Education
Post-quantum VPN explained: which providers are quantum-ready in 2026
A quantum computer capable of breaking current VPN encryption does not exist yet. The risk is that nation-state adversaries are already capturing encrypted traffic in 2026 and storing it for later decryption. This is why a post quantum VPN matters now, not when the hardware arrives.
The short answer
Post-quantum cryptography is a new family of encryption algorithms designed to resist attacks from quantum computers. NIST finalized the first three standards in August 2024 (FIPS 203 ML-KEM for key exchange, FIPS 204 ML-DSA and FIPS 205 SLH-DSA for digital signatures). As of mid-2026, only one major commercial VPN provider has shipped a full post quantum VPN stack across all clients: NordVPN. The rollout started on Linux in September 2024 and completed across Windows, macOS, iOS, Android, Android TV, and tvOS in May 2025. ExpressVPN, Surfshark, and Proton VPN have signaled roadmap intent but have not published production PQE as of mid-2026.
Our research methodology
This explainer draws on the published NIST Post-Quantum Cryptography Standardization documents (FIPS 203, FIPS 204, FIPS 205), the official press releases of NordVPN, ExpressVPN, Surfshark, and Proton VPN as of mid-2026, technical coverage in TechRadar and Tomu2019s Guide on the NordVPN PQE rollout, and direct readings of the NordVPN blog and Nord Security press area. The aim is a neutral status check across providers, not a marketing summary. See our research methodology for the broader sourcing approach.
What a post-quantum VPN actually does
Current VPN encryption relies on two mathematical problems that classical computers cannot solve in any reasonable time: factoring large numbers (RSA) and computing discrete logarithms on elliptic curves (ECDH, ECDSA). Both problems become solvable in polynomial time on a sufficiently large quantum computer running Shor algorithm. The exact size of "sufficient" is contested in the academic literature, with current estimates ranging from a few thousand to a few million logical qubits, depending on the implementation efficiency.
Post-quantum cryptography uses different mathematical problems that quantum computers are not known to solve efficiently. The main family standardized by NIST is lattice-based cryptography. The selected algorithms include:
- ML-KEM (Module-Lattice-based Key-Encapsulation Mechanism, formerly CRYSTALS-Kyber): used for key exchange, equivalent role to ECDH
- ML-DSA (Module-Lattice-based Digital Signature Algorithm, formerly CRYSTALS-Dilithium): used for digital signatures, equivalent role to ECDSA
- SLH-DSA (Stateless Hash-based Digital Signature Algorithm, formerly SPHINCS+): a backup signature algorithm based on hash functions rather than lattices
For VPNs specifically, ML-KEM is the relevant primitive. It replaces or augments the key exchange step at the start of every VPN connection. The data encryption itself (AES-256, ChaCha20) is already considered quantum-resistant for symmetric keys of sufficient size, so the post-quantum upgrade primarily targets the handshake.
The post-quantum upgrade changes the connection handshake rather than the whole routing model. Our guide explaining what a VPN tunnel is covers where that handshake fits.
Why VPN providers need to act now (the HNDL threat)
The standard assumption is that quantum computers capable of breaking RSA-2048 or ECDH-256 will appear within 10 to 20 years. The exact timeline is uncertain. What is not uncertain is that intelligence agencies and well-resourced adversaries are already operating on the Harvest Now, Decrypt Later (HNDL) model: capture and store encrypted traffic today, decrypt it when the hardware becomes available.
Any traffic captured in 2026 using only classical encryption is therefore at risk of being readable in 2040 or 2050. For most users, this is irrelevant. The content of typical browsing has no value 15 years later. For specific user categories (journalists, dissidents, government employees, business executives handling long-term sensitive data, legal professionals), the HNDL threat is real and present.
VPN providers shipping a true post-quantum VPN today protect traffic against this scenario. Traffic captured in 2026 from a PQE-protected connection should remain unreadable in 2050 even with mature quantum hardware.
NIST standards: what each algorithm does
The three NIST standards finalized in 2024 cover different cryptographic operations.
FIPS 203: ML-KEM for key encapsulation. When a VPN client connects to a server, it needs to negotiate a shared session key. Classical handshakes use Diffie-Hellman or its elliptic curve variant. ML-KEM replaces this step with a quantum-resistant equivalent. NIST specifies three parameter sets: ML-KEM-512, ML-KEM-768, ML-KEM-1024, with increasing security levels.
FIPS 204: ML-DSA for digital signatures. When a VPN server presents its identity to a client, the client verifies a signature. ML-DSA replaces RSA and ECDSA in this role. Three parameter sets: ML-DSA-44, ML-DSA-65, ML-DSA-87.
FIPS 205: SLH-DSA as backup digital signature scheme. Based on hash functions rather than lattices. Slower than ML-DSA but cryptographically diverse, which matters if a flaw is later found in the lattice family.
For VPN production deployments in 2026, the relevant primitive is ML-KEM at parameter set 768 or 1024. NordVPN has publicly stated it uses ML-KEM in its PQE implementation, integrated into the NordLynx protocol (a NordVPN-tuned WireGuard variant). For the broader context on VPN protocol choices, see our WireGuard vs OpenVPN comparison.
NordVPN: the only post-quantum VPN with full-stack PQE deployment
NordVPN started the PQE rollout in September 2024 on its Linux client. The Linux app received the first ML-KEM integration into the NordLynx protocol, compliant with the NIST standards finalized that summer. Performance metrics were collected during the Linux phase to validate that the post-quantum upgrade did not degrade the user experience.
In May 2025, NordVPN rolled out PQE to Windows, macOS, iOS, Android, Android TV, and tvOS. This was the first full-stack PQE deployment by a major commercial VPN, according to the NordVPN press release of May 22, 2025, and confirmed in TechRadar coverage.
The implementation uses a hybrid approach: PQE algorithms run alongside classical encryption, so a vulnerability discovered in the post-quantum side does not weaken the connection compared to the pre-PQE baseline. The encryption keys are rotated every 90 seconds, faster than the standard practice.
PQE only activates on the NordLynx protocol. It does not work when the user selects OpenVPN, Obfuscated Servers, Dedicated IP, or NordWhisper. The activation also disables the Meshnet feature because the two are not currently compatible. Enable PQE manually in the NordVPN app: Settings, Connection, Post-quantum encryption toggle.
For the broader NordVPN assessment, see our NordVPN review. For the independent audit context of how PQE claims should be verified, see our VPN independent audits guide.
ExpressVPN, Surfshark, Proton VPN: PQE status as of mid-2026
The other three major audited providers have not shipped production PQE as of mid-2026, based on the readings of their public documentation and press releases.
ExpressVPN has signaled in roadmap statements that PQE is under research, with the Lightway protocol identified as the integration target. No public release date is documented. The Cure53 audit of Lightway covers the current implementation, which does not include PQE.
Surfshark has not published PQE roadmap statements in its blog or press area. The Nord Security parent group (which owns both NordVPN and Surfshark since 2022) has not extended the NordVPN PQE rollout to Surfshark clients. Audit cycles for the two brands remain separate.
Proton VPN has acknowledged the importance of post-quantum cryptography in its general blog coverage but has not announced a production rollout for the Proton VPN clients. Proton has a parallel post-quantum effort on Proton Mail (announced 2024 and 2025), which is technically distinct from VPN PQE.
A user prioritizing PQE in mid-2026 therefore has effectively one choice: NordVPN. This may change before end of 2026 if ExpressVPN or Proton VPN ship the implementations signaled in their roadmaps.
PQE limitations and trade-offs
Three trade-offs apply when enabling PQE on a VPN connection.
Protocol restriction. NordVPN PQE only works on NordLynx. If the network requires obfuscation (China, restrictive corporate networks, see our VPN obfuscation guide), the user has to choose: PQE without obfuscation, or obfuscation without PQE. The two protections do not currently combine.
Performance overhead. ML-KEM-768 adds approximately 1 to 2 kilobytes to the handshake message size compared to classical ECDH, and the computational cost is slightly higher. In practice the user experience is unchanged on modern hardware, but on older mobile devices or low-bandwidth connections the impact is measurable.
Cryptographic maturity. Lattice-based cryptography has been studied academically for two decades but has been deployed at scale for fewer than three years. The classical algorithms (RSA, ECDH) have 40 years of real-world security analysis. A vulnerability discovered in ML-KEM tomorrow would not be caught by historical scrutiny in the same way. This is why hybrid implementations (classical plus post-quantum running together) are the current best practice.
How to verify PQE claims
Independent verification of PQE matters because PQE is a marketing claim as much as a technical one. The right four checks:
- Is there a press release dated and naming the specific algorithm (ML-KEM, ML-DSA, hybrid mode)?
- Is there a third-party security audit covering the PQE implementation specifically?
- Is the activation visible in the app settings, with a toggle the user can verify?
- Does the provider document on which protocols PQE applies (and on which it does not)?
For NordVPN as of mid-2026, all four answer yes. For ExpressVPN, Surfshark, and Proton VPN, the answers are partial or pending.
FAQ
Final word
Post-quantum cryptography is the most significant change in VPN encryption since the move from L2TP to OpenVPN in the mid-2000s. In mid-2026, the ecosystem is split into one provider that has shipped a full-stack production post quantum VPN (NordVPN) and three audited competitors with announced roadmaps and no production date (ExpressVPN, Surfshark, Proton VPN). Users with a real HNDL threat model have a clear choice. Users without one have time to wait for the rest of the industry to catch up.
For the deeper question of how to independently verify a PQE claim before trusting it, see our VPN independent audits guide.
