Which VPNs Support Post-Quantum Encryption and How to Enable It

Quantum computers can’t crack regular VPN encryption just yet, but what happens when that changes?

Cybersecurity experts warn that about 10–20 years from now, quantum computers will have enough processing power to decipher common cryptography techniques like RSA and ECC, an event they call “Q-Day.” These encryption protocols are the current gold standard in VPN tech, but when Q-Day arrives, they’ll no longer be enough.

Post-quantum encryption (or PQE), which uses complex mathematical puzzles that even quantum computers struggle with, is your VPN provider’s answer to the Q-Day threat. But while Q-Day is still years away from actualization, PQE is a VPN feature you can enable today, to protect your data against hackers who might hold on to your encrypted data until quantum computers get strong enough to decrypt it.

NordVPN, ExpressVPN, Mullvad, and others let you enable PQE right away with the click of a button. But is this future-proof encryption protocol necessary or worth the investment today? Here’s how it works, what it protects against, and which providers offer it.

How Post-Quantum Encryption (PQE) Works

When you access the internet through a VPN tunnel, it scrambles your traffic data into unreadable code that can only be unlocked using a cipher key. That key is then securely transmitted to your device using a VPN handshake. So anyone who doesn’t have access to the encryption key — including your ISP — will not be able to interpret any useful information from your network and data usage. However, this technology only works because hackers don’t have access to hardware that can decrypt the scrambled network data without the encryption key. With quantum computing evolving as quickly as it is, security researchers estimate that it will be powerful enough to fully decipher your encrypted data without access to the actual key.

Q-Day isn’t merely a distant threat. Attackers are already using “harvest now, decrypt later” (HNDL) attacks to hoard your encrypted network data so that they can decrypt it as soon as Q-Day arrives. That means they’ll suddenly gain access to years of private user data the second that quantum computers gain enough processing power through hardware improvements. That’s why in August 2024, NIST standardized new encryption algorithms from an open competition that ran for years. Three models were found complex enough to resist attacks from quantum computers: ML-KEM (aka Kyber) for key exchange, along with ML-DSA and SLH-DSA for digital signatures.

If your work involves sensitive data, if you perform a lot of high-value financial transactions, or if you are in a regulated industry with strict compliance requirements, PQE is worth looking into. While its availability is limited to certain VPN providers on specific pricing tiers only, security-conscious businesses and professionals operating in sensitive industries will find it genuinely useful — so it’s not just a gimmick.

VPNs That Support Post-Quantum Encryption

A lot of companies use the phrase “quantum-safe” in their marketing terminology, but not all offer PQE as a standard VPN feature. Right now, NordVPN, ExpressVPN, and Mullvad are three mainstream providers who offer PQE as an opt-in feature on several plans.

NordVPN

Nord rolled out PQE in its Linux VPN app in 2024, followed by Windows, Android, and Apple operating systems. It runs on the NordLynx protocol with the ML-KEM algorithm layered on top of the existing WireGuard encryption. That also means you can’t use PQE with NordVPN if you’re using a dedicated IP, Meshnet, or the OpenVPN protocol.

Because PQE is available to all NordLynx users, you don’t need a premium subscription tier or add-on to access it. All existing NordVPN customers can enable it, whether you’re on the Basic plan or Prime. Here’s how to do it:

• On Windows: Open the NordVPN app, go to Settings > Connections. Toggle on Post-quantum encryption.
• On macOS: Open the app on your Mac device. Go to Settings, then navigate to the General tab and enable the Post-quantum encryption toggle.
• On iOS, Android, tvOS, or Android TV: Tap your profile icon. From here, you can easily find the toggle for Post-quantum encryption.
• On Linux: Navigate to terminal. Run this command: nordvpn set pq on

ExpressVPN

Even before its NIST standardization, ExpressVPN was one of the first companies to offer the Kyber algorithm through its Lightway protocol as early as 2023. When the ML-KEM protocol was standardized, ExpressVPN upgraded its platform to adhere to the exact NIST standards with several improvements.

ExpressVPN has PQE enabled on every user plan by default. However, you need to be using the Lightway protocol and not a legacy alternative like OpenVPN. If you aren’t sure if PQE is enabled, here’s how to check:

• Open the ExpressVPN app and make sure you’re on the latest version.
• Click on Settings. Navigate to the Protocol tab.
• Check if one of the following options is selected: Automatic, Lightway UDP, or Lightway TCP. If not, choose any one of them to enable PQE.

Mullvad

Mullvad introduced a pilot version of its post-quantum encryption key exchange protocol back in 2017, but that experimental implementation was later replaced by a new version based on the Classic McEliece algorithm on top of all existing WireGuard servers. With the 2023.3 launch of its desktop app, Mullvad launched a fully stabilized PQE feature while extending support for Android and iOS.

Mullvad doesn’t have a feature-based pricing tier to worry about. Every paying customer has access to this feature with no add-on purchases necessary. It should be enabled by default on desktop unless you specifically opted out, but a manual opt-in is necessary on smartphone apps:

• On Windows, macOS, and Linux: Go to Settings > VPN settings > WireGuard settings. Make sure the Quantum-resistant tunnel option is switched to On. When the VPN is connected, you should see a string of green text that reads: “QUANTUM SECURE CONNECTION.”
• On Android and iOS: Launch the Mullvad VPN app. Go to Settings > VPN settings. Find the Quantum-resistant tunnel option, then toggle it on.

Does It Make Sense to Use PQE Right Now?

There’s no downside to enabling post-quantum encryption if your VPN provider already supports it on your existing plan. Testing the feature on NordVPN and ExpressVPN didn’t reveal any meaningful latency or speed drops. But if you’re wondering whether it’s worth switching to a different plan or provider just for PQE, the answer depends on what your typical workflow looks like.

Quantum computers are still years away from being able to decrypt current security protocols, but the “harvest now, decrypt later” threat is real and active today. For most everyday users, PQE is a low-effort, no-cost upgrade worth enabling — and for anyone handling sensitive professional or financial data, it’s increasingly becoming a baseline expectation rather than an optional extra.