Post-quantum encryption: is your website ready?
No quantum computer today can break the encryption protecting your website. Nobody knows for certain when one will. And yet the biggest cryptography change in a generation is already running in the browser you are reading this in. Here is why that is not a contradiction, and what it asks of a small business — which, reassuringly, is not much.
The threat, in one paragraph
Most of the encryption on the internet relies on maths problems that ordinary computers cannot solve in any useful time: factoring huge numbers (RSA) and a related problem on elliptic curves. A sufficiently large, reliable quantum computer running Shor's algorithm could solve both. Such a machine does not exist yet. Research progress on error correction has been real, which is why the timelines have stopped sounding like science fiction.
Why the switch is happening now anyway
The answer is “harvest now, decrypt later”. An attacker can record encrypted traffic today and store it until a quantum computer can open it. Anything that must stay secret for ten years or more — medical records, legal files, trade secrets, long-lived credentials — is exposed to that attack already, even though the machine that would complete it has not been built.
That is why the replacement has been built first:
- August 2024: the US standards body NIST published its first three post-quantum standards — ML-KEM for key exchange, and ML-DSA and SLH-DSA for digital signatures.
- Late 2024 onwards: Chrome and Edge began using a hybrid key exchange by default, combining a classic algorithm with ML-KEM, so a connection is safe unless both are broken. Firefox and Apple followed; Apple's 2025 operating systems advertise it by default.
- March 2025: the UK's National Cyber Security Centre set out a migration timeline — plans in place by 2028, priority systems moved by 2031, the job finished by 2035.
Your website is probably already partly done
The part that matters most for a website — the key exchange that protects traffic in transit — is handled by whoever terminates your HTTPS connection. The large CDNs and modern hosts already negotiate hybrid post-quantum key exchange with browsers that offer it. This site is served through Cloudflare, which does. You did not have to do anything, and neither did we.
What is not done yet, anywhere, is the certificate side — the signatures that prove a site is who it says it is. That is a harder change with larger keys, and the industry is still working through it. It matters less for harvest-now attacks, because a forged signature is only useful in real time.
What a small business should actually do
- Check your host supports TLS 1.3 and, ideally, hybrid post-quantum key exchange. If your hosting is old enough that it does not, that is a sign of bigger problems — see what modern hosting looks like.
- Keep devices and software updated. The protection arrives through browser and operating system updates. A laptop stuck on an unsupported system misses it.
- Make a short list of what else uses encryption: your VPN, remote access tools, any server you log into, any device that has not been updated in years. That list is the “discovery” stage the NCSC asks larger organisations to complete by 2028, and for a small business it fits on one page.
- Ask suppliers, do not rebuild. For almost everything you use, post-quantum support will arrive as a vendor update. The useful question for a supplier is simply whether it is on their roadmap.
What to be sceptical of
Expect to be sold “quantum-proof” products. Most small businesses do not need to buy anything. The standards are public, the implementations are arriving free inside software you already use, and the real work is keeping that software current. Anyone telling you otherwise with a deadline attached is selling urgency.
Equally, do not dismiss it. The businesses that will find this painful are the ones running old, unpatched systems that cannot be upgraded — which is a problem worth fixing now for reasons that have nothing to do with quantum computers. Security basics are still where the real risk is.
If you are not sure how old your hosting setup is, ask us and we will tell you plainly. Our hosting plans run on platforms that already support it.
Sources
Researched, written and published by Aftab Ahmad, owner of Seven Layers.