Post-quantum encryption uses maths that a future quantum computer is not expected to break. In HushHush it is an optional, per-contact choice called Ultra Secure, made in person when you pair; it is not on by default. It adds ML-KEM-1024 and P-384 keys to the safety number and protects copy-and-paste messages. On automatic chats it is a switch that trades forward secrecy for the post-quantum layer: one or the other, not both. It is pure software, checked against NIST's test vectors, with no government validation and no outside review.
What post-quantum messaging means
NIST describes post-quantum cryptography as encryption designed to hold up against both ordinary computers and quantum ones. The worry is specific: the public-key maths today's apps use to agree a key rests on problems a large quantum computer could solve quickly. Nobody knows when such a machine will exist; NIST's explainer says some think less than ten years, others decades.
The reason to act now is what NIST calls harvest now, decrypt later: an adversary records encrypted traffic today and decrypts it once the technology arrives; as NIST puts it, some secrets remain valuable for many years. On 13 August 2024 NIST finalised its first three post-quantum standards. FIPS 203 defines ML-KEM, a key-encapsulation mechanism derived from CRYSTALS-Kyber, in three sizes, ML-KEM-512, 768 and 1024, and says it is believed to be secure even against adversaries who possess a quantum computer. ML-KEM-1024 is the size the NSA's CNSA 2.0 suite requires for US national security systems.
The large messengers have moved. Signal added PQXDH in September 2023, combining CRYSTALS-Kyber with its elliptic-curve exchange so that an attacker must break both to read the initial key agreement. In October 2025 it announced the Sparse Post-Quantum Ratchet, which adds continuous ML-KEM re-keying beside the Double Ratchet for post-quantum forward secrecy, rolling out gradually. Apple's iMessage PQ3, shipped with iOS 17.4 in 2024, applies Kyber to both the initial key and ongoing re-keying, on by default on supported devices. Both keep message authentication classical, because that attack would need a quantum computer in real time, not later.
| What | Classical encryption | HushHush Ultra Secure |
|---|---|---|
| How the key is agreed | Elliptic-curve exchange only | ML-KEM-1024 plus P-384, both |
| Record now, decrypt with a future quantum computer | Possible, in theory | Designed to resist it |
| Forward secrecy on automatic chats | Yes, Double Ratchet | No. It is one or the other |
| Copy-and-paste messages | Four ciphers, keys from the in-person pairing | Four ciphers plus the post-quantum layer |
| How it is chosen | Automatic | Per contact, in person, when pairing |
| Who you message, and when | Yes | Still yes, in the carrying app |
Who needs this, and who does not
The question is the shelf life of what you write. A joke about tonight's dinner is worthless in ten years, so a recording of it is worthless too. A legal matter that will still be sensitive in fifteen years, a source's identity, a medical history: those are the messages harvest now, decrypt later is aimed at, and the ones worth a post-quantum layer today.
On automatic chats there is a trade, and it is honest to state it. The Double Ratchet gives forward secrecy: a key stolen today does not open yesterday's messages. HushHush's post-quantum layer replaces that with static post-quantum keys agreed in person. For most people, most of the time, forward secrecy against the attackers who exist is the better bargain; choose the post-quantum layer for the contacts whose conversations must stay secret for decades.
How HushHush helps
HushHush encrypts the text on your phone before it goes into any app, so the carrying app only ever sees ciphertext and your contact decrypts it in their HushHush. If you open Advanced while pairing and choose Ultra Secure, each phone generates an ML-KEM-1024 key pair and a P-384 key pair, exchanges them by a two-way QR scan, and binds them into the safety number you can read out to each other on the spot. From then on, copy-and-paste messages to that contact carry the post-quantum layer on top of the four-cipher cascade. On an automatic chat over Telegram, Matrix or email, a per-contact switch lets you prefer the post-quantum layer over forward secrecy. Both people need HushHush, and Ultra Secure must be chosen when you pair.
Pair in person, choose Ultra Secure
Add the contact, open Advanced and turn on Ultra Secure before you scan. Both phones scan each other's codes; no account, no phone number, no server.
Compare the safety number
It now includes the post-quantum keys. Read it out to each other while you are still together.
Send as usual
Paste the ciphertext into any app, or let Telegram, Matrix or email carry it automatically. For automatic chats, pick forward secrecy or the post-quantum layer in that chat's settings.
What HushHush does not do. Post-quantum protection is not on by default: an ordinary pairing, and every automatic chat that has not been switched, uses classical keys, and the Double Ratchet's own key agreement is elliptic-curve. It does not give post-quantum protection and forward secrecy at the same time on an automatic chat. Its post-quantum code is pure software, checked against NIST's published known-answer vectors; it carries no government validation, has had no outside review, and does not claim constant-time execution. Message authentication stays classical, as in Signal and iMessage. It does not hide who you message or when; the carrying app still sees that, with the ciphertext and its length.
Frequently asked questions
Is Signal quantum-safe?
Is iMessage post-quantum?
What is harvest now, decrypt later?
Is post-quantum protection on by default in HushHush?
Encrypt it before anyone can record it.
HushHush is on the App Store and Google Play. Pair in person, then send in any app.
Related
Sources
- FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard, NIST, accessed 7 October 2026.
- What Is Post-Quantum Cryptography?, NIST, accessed 7 October 2026.
- NIST Releases First 3 Finalized Post-Quantum Encryption Standards, NIST, accessed 7 October 2026.
- Quantum Resistance and the Signal Protocol, Signal, accessed 7 October 2026.
- Signal Protocol and Post-Quantum Ratchets, Signal, accessed 7 October 2026.
- iMessage with PQ3: The new state of the art in quantum-secure messaging at scale, Apple Security Research, accessed 7 October 2026.
- Commercial National Security Algorithm (CNSA) Suite 2.0 Profile for TLS 1.3, IETF Internet-Draft, accessed 7 October 2026.