Explainer

Post-quantum encrypted messaging, explained

Most encrypted messengers protect you against every computer that exists today. VoidSend also protects you against the ones that do not exist yet. Here is what that means, why it matters now rather than later, and how it is done without giving up any of the security you already rely on.

The problem: harvest now, decrypt later

Almost all end-to-end encryption in use today agrees its keys with elliptic-curve Diffie-Hellman, usually X25519. That maths is safe against classical computers, but a sufficiently large quantum computer running Shor's algorithm would solve it quickly. Nobody has built such a machine yet. The danger is that an adversary does not need one today: they can record your encrypted traffic now, store it, and decrypt it when the hardware arrives.

For a chat about dinner plans that is irrelevant. For journalists, lawyers, activists, companies with trade secrets, or anyone whose messages will still matter in ten years, it is the whole threat. This is why NIST spent eight years standardising replacement algorithms, and why Apple, Signal and now VoidSend have adopted them.

The algorithms NIST chose

In August 2024 NIST published the first post-quantum standards. VoidSend uses two of them.

• ML-KEM (FIPS 203), formerly known as Kyber, is a key encapsulation mechanism. One party encapsulates against the other's public key and both obtain a shared secret. Its hardness rests on the Module Learning With Errors problem over lattices, which has no known efficient quantum attack. VoidSend uses the 768 parameter set, NIST security level 3.
• ML-DSA (FIPS 204), formerly Dilithium, is a digital signature scheme from the same lattice family. VoidSend uses ML-DSA-65 to sign message metadata so recipients can verify who sent a message even in a post-quantum world.

Why hybrid, not replacement

The lattice schemes are young. X25519 has been attacked by the world's best cryptanalysts for two decades; ML-KEM has had a few years. So VoidSend does not swap one for the other. It runs both and combines the two shared secrets with HKDF-SHA256 into a single message key. An attacker has to break both X25519 and ML-KEM-768 to recover it. If a flaw is ever found in the lattice scheme, you are no worse off than a classical messenger. If a quantum computer breaks the curve, the lattice half still holds.

This is the same reasoning behind Signal's PQXDH and Apple's PQ3, and it is the approach recommended by the IETF for TLS. VoidSend applies it to every message and every file, plus post-quantum signatures, which most hybrid deployments have not added yet.

What it costs

Post-quantum keys are larger. An ML-KEM-768 public key is 1184 bytes and its ciphertext 1088 bytes, against 32 bytes for X25519. An ML-DSA-65 signature is about 3.3 kilobytes. On a modern phone the extra computation is a few milliseconds and the extra bandwidth is smaller than a single emoji image, so you will not notice it.

How VoidSend uses them

Your ML-KEM and ML-DSA keys are derived from your passkey, exactly like your classical keys, so you get the same post-quantum identity on every device with nothing to back up. When you send a message, your device runs the hybrid key agreement, seals the content with AES-256-GCM and signs it with ML-DSA-65. The server only ever sees the resulting ciphertext. Calls use WebRTC's own per-call keys and are relayed so participants never see each other's IP address. The complete walk-through is on the security page.

Which messengers are post-quantum today?

As of 2026, Signal uses a hybrid post-quantum key exchange, Apple's iMessage uses PQ3, and VoidSend uses hybrid ML-KEM-768 with ML-DSA-65 signatures. Most other messaging apps have not published post-quantum protection. See the detailed comparisons with Signal, WhatsApp and Telegram.