Why VPN PQC Matters
A VPN tunnel carries everything: logins, banking, email, documents. Harvest Now Decrypt Later against VPN traffic is among the highest-value HNDL targets. The question is which VPN providers have actually deployed Post Quantum Cryptography.
The Public Scorecard (April 2026)
| Provider | PQC status | Notes |
|---|---|---|
| Mullvad | Shipped | WireGuard + PQ key exchange experimental since 2022; hybrid ML-KEM production rollout ongoing |
| ExpressVPN | Partial | PQC key exchange announced on Lightway protocol (its proprietary OpenVPN replacement) |
| NordVPN | Partial | Post-quantum VPN tunnels announced for specific endpoints |
| IVPN | Planning | Roadmap mentioned PQC; production status uncertain as of April 2026 |
| ProtonVPN | Planning | PQC discussed but not publicly confirmed as default |
| Cloudflare WARP | Shipped | Cloudflare has >60% hybrid ML-KEM TLS already; WARP benefits |
| Most OEM VPNs | Not yet | Default IPsec and OpenVPN config still classical |
Note: these statuses change rapidly. Verify current status on each provider's official page before relying on PQC protection.
How VPN PQC Actually Works
- IPsec: RFC drafts for hybrid ML-KEM in IKEv2 are active (draft-ietf-ipsecme-ikev2-pqc). IPsec PQC is approaching stability.
- WireGuard: by default uses Noise protocol with X25519. Mullvad deployed a proprietary extension combining X25519 with a PQC KEM (historically Kyber, migrating to ML-KEM).
- OpenVPN / Lightway: use TLS 1.3 underneath. TLS 1.3 + hybrid X25519MLKEM768 gives PQC.
- WireGuard over TLS / QUIC: inherits TLS 1.3 PQC.
Questions to Ask Your VPN Provider
- Does your service use hybrid ML-KEM key exchange today?
- What specific algorithm is deployed (sntrup761, Kyber-1024, ML-KEM-768)?
- Is it default or opt-in?
- What's your migration timeline to NIST FIPS 203 ML-KEM if not yet deployed?
- Are logs or metadata stored in a way that could be retrospectively decrypted?
Self-Hosted WireGuard with PQC
For organizations with stricter requirements, self-hosting WireGuard with a custom hybrid layer (using Rosenpass, which wraps WireGuard with hybrid PQ KEM) is a practical path. Rosenpass is an open-source proof-of-concept that has influenced production designs.
Frequently Asked Questions
Which VPN has deployed PQC first?
Mullvad has been shipping a hybrid PQC WireGuard experimental extension since 2022. Cloudflare WARP inherits PQC from Cloudflare's TLS infrastructure. Specific rollout details change; check providers' current pages.
Does IPsec support PQC?
IPsec IKEv2 hybrid ML-KEM is an active IETF draft (`draft-ietf-ipsecme-ikev2-pqc`). Implementation in StrongSwan and other projects is in progress.
Should I use a VPN without PQC?
Classical VPN is still secure against classical attackers. For any traffic with multi-decade confidentiality (financial, medical, legal, activist), prefer a provider with PQC deployed or planned.
What is Rosenpass?
An open-source hybrid PQ KEM wrapper around WireGuard. Adds PQC protection to a WireGuard tunnel. Used as a reference for production designs.
Sources
Related Articles
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.
Try QNSQYOriginally published at quantumsequrity.com/blog/vpn-providers-pqc-scorecard.