Meshnet, or the OpenVPN protocol.
Because PQE is available to all NordLynx users, you don’t need a premium subscription tier or add-on to access it. All existing NordVPN customers can enable it, whether you’re on the Basic plan or Prime. Here’s how to do it if you’re already using NordVPN:
-
On Windows: Open the NordVPN app, go to Settings > Connections. Toggle on Post-quantum encryption.
-
On macOS: Open the app on your Mac device. Go to Settings, then navigate to the General tab and enable the Post-quantum encryption toggle.
-
On iOS, Android, tvOS, or Android TV: Tap your profile icon. From here, you can easily find the toggle for Post-quantum encryption.
-
On Linux: Navigate to terminal. Run this command: nordvpn set pq on.
ExpressVPN
Even before its NIST standardization, ExpressVPN was one of the first companies to offer the Kyber algorithm through its Lightway protocol as early as 2023. When the ML-KEM protocol was standardized, ExpressVPN upgraded its platform to adhere to the exact NIST standards with several improvements.
What do you think so far?
Interestingly, ExpressVPN has PQE enabled on every user plan by default. However, you need to be using the Lightway protocol and not a legacy alternative like OpenVPN. If you aren’t sure if PQE is enabled, here’s how to check:
-
Open the ExpressVPN app.
-
Make sure you’re on the latest version of the app.
-
Click on Settings. Navigate to the Protocol tab.
-
Check if one of the following options is selected: Automatic, Lightway UDP, or Lightway TCP. If not, just choose any one of them to enable PQE.
Mullvad
Mullvad introduced a pilot version of its post-quantum encryption key exchange protocol way back in 2017, but the experimental implementation was replaced by a new version based on the Classic McEliece algorithm on top of all existing WireGuard servers. With the 2023.3 launch of its desktop app, Mullvad launched a fully stabilized PQE feature while extending support for Android and iOS.
Mullvad doesn’t have a feature-based pricing tier to worry about. Every paying customer has access to this feature with no add-on purchases necessary. It should be enabled by default on desktop unless you specifically opted out of it, but a manual opt-in is necessary on smartphone apps. You can do this by following these steps:
-
On Windows, macOS, and Linux: Go to Settings > VPN settings > WireGuard settings. Make sure that the Quantum-resistant tunnel option is switched to On. When the VPN is connected, you should see a string of green text that reads: “QUANTUM SECURE CONNECTION.”
-
On Android and iOS: Launch the Mullvad VPN app. Go to Settings > VPN settings. Find the Quantum-resistant tunnel option, then toggle it on.
Does it make sense to use PQE right now?
There’s no downside to enabling post-quantum encryption if your VPN provider already supports it on your existing plan. I didn’t notice any meaningful latency or speed drops when testing the feature on NordVPN and ExpressVPN. But if you’re wondering if it’s worth switching to a different plan or provider just for PQE, the answer depends on what your typical workflow looks like.
Quantum computers are still years away from being able to decrypt current security protocols like RSA and ECC, even by the most generous estimates. However, HNDL attacks are a big enough security red flag that companies or people operating in sensitive industries and dealing with confidential information should be paying attention. For regular browsing workflows, PQE may be overkill. But when dealing with financial data, accessing healthcare portals, or sending sensitive information that you can’t afford to have intercepted, quantum protection offers additional peace of mind.
