Post-Quantum VPN: What It Is, Who Has It, and Do You Need One?

A post-quantum VPN uses a key exchange that quantum computers can't break, so traffic recorded today can't be decrypted years from now. Most use a hybrid: a classical algorithm (X25519) combined with ML-KEM, the post-quantum standard NIST published as FIPS 203 in August 2024. Quantum computers can't break today's VPNs yet. The risk is "harvest now, decrypt later": someone records your encrypted traffic now and decrypts it once the hardware exists. Post-quantum key exchange closes that gap, and it costs about a kilobyte per connection and no noticeable speed.

What does "post-quantum" actually protect?

Every encrypted connection has two jobs:

1. Agreeing on a secret key (key exchange). If an attacker can recover this key, they can decrypt everything sent with it, including recordings made years earlier.
2. Proving who you're talking to (authentication, usually signatures). Forging this needs a quantum computer during the connection. Recordings don't help.

That's why the industry fixed key exchange first. A future quantum computer running Shor's algorithm could recover today's classical keys (X25519, RSA) from recorded traffic. It can't go back in time and impersonate a server you already talked to. Post-quantum key exchange protects your traffic's confidentiality against recording, starting today. Post-quantum signatures can follow before quantum computers actually arrive.

Why "hybrid"?

ML-KEM is new. Combining it with X25519 means the connection is secure if either algorithm holds. If a flaw were ever found in ML-KEM, you'd still have today's classical security. If quantum computers break X25519, ML-KEM still protects you. The combination, X25519MLKEM768, is now standardised for TLS as RFC 10024 (August 2026). Browsers and servers use it by default.

Who already has post-quantum encryption?

Browsers and operating systems

VPN providers (from their own announcements)

WireGuard itself isn't post-quantum. Its authors say it is "not, by default, post-quantum secure". It can be strengthened with a pre-shared key, which is how most WireGuard-based providers add ML-KEM: they run a post-quantum exchange first, then feed the result in as the key.

How SleekDart does post-quantum

SleekDart runs VLESS + REALITY on Xray-core, so its key exchange is the same TLS 1.3 hybrid your browser uses:

• Since Xray v25.5.16 (May 2025), REALITY negotiates X25519MLKEM768 whenever the website it borrows supports it. We pick borrowed sites that do, by measuring their handshakes from each server.
• Since Xray v26.9.9 (September 2026), REALITY servers can reject a handshake that lacks the post-quantum key share. Ours do. There's no downgrade path to classical-only key exchange.
• The client fingerprint is Chrome's (fp=chrome), which already includes the ML-KEM key share. Handshakes that look like other clients, or like random fingerprints, are refused.

The one practical side effect: apps built on upstream sing-box, up to version 1.14, strip that key share, so they can't connect. Happ, V2Box, Streisand, v2rayNG and recent Hiddify can. See how to set up the apps.

Does post-quantum encryption slow a VPN down?

No, not in any way you'd notice.

• Size: an ML-KEM-768 public key is 1,184 bytes and its ciphertext 1,088 bytes, per FIPS 203. That adds roughly one extra packet to the first message of each connection. The data that follows is encrypted exactly as before.
• Computation: ML-KEM operations take microseconds on a modern phone or laptop, far less than one network round trip.
• Our measurement: with post-quantum key exchange on every connection, VLESS + REALITY carried 2.0 Gbit/s on a single connection between London and Frankfurt. On café Wi-Fi, download through the tunnel matched the direct line.

What does cost speed is distance and the network itself. See what actually makes a VPN fast.

Do you need a post-quantum VPN?

If your VPN offers it, turn it on. There's no real downside. It matters most if:

• What you send needs to stay private for years: legal, medical, financial, business strategy, journalism, research.
• You often use networks you don't control, such as hotels, airports, cafés and foreign mobile networks, where traffic is easiest to record. A stealth protocol also keeps those networks from blocking you.
• You handle client or company data and want to meet the NIST 2030/2035 timeline early instead of retrofitting.

A fair question: if your browser already uses post-quantum TLS with many sites, what does the VPN add? Two things. First, the tunnel hides which sites and services you use, along with your DNS lookups, from the local network. A recording of that metadata is valuable too. Second, plenty of apps and servers still use classical-only TLS, and the tunnel wraps them in a post-quantum layer anyway.