The encryption a quantum computer cannot break — running on this phone, step by step. ML-KEM-768, the NIST standard since 2024, implemented from the text of the standard.
The shared secret becomes an AES-256 key. Type anything; it is encrypted on Bob's side and decrypted on Alice's.
| Scheme | Public key | Ciphertext | Quantum computer |
|---|---|---|---|
| RSA-2048 | 256 B | 256 B | breaks it (Shor, 1994) |
| X25519 (elliptic curve) | 32 B | 32 B | breaks it (Shor, 1994) |
| ML-KEM-768 | 1184 B | 1088 B | no known attack |
Bigger keys are the price. Chrome, Firefox and Cloudflare already pair X25519 with ML-KEM-768 in TLS — so the connection to this very page may have used it.
RSA rests on factoring, elliptic curves on discrete logs — a quantum computer solves both with Shor's algorithm. ML-KEM rests on a different problem: given a matrix A and A·s + e with small noise e, find s. No quantum algorithm is known to do that faster than a classical one.
FIPS 203, published by NIST in August 2024, after a six-year open competition. This page implements it line by line: Keccak, arithmetic in Z₃₃₂₉, the number-theoretic transform, sampling, compression, K-PKE, the KEM with implicit rejection.
Demonstration code, so you can see every step. It has no constant-time guarantees and no audit. For anything real, use a vetted library or the browser's own crypto once it ships ML-KEM.