Post-Quantum Messaging Is Here: Inside Graphite's ML-KEM-768 Encryption

TL;DR: Post-quantum messaging protects your end-to-end-encrypted chats with algorithms built to withstand future quantum computers. Graphite Messenger (v1.13.25 public beta) does this with a hybrid X25519 + ML-KEM-768 key exchange, so your messages stay private even if one algorithm is later broken. No quantum computer can crack today's encryption yet — this is a defence against "harvest now, decrypt later".

By the PrivacyPortal team · Content current as of July 2026 · Last updated July 2026.

If you have been hearing about post quantum messaging and wondering whether it matters yet, here is the honest version: it is a real, shipping upgrade to how secure messengers protect your conversations — not marketing gloss. The idea is simple. Today's encryption relies on maths (elliptic-curve key exchange) that a large quantum computer could one day unravel. Post-quantum messaging adds a second, quantum-resistant lock so your chats stay sealed even in that future. Graphite Messenger, our own free post quantum encryption app, layers the standardised ML-KEM-768 algorithm on top of classic X25519. Below we explain exactly how it works, how it compares to Signal, iMessage and RCS, and how to try it on your own phone today.

What is post-quantum messaging?

Post-quantum messaging is end-to-end encryption that uses post-quantum cryptography (PQC) — algorithms designed to resist attacks from both ordinary and quantum computers. Conventional messengers secure each conversation with an elliptic-curve key exchange such as X25519 or P-256. Those schemes are excellent against today's hardware but theoretically breakable by a future quantum computer running Shor's algorithm. A quantum safe messenger keeps the classical key exchange and adds a quantum-resistant one alongside it, so the session is protected as long as either lock holds. That "belt and braces" approach is called a hybrid, and it is the design every serious deployment uses in 2026.

Image: a timeline showing an adversary recording encrypted traffic in 2026 and decrypting it years later, once a cryptographically relevant quantum computer exists.

The "harvest now, decrypt later" threat

Why act before a quantum computer exists? Because of harvest now, decrypt later (HNDL). An adversary — a state, an ISP, anyone who can tap a network — records your encrypted messages today and simply stores the ciphertext. They cannot read it now. But if a cryptographically relevant quantum computer arrives in, say, 2035, they decrypt the archive retroactively. Anything with a long shelf life — health records, legal matters, source protection, private photos — is exposed years after you sent it. Post-quantum messaging closes that window now, while the data is still being created, which is the only time it can be closed.

NIST finalised ML-KEM as FIPS 203 on 13 August 2024, standardising the algorithm formerly known as CRYSTALS-Kyber.

What ML-KEM-768 is, and why it matters

ML-KEM stands for Module-Lattice-based Key-Encapsulation Mechanism. It is the quantum-resistant algorithm that NIST's FIPS 203 (ML-KEM) standard defines, based on the hard mathematical problem of finding short vectors in a lattice — something quantum computers are not known to solve efficiently. The number after the name is the parameter set, which fixes the security level:

• ML-KEM-512 — NIST Category 1, roughly AES-128 strength.
• ML-KEM-768 — NIST Category 3, roughly AES-192 strength. The widely adopted default.
• ML-KEM-1024 — NIST Category 5, roughly AES-256 strength.

Graphite uses ML-KEM-768 — the same parameter set that Chrome, Firefox and Cloudflare adopted for hybrid key exchange in TLS 1.3 (branded X25519MLKEM768). It hits a practical sweet spot: a strong Category 3 margin without the larger keys and ciphertexts of ML-KEM-1024, which matters on mobile networks where every byte of a handshake counts. Signal's PQXDH and Apple's PQ3 chose the heavier ML-KEM-1024; both are valid engineering trade-offs rather than a right-or-wrong answer.

How Graphite builds a quantum safe messenger

Image: a simplified diagram of the hybrid handshake, showing an X25519 shared secret and an ML-KEM-768 shared secret being combined into one session key.

Graphite Messenger performs a hybrid key exchange at the start of every session. In practice this means two independent shared secrets are derived and then mixed together:

• A classical X25519 Diffie–Hellman exchange — fast, battle-tested and secure against all current attacks.
• An ML-KEM-768 key encapsulation — quantum-resistant, providing the forward-looking protection.

Both secrets are fed into a key-derivation function to produce the final session key. An attacker must break both X25519 and ML-KEM-768 to read anything — so even if lattice cryptography is later weakened, X25519 still guards you, and vice versa. This is the same defensive logic behind Signal's and Apple's designs, and it is why nobody ships "pure" post-quantum: hybrids protect against surprises in the new maths as well as the old.

Graphite Messenger v1.13.25 is a free public beta from PrivacyPortal, using a hybrid X25519 + ML-KEM-768 key exchange for session setup.

Post-quantum messaging in 2026: Signal, iMessage, RCS and Graphite compared

Every major encrypted platform is moving toward post-quantum messaging, but they are at different stages and use different parameters. Here is how they line up as of July 2026.

Signal announced its Triple Ratchet (SPQR) in October 2025, extending post-quantum protection continuously through a conversation rather than only at session setup.

The key nuance: securing session setup — as PQXDH, PQ3's foundation and Graphite all do — blocks harvest-now-decrypt-later on the initial handshake. Extending PQ protection to every ratchet step, as Signal's PQXDH specification and the newer SPQR work describe and Apple's iMessage PQ3 write-up details, is the next milestone the whole field — Graphite included — is working toward.

How to try Graphite's post-quantum messaging (step by step)

Graphite is a free public beta, so treat it as an additional secure channel rather than the sole home for irreplaceable messages just yet. It installs like any app — there is no bootloader unlocking or flashing involved, so no data-wipe risk — but a couple of sensible precautions still apply.

Image: the Graphite Messenger encryption-details screen confirming an active ML-KEM-768 hybrid session with a contact.

1. Back up first. Make sure anything important in your current messenger is exported or backed up before you switch attention to a new app. Beta software can change or reset between builds.
2. Check the prerequisites. You need an Android phone (a standard handset or a de-Googled Android phone both work), a network connection and roughly 100 MB free. Graphite does not require Google Play Services.
3. Download Graphite Messenger. Get the current public beta (v1.13.25) from the verified link in the "Modules, apps & files to try" section at the end of this article. Download only from there or the official site.
4. Allow the install. If you are sideloading the APK, Android will ask you to permit installs from your browser or file manager the first time — approve it, then continue. On a de-Googled phone this prompt is normal.
5. Create your account. Open Graphite and follow the sign-up. In keeping with its tagline, "private messaging with nothing to hand over," it is built to collect as little as possible — you will notice how little it asks for.
6. Verify post-quantum encryption is active. Open a chat, tap the contact or the padlock/encryption-details entry, and confirm it reports a hybrid X25519 + ML-KEM-768 session. This is your proof the post quantum encryption app is doing what it claims.
7. Verify your contact's identity. Compare the safety number / key fingerprint with your contact in person or over another trusted channel. Post-quantum maths cannot protect you from talking to an impostor — verification does.

Pitfalls and honest limitations

Post-quantum messaging is worth having, but keep expectations grounded:

• Both ends must support it. A quantum safe messenger only protects a conversation when both participants run PQ-capable builds. Mixed conversations fall back to classical encryption.
• It does not fix metadata. PQC protects message content. Who you talk to and when is a separate problem that depends on an app's architecture, not on ML-KEM.
• Endpoint security still wins or loses. If malware or someone holding your unlocked phone can read the screen, no key exchange helps. Device hygiene matters more than the algorithm.
• Beta means beta. Graphite v1.13.25 is a public beta and has not accumulated the years of external audit that Signal has. That is the trade-off for being early.
• ML-KEM-768 vs 1024. Graphite's Category 3 choice is strong and mainstream, but it is a smaller margin than the Category 5 parameters Signal and Apple use. For most threat models this is a non-issue; for the truly cautious it is worth knowing.

For a wider look at the trade-offs between apps, see our guide to the best private messaging apps.

Frequently asked questions

Is post-quantum messaging necessary in 2026?

No public quantum computer can break current encryption as of 2026, so it is a precaution rather than a fix for a live break. It matters specifically against harvest-now-decrypt-later: if your messages must stay private for a decade or more, protecting them today is the only option, because you cannot retro-encrypt data an adversary has already recorded.

What is the difference between ML-KEM-768 and ML-KEM-1024?

Both are the same FIPS 203 algorithm at different strengths. ML-KEM-768 is NIST security Category 3 (about AES-192) with smaller keys; ML-KEM-1024 is Category 5 (about AES-256) with larger keys and ciphertexts. Graphite uses 768, the widely deployed default; Signal and Apple use 1024. All three are considered secure against foreseeable quantum attacks.

Does post-quantum encryption slow messaging down?

Not noticeably. The hybrid handshake adds a few kilobytes and a millisecond or two of maths at session setup. In practice you will not perceive any difference in send or receive speed; the cost lands once, when a session is established.

Can I use Graphite on a de-Googled phone?

Yes. Graphite Messenger does not require Google Play Services, so it runs on de-Googled Android, GrapheneOS, /e/OS and similar. That makes it a natural fit if you are already running a privacy-focused ROM or a de-Googled handset from PrivacyPortal.

Is Graphite Messenger free?

Yes. Graphite is a free public beta (v1.13.25) built by PrivacyPortal. You can download it from the verified link in the "Modules, apps & files to try" section below.

Post-quantum messaging has quietly become the new baseline for serious secure communication. The maths is standardised, the hybrids are proven, and the harvest-now-decrypt-later threat is real enough that waiting for a quantum computer to appear before acting would be too late. Graphite's X25519 + ML-KEM-768 design puts that protection in your pocket today — try it, verify the encryption details yourself, and keep the honest limitations above in mind.