Post-quantum VPN encryption: what ML-KEM is and why it matters in 2026

By 2026 more than half of the HTTPS requests Cloudflare handles are negotiated with a post-quantum key exchange, and most users have no idea. Here is the plain-language version: what ML-KEM is, why key exchange is being replaced now even though no quantum computer capable of breaking the classical scheme exists yet, and what that means for a VPN connection.

The problem: harvest now, decrypt later

Classical key exchange (X25519, RSA, ECDH) rests on math problems an ordinary computer cannot solve in any useful amount of time. A quantum computer large enough would solve them with Shor's algorithm. No such machine exists today, but the threat already has a name: harvest now, decrypt later. Encrypted traffic captured today can be stored and decrypted five or ten years from now, once the hardware exists.

What ML-KEM (Kyber) is

ML-KEM (Module-Lattice Key Encapsulation Mechanism) is a key exchange algorithm standardized by NIST in 2024 as FIPS 203. Before standardization it was known as Kyber, and both names still appear in documentation. Its security rests on lattice problems, for which no efficient quantum algorithm is known.

The scope matters: ML-KEM covers key exchange, not the encryption of the data itself. Payload is still encrypted with symmetric algorithms such as AES-256 and ChaCha20, and those are barely exposed to the quantum threat — against them a quantum computer roughly halves the effective key strength, and that is the extent of it.

Why the exchange is hybrid

In practice almost nothing runs pure ML-KEM. The usual choice is X25519MLKEM768: classical X25519 and post-quantum ML-KEM-768 run side by side, and the final key is derived from both results. The reasoning is simple. The new algorithm is young, so if a weakness turns up in it, the connection is still protected by the proven classical half. It works the other way round as well: when X25519 eventually stops being strong enough, the post-quantum half still holds.

Where post-quantum encryption already runs

• Browsers — Chrome enabled hybrid ML-KEM by default for TLS 1.3 back in version 131, and Firefox supports it from version 135. There is nothing to switch on.
• Infrastructure — Cloudflare Radar measured post-quantum key exchange at more than half of all requests on their network by mid-2026.
• Messengers — Signal and iMessage moved to post-quantum schemes ahead of most of the industry.
• VPN protocols — the Xray core offers ML-KEM-768 key exchange for both VLESS and Reality authentication.

What it changes for a VPN

A VPN is the worst case for harvest now, decrypt later: a single tunnel carries all of a device's traffic, year after year. Post-quantum key exchange is what closes that scenario — a session recorded today cannot be decrypted after the fact.

Speed is practically unaffected. Post-quantum keys are larger than classical ones, so the handshake grows by a kilobyte or so. That costs a few milliseconds while the connection is set up and nothing afterwards. Latency and throughput stay the same, so there is no reason to put this off.

How to check whether your connection is post-quantum

1. 1Open any major site in Chrome, press F12, go to the Security tab and find the Connection line.
2. 2Check the key exchange group: X25519MLKEM768 means a hybrid post-quantum exchange, plain X25519 means the classical one.
3. 3In a VPN client, open the protocol details in the profile settings: post-quantum mode is labeled ML-KEM, mlkem768 or PQ.

For the protocol this key exchange runs on top of, see VLESS Reality explained. For the full set of selection criteria, see how to choose a VPN in 2026.