Post-quantum cryptography, explained simply

Updated August 6, 2026

Post-quantum cryptography is cryptography built to stay secure even after a quantum computer capable of breaking today's standard encryption exists. Three such algorithms became official U.S. cryptography standards in 2024, and most people never heard about it, because nothing on their phone or laptop visibly changed. But those three standards, published by NIST after roughly eight years of public review, are the closest thing the internet has to an answer for what happens if a working quantum computer ever shows up.

The names are a mouthful: ML-KEM, ML-DSA, and SLH-DSA. Underneath the acronyms, they solve two very ordinary problems that almost every secure connection depends on. One is how two computers agree on a shared secret over a channel someone else might be listening to. The other is how you prove you hold a private key without ever showing it. Today, both jobs run on math that a sufficiently capable quantum computer could break using Shor's algorithm. These three standards are meant to replace that math with something Shor's algorithm doesn't help against.

What each standard actually does

ML-KEM is built on CRYSTALS-Kyber. KEM stands for key encapsulation mechanism, which is a formal way of saying it's used to set up a shared secret between two parties, the same role your browser's TLS handshake plays every time you load a website over HTTPS.

ML-DSA is built on CRYSTALS-Dilithium. DSA stands for digital signature algorithm, the same category ECDSA falls into, which is what actually signs a Bitcoin transaction today. ML-DSA is meant to do that job without relying on elliptic curve math.

SLH-DSA is built on SPHINCS+. It also produces digital signatures, but from a completely different foundation: hash functions instead of algebraic structure. Hash-based security is easier to reason about mathematically, which is why SLH-DSA is often treated as the conservative fallback option. The tradeoff is size. Its signatures run much larger than the other two.

None of these are exotic research curiosities anymore. They're finished standards that browser vendors, cloud providers, and government agencies are already starting to fold into their systems, often quietly, alongside the classical algorithms already in place.

Why this reaches far beyond bitcoin

It's easy to read about quantum risk and assume it's a bitcoin story. It isn't, not primarily. The same elliptic curve math that secures a Bitcoin address also secures most TLS connections, most VPNs, most encrypted messaging apps, and a good share of banking infrastructure. Ethereum and most other cryptocurrencies lean on the same family of curves and carry a similar exposure profile. That shared dependency is exactly why NIST ran a multi-year public competition rather than picking a winner behind closed doors: the internet needed a vetted, standardized answer, not a Bitcoin-specific one.

This is also why RSA gets mentioned in the same breath as elliptic curve cryptography, even though Bitcoin doesn't use RSA. Both are vulnerable to the same class of quantum attack, for related mathematical reasons, and both are covered by different combinations of these new standards depending on the system.

Where bitcoin's own proposals fit in

Bitcoin's response draws directly on this wider standardization effort rather than inventing something from scratch. BIP-360 and BIP-361 are draft proposals, not activated protocol rules, aimed at giving Bitcoin a quantum-resistant address format and a path for existing coins to migrate into it. They're still evolving, and no specific algorithm has been locked in yet. Our longer look at Bitcoin and quantum computers walks through what changed in 2026 and why roughly 5.4 million BTC, including an estimated 1.1 million tied to Satoshi-era mining, already sits in a more exposed position than the rest of the supply.

That exposure isn't uniform across address types, and it isn't hypothetical. If you want to see where a specific address stands, the wallet exposure checker looks at its on-chain spend history and reports which tier it falls into, Taproot versus older hash-based formats. And if you're trying to reason about how much of a holding a future migration deadline might actually touch, the sats converter is a plain unit calculator, no price attached, useful for keeping the arithmetic separate from the anxiety.

The genuinely hard part of Bitcoin's version of this problem isn't cryptographic, it's social. Upgrading a browser is a software update. Migrating a live, permissionless monetary network with no central authority is a coordination problem, and one proposal on the table, restricting spending from long-dormant exposed addresses after some window, runs directly against Bitcoin's long-standing norm that nobody gets to decide whose coins can move. That debate is unresolved and, as far as we can tell, nowhere near settled.

What's honestly still unknown is twofold. Nobody has a firm date for when, or whether, a quantum computer capable of breaking secp256k1 in practice will exist; serious estimates span anywhere from several years to a decade or more, and treating that range as more precise than it is would be dishonest. And these new standards, ML-KEM, ML-DSA, SLH-DSA, are still young by cryptographic standards, with nothing close to the decades of sustained public attack that classical elliptic curve cryptography has survived. They're the best vetted answer available today. Whether they hold up as well over time is something we genuinely won't know for years.