# Over Half of Web Traffic Is Now Post-Quantum: What That Means
Table of Contents
In late October 2025 Cloudflare, one of the large networks that carry a big share of Internet traffic, announced a milestone: more than half of the human-initiated web traffic passing through its servers is now protected with post-quantum cryptography. The term sounds like something from a lab, but the issue touches anyone who uses a website, shops online, or sends a message. It’s worth understanding what it means, which threat it guards against, and what’s still left to do.
The news in brief
The announcement marks a quiet turning point. A few years ago post-quantum cryptography was confined to experiments; today it’s on by default in most of the widely used browsers. Chrome enabled it on desktop in March 2024 and on Android in November 2024; during 2025, Firefox and Apple’s systems on iPhone, iPad, and Mac joined in. The result is that, without users doing anything, more than one connection in two now starts out protected against an attack that isn’t possible today but could become so later.
The problem: “harvest now, decrypt later”
To see why this matters, start with a threat that has an unsettling name: harvest now, decrypt later. The idea is simple and uncomfortable. Internet traffic today is encrypted: when the padlock shows up in your browser, the data traveling between your device and the site is made unreadable to anyone intercepting it. That protection holds because today’s computers don’t have the raw power to break it in any reasonable time.
The catch is that quantum computers - a technology still under development, built on different principles from ordinary computers - could one day break much of the cryptography we rely on now. That hypothetical moment is called “Q-day.” Nobody knows for sure whether or when it will arrive: expert estimates range from a bit more than ten years to several decades. But one detail makes the problem present rather than future: someone intercepting encrypted traffic today can store it and archive it, waiting to decrypt it once the technology allows. Data that stays sensitive for years - medical records, trade secrets, confidential communications - is therefore already at risk now, even though the machine capable of opening it doesn’t exist yet.
The answer: post-quantum cryptography
The countermeasure is called post-quantum cryptography: new algorithms designed to resist even a quantum computer. They don’t need special hardware, they’re ordinary software, and they run on everyday devices. The part that arrived first is key exchange (also called key agreement): the opening step of a secure connection, where the browser and the site agree on a shared secret key that is then used to encrypt the rest of the conversation. That step is exactly what’s exposed to the “harvest now, decrypt later” attack, so it’s the first thing to secure.
Hybrid key exchange
In practice, the old cryptography wasn’t thrown out and replaced with the new one. The approach is hybrid: a classical algorithm, proven over years, is combined with a post-quantum one. The connection stays protected as long as at least one of the two holds. So if a weakness were later found in the new algorithm - not impossible, given how recent it is - the traditional one would still provide protection; and against a quantum attack, the new part does the job. Belt and suspenders, together.
The most common scheme right now is called X25519MLKEM768. The name is a mouthful, but it says exactly what’s inside: X25519 is the classical algorithm long used for key exchange, and ML-KEM-768 is the post-quantum part. ML-KEM (short for Module-Lattice-Based Key-Encapsulation Mechanism, previously known as Kyber) was officially standardized by the US agency NIST on 13 August 2024, under the name FIPS 203. So it isn’t one vendor’s experiment, but a public standard the industry is aligning around. All of this runs inside TLS 1.3, the protocol behind https and the browser padlock.
Why “over 50%” is a real milestone
That such a large share of traffic already uses these algorithms isn’t a detail for insiders. Passing the halfway mark means the protection is no longer an exception but is becoming the norm, transparently for the person browsing. The credit goes mostly to browsers, which turned it on by default: users didn’t have to install or configure anything. On the site side, adoption lags further behind - scans from September 2025 put roughly 39% of public web servers ready to use it - but the direction is clear. It’s also worth remembering that Cloudflare’s figure covers “human-initiated” traffic, meaning connections from real browsers, kept separate from automated bot traffic.
What’s still missing: signatures and certificates
The picture, though, is only half complete. Cryptography does two different jobs, and both need to become post-quantum. The first is keeping data secret: that’s the key exchange just described, and it’s the part already in production. The second is authentication: making sure you’re really talking to the right site and not an impostor. That relies on certificates and digital signatures, and it’s the part still behind.
The reason is technical but understandable: post-quantum signatures take up much more space than current ones, which creates performance and compatibility problems with systems built for smaller sizes. At the time of the announcement, in October 2025, the standards for post-quantum certificates were not yet final; work on “hybrid” certificates was underway, with hopes of wrapping it up in early 2026. Certificates like these are unlikely to be in widespread use before 2027. Meanwhile, other NIST standards for signatures are already published - ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), both released in 2024 - along with a backup key-exchange algorithm, HQC, chosen in March 2025 as an alternative built on different mathematical principles.
In short
For most people there’s nothing to do: keep browsers and operating systems updated, and the protection arrives on its own. For those who run sites and servers, the message is to prepare without rushing but without putting it off: check that your stack supports post-quantum key exchange, keep software current, and, looking further ahead, get used to the idea that certificates will need to be reissued in new formats. Several authorities - in the US, Europe, the UK, and Australia - point to migration deadlines between 2030 and 2035: there’s time, but that’s no reason to wait passively.
Passing the 50% mark doesn’t solve the problem, but it signals that the transition has genuinely started and is moving along quietly, one browser update at a time.
