What is post-quantum cryptography (PQC)?

PQC refers to cryptographic algorithms designed to be secure against attacks by quantum computers, aiming to replace vulnerable RSA and ECC in the future.

Why is Cloudflare pursuing a post-quantum strategy now?

To protect data in transit and at rest during the transition period, while ensuring compatibility with evolving standards and minimizing disruption for users.

When will PQC be widely deployed?

Standards are progressing, and deployment will occur in phases. Organizations should begin planning and piloting now, aligned with their data sensitivity and regulatory timelines.

What practical steps should organizations take today?

Start with a cryptographic inventory, identify long-term confidentiality data, pilot hybrid configurations, and develop a migration plan that gradually adopts PQC algorithms as standards mature.

Technology2 min read5/16/2026

Is Quantum Computing a Threat to Internet Security? Cloudflare’s Post-Quantum Strategy

Quantum computing could disrupt today’s internet security, but a standards-aligned move to post-quantum cryptography offers a safe, practical path. This post explains PQC basics, Cloudflare’s hybrid TLS approach, and concrete steps for organizations to begin migrating.

Listen to this article

Uses your browser voice to read the article content.

Is Quantum Computing a Threat to Internet Security? Cloudflare’s Post-Quantum Strategy

Key takeaways

Quantum computers could undermine current public-key cryptography, highlighting the need for post-quantum cryptography (PQC).
A hybrid TLS approach enables secure, gradual migration to quantum-safe algorithms without breaking existing connections.
Standards like NIST PQC guide algorithm selection and interoperability during the transition.
Organizations should start with cryptographic inventory, risk assessment, and a phased migration plan.

The Quantum Threat Landscape

Quantum computers could render widely used public-key cryptography vulnerable, potentially compromising data in transit for sensitive connections. The long-term risk is real, especially for archived data that needs confidentiality years from now. While practical quantum machines capable of breaking current cryptography at scale do not yet exist, researchers and standards bodies are actively preparing for this future with post-quantum cryptography (PQC).

Key ideas to know now:

Public-key cryptography such as RSA and ECC could be weakened by quantum attacks.
Symmetric cryptography requires larger key sizes to maintain resistance.
Standards development is ongoing to standardize PQC algorithms.

Cloudflare's Post-Quantum Strategy

Hybrid TLS and Algorithm Agility

To balance security today with readiness for tomorrow, Cloudflare is adopting a hybrid approach that combines traditional cryptography with post-quantum algorithms during TLS handshakes. This strategy preserves compatibility with existing clients while gradually migrating to quantum-safe options. You can learn more about our PQC resources in downloads or follow research updates in our AI cryptography work.

For threat context and ongoing monitoring, see Radar threat intelligence and our official announcements in the blog.

Migration plan and timelines

Our plan emphasizes phased adoption aligned with evolving standards. We start with data that has long-term confidentiality needs, pilot hybrid configurations, and gradually expand as PQC candidates become standardized and mature. This reduces risk and minimizes user disruption.

Performance and Usability

PQC selection and hybrid configurations can influence latency and key management. Cloudflare focuses on sensible defaults, monitoring, and graceful fallbacks to keep performance stable while raising resilience against quantum threats.

Default configurations designed for broad client compatibility
Observability and telemetry to guide adjustments

Standards, Collaboration, and Standards Bodies

Standards bodies such as NIST are evaluating and standardizing PQC algorithms. Staying aligned with these developments helps ensure interoperability across the internet ecosystem. For official standards, see NIST Post-Quantum Cryptography project.

Getting Started with Cloudflare

Organizations can begin by assessing their cryptographic inventory, identifying data with long confidentiality needs, and planning a PQC transition. Explore our resources and services to start the journey: Cloudflare security services, PQC readiness resources, threat intelligence with Radar, and Cloudflare blog.

For background reading, see official PQC discussions at Cloudflare Learning Center on PQC.

External reference: Visit Quantum.gov for a high-level view of national quantum initiatives.