Post-quantum encryption is no longer theoretical. As of 2026, four major messengers use it in production. The algorithms that protect your messages against a future quantum computer are now standardized, shipped, and running. If you are not using one of these four, your messages could be recorded today and decrypted by a machine that doesn't exist yet.
The NIST standardization: FIPS 203 and 204
In 2024, the U.S. National Institute of Standards and Technology (NIST) finalized the first post-quantum cryptography standards:
- FIPS 203: ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism), formerly known as Kyber ML-KEM The post-quantum key-exchange algorithm beChat uses to let two phones agree on a shared secret that a future quantum computer cannot figure out. Standardized by NIST as FIPS 203. Click for full glossary →. Used for post-quantum key exchange.
- FIPS 204: ML-DSA (Module-Lattice-Based Digital Signature Algorithm), formerly known as Dilithium ML-DSA The post-quantum signature algorithm beChat uses to prove who sent a message and that it was not tampered with. Standardized by NIST as FIPS 204. Click for full glossary →. Used for post-quantum signatures.
These went through a public, multi-year competition starting in 2016. Cryptographers from around the world submitted candidates, and each was publicly attacked, stress-tested, and refined over several rounds. The survivors are now federal standards, on the same footing as AES and SHA-3.
beChat uses ML-KEM-1024 (the highest security parameter set) and ML-DSA-87 (the highest security parameter set for signatures). Both are NIST-standardized.
Which messengers have post-quantum cryptography in 2026?
| Messenger | PQ key exchange | Continuous PQ ratcheting | PQ signatures |
|---|---|---|---|
| beChat | ML-KEM-1024 | Yes (ML-KEM-1024 every step) | ML-DSA-87 |
| Signal | PQXDH (Kyber-1024) | Yes (SPQR, ML-KEM-768, since Oct 2025) | No (classical XEdDSA) |
| iMessage | PQ3 | Yes (PQ3 ongoing rekeying) | No |
| SimpleX | sntrup761 | Yes (sntrup761 in ratchet since v5.6) | No |
| No | No | No | |
| Telegram | No | No | No |
| Session | No (planned v2) | No (planned v2) | No |
| Threema | No | No | No |
beChat: continuous post-quantum ratcheting with ML-KEM-1024
beChat uses ML-KEM-1024 in every ratchet step of the Double Ratchet Double Ratchet The key-ratcheting construction beChat implements for end-to-end encryption, the same mechanism Signal and WhatsApp use. It generates a brand-new key for every message so a single compromised key does not expose past or future messages. Click for full glossary →, not just at the initial handshake. This means the post-quantum protection is continuous: every message gets a fresh key derived from a post-quantum secret, giving post-quantum forward secrecy Forward secrecy A property where every message uses its own fresh key, so a key stolen today cannot unlock messages sent yesterday or tomorrow. The Double Ratchet provides this automatically. Click for full glossary → and post-compromise security against "harvest now, decrypt later" Harvest now, decrypt later An attack where someone records your encrypted traffic today, while it is still unbreakable, and stores it for years until a future quantum computer can crack it. It is why post-quantum encryption matters now, not later. Click for full glossary → attacks.
beChat also uses ML-DSA-87 for post-quantum signatures. This means that even if a quantum computer is built, an attacker cannot forge your identity or impersonate you. beChat is the only messenger on the list that uses NIST-standardized post-quantum algorithms for both key exchange and signatures.
Signal: PQXDH + SPQR
Signal introduced PQXDH in September 2023, adding Kyber-1024 to the initial key exchange. In October 2025, Signal went further with SPQR (Signal Post-Quantum Ratchet, also called the Triple Ratchet), which adds continuous post-quantum ratcheting using ML-KEM-768 throughout a session. This gives Signal post-quantum forward secrecy and post-compromise security. Signal's protocol is formally verified with ProVerif and F*.
Signal does not use post-quantum signatures. Its signatures remain classical XEdDSA. If a quantum computer is built, Signal's signatures could theoretically be forged, though the continuous ratchet limits the window of exposure.
iMessage: PQ3
Apple shipped PQ3 in iOS 17.4 (March 2024). PQ3 uses a post-quantum key exchange plus ongoing rekeying throughout a session. Apple claims PQ3 provides "level 3" post-quantum security, the highest on their scale. iMessage's protocol is closed source and has not been independently audited.
SimpleX: sntrup761
SimpleX uses Streamlined NTRU Prime (sntrup761) in its ratchet since v5.6 (March 2024). This is a post-quantum key exchange that runs in every ratchet step, providing continuous post-quantum protection. SimpleX chose sntrup761 over ML-KEM citing no known patent claims and a lower perceived risk of compromise. SimpleX has been audited by Trail of Bits.
What about WhatsApp, Telegram, Session, and Threema?
As of 2026, WhatsApp, Telegram, Session, and Threema do not use post-quantum cryptography. Messages sent on these apps today are protected by classical encryption (ECDH, RSA, or similar) that a future quantum computer could break. If you are concerned about "harvest now, decrypt later" attacks, these apps do not protect you.
What this means for you
If you are choosing a messenger in 2026 and post-quantum protection matters to you, the options are: beChat, Signal, iMessage, or SimpleX. All four have continuous post-quantum ratcheting. The differences are:
- beChat: ML-KEM-1024 + ML-DSA-87, anonymous accounts, European hosting, Android beta
- Signal: PQXDH + SPQR, phone number required, US-hosted, formally verified, multi-platform
- iMessage: PQ3, Apple ID required, Apple devices only, closed source
- SimpleX: sntrup761, no identifiers at all, self-hostable, audited
If you want NIST-standardized post-quantum for both key exchange and signatures, beChat is the only option. If you want formal verification and multi-platform support, Signal is the stronger choice. If you are on Apple only, iMessage works. If you want maximum anonymity (no identifiers at all), SimpleX.
Frequently asked questions
Is post-quantum encryption used in production today?
Yes. Signal uses PQXDH (Kyber-1024) for key exchange since September 2023 and SPQR (Triple Ratchet with ML-KEM-768) for continuous ratcheting since October 2025. iMessage uses PQ3 since iOS 17.4 (March 2024). SimpleX uses sntrup761 in its ratchet since v5.6 (March 2024). beChat uses ML-KEM-1024 in every ratchet step and ML-DSA-87 for signatures. All four provide post-quantum protection in production today.
Has a quantum computer broken encryption yet?
No. As of 2026, no quantum computer exists that can break the encryption used by Signal, WhatsApp, iMessage, or beChat. The threat is forward-looking. Researchers expect that a sufficiently large quantum computer could be built in the coming decades, and that ciphertext captured today could be decrypted then. Post-quantum cryptography is insurance against that future risk.
What is the difference between post-quantum key exchange and continuous post-quantum ratcheting?
Post-quantum key exchange uses quantum-resistant algorithms only for the initial handshake. Continuous post-quantum ratcheting re-keys with post-quantum secrets throughout the session, not just at the start. beChat, Signal (SPQR), iMessage (PQ3), and SimpleX all have continuous post-quantum ratcheting. This provides post-quantum forward secrecy and post-compromise security, not just a one-time quantum-resistant key agreement.
Keep reading
Read the plain-English guide to post-quantum encryption, the full how beChat works walkthrough, or how beChat compares to other messengers.