Post-quantum encryption is a new kind of lock that even a future supercomputer can't pick. Today's digital locks are excellent against today's computers. But scientists are building a different kind of computer, a quantum computer, that could eventually crack those locks. Post-quantum encryption swaps in locks built from different math, so that neither a regular computer nor a quantum one can break them.
beChat uses these new locks automatically, on every conversation, so that messages you send today can't be read by a machine that doesn't exist yet but might in ten or twenty years.
Start here: how encryption works today
Before we talk about post-quantum, it helps to understand the encryption most apps use right now.
When you send a private message in Signal or WhatsApp, your phone scrambles the text into gibberish using a key, which is a long random number. Only your contact's phone has the matching key to unscramble it. Anyone who intercepts the message in between just sees noise.
The scrambling relies on a math problem that is easy in one direction and brutal in the other. For example: multiplying two huge prime numbers is quick. But taking a huge number and figuring out which two primes were multiplied to make it? With today's computers, that would take billions of years for the key sizes anyone actually uses.
That "hard in reverse" property is what keeps your messages confidential. It is called public-key cryptography Public-key cryptography A way to encrypt things using two linked keys: a public one you can share with anyone, and a private one you keep secret. It is how two phones that have never met agree on a shared secret over an open network. Click for full glossary →, and it has protected the internet for decades: banking, email, web browsing, messaging, everything.
Today's encryption works because some math problems are insanely hard for normal computers to solve. Break the math problem, break the encryption. So far, no normal computer can.
So what is a quantum computer?
A quantum computer works on different principles than your laptop. It exploits the rules of quantum physics, the strange laws that govern atoms and subatomic particles, to solve certain problems that normal computers struggle with.
Without drowning in physics: a normal computer stores information as bits, each of which is either a 0 or a 1. A quantum computer uses qubits, which can be a 0 and a 1 at the same time (a state called superposition). By entangling many qubits together, a quantum computer can explore an enormous number of possibilities in parallel. For certain very specific mathematical problems, that lets it jump to an answer that a normal computer would have to grind through one by one.
Imagine you need to find one specific grain of sand in a desert. A normal computer examines grains one at a time. A quantum computer is more like pouring the whole desert through a sieve that only catches the one grain you want. For certain shapes of "grain," it can find the answer almost instantly.
The catch: quantum computers only have this superpower for specific math problems. They are not magically fast at everything. But unfortunately for today's encryption, one of those specific problems happens to be the exact math that protects your messages.
The problem: Shor's algorithm breaks today's locks
In 1994, a mathematician named Peter Shor discovered that a quantum computer could solve two specific problems extremely efficiently:
- Factoring large numbers, which is the math behind RSA, used to secure most of the web.
- Discrete logarithms, which is the math behind elliptic-curve Diffie-Hellman (ECDH), used by Signal, WhatsApp, and iMessage to set up encrypted conversations.
Shor's algorithm is the reason post-quantum cryptography exists. If someone builds a quantum computer big enough, the math that protects almost every encrypted message today stops being hard. The locks effectively stop being locks.
Remember that "hard in reverse" math problem keeping your messages safe? Shor's algorithm is a trick that lets a quantum computer skip the hard part and jump straight to the answer. Once the answer is easy, the encryption is broken.
"Harvest now, decrypt later": why this matters today
Here is the uncomfortable part: you do not need to wait for a quantum computer to be built for it to start hurting you.
Anyone with access to your network traffic (a state intelligence agency, a well-funded criminal group, even a nosy telecom) can record your encrypted traffic today, while it's still unbreakable, and simply store it. Then, years from now, when a quantum computer finally exists, they dig out those recordings and decrypt them.
Security researchers call this "harvest now, decrypt later." It is a real, documented strategy. The recordings are cheap to make and the storage cost keeps falling.
Imagine someone steals your diary, written in a secret code you're sure no one can crack. They don't read it now. They just lock it in a vault. Twenty years later, a new invention makes your code trivial to break. They open the vault and read everything you wrote in 2026.
Messages you send today, whether political organizing, journalist sources, medical questions, or business plans, could be retroactively exposed long after you sent them. Post-quantum encryption is the way to make sure that vault never opens.
For messaging, this matters more than for, say, web browsing. A website's encrypted traffic from 2018 is mostly stale. But a private conversation from 2018 can still be deeply sensitive in 2038. The shelf life of a message is long.
What post-quantum encryption actually does
Post-quantum cryptography (PQC) is a family of new encryption algorithms built on different mathematical problems. These are problems that no one has found a way to solve quickly, not even with a quantum computer.
If Shor's algorithm is the quantum trick that breaks today's locks, post-quantum cryptography is the answer to "what locks are immune to that trick?" The new locks are built from math that quantum computers don't have a known shortcut for.
Today's locks are built on a math puzzle that quantum computers happen to be great at. Post-quantum locks are built on different math puzzles, ones that no one (including the quantum computer designers) has found a trick for. Same job (keep messages private), different ingredients.
The great standardization: NIST picks the winners
You don't want just anyone inventing the encryption that protects your messages. Cryptography is full of ideas that look clever and then get broken a year later. So in 2016, the U.S. National Institute of Standards and Technology (NIST), the same body that standardized AES and SHA-3, opened a public, multi-year competition to choose which post-quantum algorithms would become official standards.
Cryptographers from all over the world submitted candidates. Each one was publicly attacked, picked apart, and stress-tested by the global security community. After several rounds, NIST announced the first winners in 2022 and finalized them as federal standards in 2024:
- FIPS 203: ML-KEM (formerly called Kyber ML-KEM The post-quantum key-exchange algorithm beChat uses to let two phones agree on a shared secret that a future quantum computer cannot figure out. Standardized by NIST as FIPS 203. Click for full glossary →), a lattice-based Lattice-based cryptography A family of post-quantum math problems built on multi-dimensional grids (lattices) of points. They are hard for both normal and quantum computers. ML-KEM and ML-DSA are lattice-based. Click for full glossary → scheme for exchanging keys.
- FIPS 204: ML-DSA (formerly called Dilithium ML-DSA The post-quantum signature algorithm beChat uses to prove who sent a message and that it was not tampered with. Standardized by NIST as FIPS 204. Click for full glossary →), a lattice-based scheme for digital signatures.
These are the algorithms beChat uses. They went through an open, years-long process involving the world's top cryptographers.
NIST's competition is the cryptographic equivalent of a clinical trial. Instead of trusting one company's secret recipe, the algorithms were tested in public by thousands of experts whose job was to try to break them. The ones that survived are now the global standard. beChat uses the survivors.
The two ingredients, explained without the math
Here is what each of the two algorithms actually does in beChat, in plain language:
1. ML-KEM-1024: the key exchange
ML-KEM is the courier who carries a shared secret from your phone to your contact's phone without anyone along the route being able to read it. It is a key encapsulation mechanism Key encapsulation mechanism (KEM) A way for two devices to agree on a shared secret over an open network, with the secret locked inside a box only the recipient can open. ML-KEM is a post-quantum KEM. Click for full glossary →: your phone puts a fresh secret in a locked box, sends it over, and only your contact's phone can open it. Once both phones have the secret, they use it to seed everything else.
The "1024" is the security level, the highest parameter set NIST standardized, giving the strongest protection in the family.
2. ML-DSA-87: the signature
ML-DSA is the wax seal on a letter. When your contact's phone receives a message claiming to be from you, how does it know you really sent it and that nobody tampered with it along the way? ML-DSA produces a digital signature your phone can verify, but no one else can forge, not even with a quantum computer.
It signs your device keys and message keys so that who you are and that the message wasn't altered are both guaranteed.
How beChat fits the pieces together
beChat does not replace the Double Ratchet, the key-ratcheting mechanism used by Signal and WhatsApp. It extends it with a post-quantum handshake. Here is the whole chain in one breath:
- When you start a conversation, ML-KEM-1024 carries a fresh shared secret between the two phones, resistant to a future quantum computer.
- ML-DSA-87 signs the device and message keys, so each phone can prove who it is and that nothing was tampered with.
- The shared secret seeds the Double Ratchet, which generates a brand-new key for every single message. This is called forward secrecy Forward secrecy A property where every message uses its own fresh key, so a key stolen today cannot unlock messages sent yesterday or tomorrow. The Double Ratchet provides this automatically. Click for full glossary →: if one message key ever leaks, the others stay safe.
- Each message is then scrambled with AES-256-GCM-SIV, a hardened variant of the encryption standard the U.S. government approves for top-secret documents, and sent to the beChat server, which stores only the scrambled blob and cannot unscramble it.
When you start chatting, the two phones use post-quantum math to agree on a secret that not even a future quantum computer could figure out. They then sign everything with post-quantum signatures so nobody can impersonate either of you. From that secret, a fresh lock is created for every message, so even if one message's lock somehow gets picked, all the others stay sealed. The server in the middle only ever sees scrambled noise.
Why beChat does this now, not later
You might reasonably ask: if no quantum computer can break Signal today, why bother switching now?
Because of harvest now, decrypt later. The messages you send in 2026 will still be sensitive in 2036. The only way to protect them against a future quantum adversary is to encrypt them with post-quantum algorithms today. Waiting until a quantum computer exists is waiting until it is too late.
beChat treats post-quantum cryptography as a default, not a toggle. Every conversation gets the post-quantum handshake automatically. There is no "PQC mode" to enable and no way to silently fall back to classical-only key exchange. You don't have to know anything about quantum physics to benefit from it.
You do nothing different. You install beChat, you type a message, you press send. Behind the scenes, your message is locked with the strongest encryption standards on Earth, the ones the world's cryptography community spent years trying to break and couldn't. And it will still be locked in twenty years, even if someone builds a machine that can pick every other lock in the world.
What post-quantum encryption does not do
It is important to be honest about the boundaries:
- It does not provide anonymity on its own. Anonymity requires not collecting personal identifiers in the first place, which is why beChat also uses PIN-based accounts instead of phone numbers.
- It does not hide the fact that two accounts are talking. The beChat server still needs to route encrypted blobs between accounts. What it hides is the content of a conversation, not its existence.
- It is not a guarantee of permanent unbreakability. No encryption is. It is the best current answer to a known future threat, chosen by the most rigorous public process we have.
- It does not protect your messages if your device itself is compromised. If malware is reading your screen before encryption, no cryptography helps. Keep your operating system updated.
For the full chain (anonymous registration, key exchange, ratcheting, transport, storage), read the main how beChat works page. For every technical term used on this page defined in one sentence, see the glossary.
Frequently asked questions
What is post-quantum encryption?
Post-quantum encryption (or post-quantum cryptography, PQC) is a new generation of encryption designed to stay secure even if a large-scale quantum computer is ever built. The encryption used by most banks, websites, and messengers today could theoretically be broken by such a machine. Post-quantum encryption uses different mathematical puzzles that no one has found a way to break, even with a quantum computer.
Do I need to understand quantum physics to use beChat?
No. You use beChat the same way you use any chat app. You type a message and press send. The post-quantum protection runs automatically, in the background, every time you start a conversation. You never see a "quantum setting" and you never have to enable anything.
Why does post-quantum encryption matter for messaging?
Because encrypted messages sent today can be recorded and stored for years. Even though current computers cannot break the encryption a messenger like Signal uses, a future quantum computer could decrypt those stored transcripts. This is called a "harvest now, decrypt later" attack. Post-quantum encryption closes that window by using keys that resist both today's computers and tomorrow's quantum ones.
Which post-quantum algorithms does beChat use?
beChat uses ML-KEM-1024 for key exchange and ML-DSA-87 for digital signatures. Both are lattice-based schemes standardized by the U.S. National Institute of Standards and Technology (NIST) as FIPS 203 and FIPS 204. beChat combines them with a Double Ratchet construction so every message gets a fresh key with forward secrecy.
Is post-quantum encryption slower than regular encryption?
The initial handshake uses a bit more bandwidth because post-quantum keys and signatures are larger than classical ones. For ongoing messaging, the cost is negligible because the Double Ratchet reuses derived keys per message. The handshake runs once per conversation, not once per message, so you will not notice any delay when chatting.
Has a quantum computer broken encryption yet?
No. As of 2026, no quantum computer exists that can break the encryption used by Signal, WhatsApp, or beChat. The threat is forward-looking: researchers expect that a sufficiently large quantum computer could be built in the coming decades, and that ciphertext captured today could be decrypted then. Post-quantum cryptography is insurance against that future risk.
Does post-quantum encryption replace the Double Ratchet?
No. beChat implements a Double Ratchet construction, the same key-ratcheting mechanism Signal and WhatsApp use, and layers post-quantum key exchange and post-quantum signatures on top. The Double Ratchet still provides forward secrecy and post-compromise security. The post-quantum layer protects the initial key agreement against a future quantum adversary.
Is post-quantum encryption proven to be unbreakable?
No encryption is ever proven unbreakable. Post-quantum algorithms are chosen because the best minds in cryptography, including the NIST standardization process, have spent years trying to break them and have not found a way. They are considered secure against both classical and quantum attacks by the current consensus of the cryptographic community.
Keep reading
Next: Why SMS is fundamentally broken. The security problems with SMS that motivated beChat, and what changes when you stop tying your identity to a phone number.
Or jump to the download page to join the open beta on Android.