Download QNSQY
One command installs both CLI and GUI. All cryptographic operations run locally and your data never leaves the machine. The Free tier runs fully offline; paid tiers contact the billing endpoint only to validate the subscription.
Free Version
Personal use. Quantum-safe encryption. ML-KEM-512 + ML-DSA-44 are unlimited with no file-size cap; advanced algorithms have a 100 MB per-file limit on Free.
Linux
x86_64 · glibc 2.35+Verified end-to-end on Ubuntu 22.04 / 24.04 / 24.10 / 25.04 / 25.10 / rolling, Debian 12 / 13 (trixie), Fedora 40 / 41 / 42 / 43 / 44, AlmaLinux 10 — install via package manager + run the full Free-tier suite (ML-KEM-512 recipient round-trip, ML-DSA-44 sign/verify, AES-256-GCM password round-trip, BLAKE3 hash) and the Business-tier suite (FN-DSA-1024, HQC-256, LMS-SHA256-H10W2, SLH-DSA-128s, ML-KEM-1024) on each. Not supported on Debian 11 / Rocky 9 / AlmaLinux 9 (glibc < 2.35).
Quick Install (Recommended)
Installs both CLI and GUI. After install: qnsqy or qnsqy-gui
curl -fsSL https://quantumsequrity.com/downloads/install.sh | bash
Copied!
Manual Download
Single unified binary includes CLI, GUI, TUI, and MCP server
macOS
Coming Q3 2026macOS builds are targeted for Q3 2026. Join the waitlist to be notified when the macOS build is ready.
Windows
x86_64 · Windows 10 1809+ / 11
Verified end-to-end via Wine in both Windows 10 and Windows 11 emulation modes (11/11 free-tier tests pass on each). Add --acknowledge-no-sandbox to commands that require network isolation acknowledgment.
Installer (Recommended)
NSIS installer registers in Add/Remove Programs and adds Start Menu entries.
Portable Binary
Single .exe, no install. Run from any folder or USB stick.
Note: Windows cannot enforce kernel-level network sandboxing the way Linux seccomp does. The crypto itself is unchanged, but the "file content never leaves the machine" guarantee relies on the binary's good behavior, not a kernel block. For air-gapped use cases, the Linux build is recommended. See Security for details.
SHA-256 Checksums (v7.2.39)
# Linux cd8560695cfcbc44618ac8e37f930b83e89290d5cebc96ec822f9215cb7bbcf3 qnsqy-7.2.39-1.x86_64.rpm 9bfb507aacca383e1c5e2f1862746912f7e5c97ebc7b73af8d4afc0faa260da7 qnsqy_7.2.39-1_amd64.deb # Windows 133fba8256ca5998159f3f4d11bb20304b04778ce0a1533743102dac0fe36bd5 qnsqy-setup-7.2.39.exe b48062f8981eb99d3197080e75a0e5de013eee9d81550b381ab35ad62432dfd0 qnsqy-7.2.39-x86_64.exe # Verify the checksums file itself with the signed checksums.txt.sig # (ML-DSA-87 / NIST FIPS 204 / post-quantum, security level 5). # v7.2.35 embeds the current release pubkey (BLAKE3 fingerprint # 50af23b47dca8d74); verify-release works with no extra flags. # curl -LO https://cdn.quantumsequrity.com/linux/checksums.txt # curl -LO https://cdn.quantumsequrity.com/linux/checksums.txt.sig # qnsqy verify-release checksums.txt checksums.txt.sig
Installation Guide
Install via RPM (dnf), DEB (apt), npm (npm install -g qnsqy), or download a standalone binary. No root access required for binary installs.
One Unified Binary
QNSQY ships as a single unified binary (~47 MB) that includes CLI, GUI, TUI, and MCP server. Run mode is detected automatically:
qnsqy | CLI mode (default) |
qnsqy --gui | Launch desktop GUI |
qnsqy --tui | Terminal UI |
qnsqy --mcp | MCP server (JSON-RPC) |
Or create symlinks: qnsqy-gui / qnsqy-tui / qnsqy-mcp for mode auto-detection.
Linux - Package Managers
# Ubuntu / Debian (APT repository) $ curl -fsSL https://cdn.quantumsequrity.com/repo/qnsqy-repo.gpg.asc | sudo gpg --dearmor -o /usr/share/keyrings/qnsqy.gpg $ echo "deb [signed-by=/usr/share/keyrings/qnsqy.gpg] https://cdn.quantumsequrity.com/repo/deb stable main" | sudo tee /etc/apt/sources.list.d/qnsqy.list $ sudo apt update && sudo apt install qnsqy # Fedora / RHEL / CentOS (DNF repository) $ sudo tee /etc/yum.repos.d/qnsqy.repo <<'EOF' [qnsqy] name=QNSQY baseurl=https://cdn.quantumsequrity.com/repo/rpm enabled=1 gpgcheck=0 repo_gpgcheck=1 gpgkey=https://cdn.quantumsequrity.com/repo/qnsqy-repo.gpg.asc EOF $ sudo dnf install qnsqy # npm (wrapper package, installs the same binary) $ npm install -g qnsqy # Verify installation $ qnsqy version QNSQY v7.2.39 (Free)
Linux - Manual Package Install
# Fedora / RHEL / CentOS (RPM) $ curl -fsSLO https://cdn.quantumsequrity.com/linux/qnsqy-7.2.39-1.x86_64.rpm $ sudo dnf install ./qnsqy-7.2.39-1.x86_64.rpm # Ubuntu / Debian (DEB) $ curl -fsSLO https://cdn.quantumsequrity.com/linux/qnsqy_7.2.39-1_amd64.deb $ sudo apt install ./qnsqy_7.2.39-1_amd64.deb # Verify installation $ qnsqy version QNSQY v7.2.39 (Free) # Encrypt your first file $ qnsqy encrypt -i secret.pdf
Windows / macOS
# Windows builds are available above (installer + portable .exe). # macOS builds are targeted for Q3 2026. # Join the waitlist above to be notified when macOS is ready.
Linux - GUI Mode
# After installing, launch GUI mode: $ qnsqy --gui # Or create a symlink for convenience: $ ln -s ~/.local/bin/qnsqy ~/.local/bin/qnsqy-gui $ qnsqy-gui # auto-detects GUI mode from name # TUI (Terminal UI) mode: $ qnsqy --tui
Quick Start
# Encrypt a file (creates secret.pdf.qs) $ qnsqy encrypt -i secret.pdf Enter password: ******** Confirm password: ******** ✓ Encrypted: secret.pdf.qs # Decrypt the file $ qnsqy decrypt -i secret.pdf.qs Enter password: ******** ✓ Decrypted: secret.pdf # Securely delete the original $ qnsqy shred secret.pdf ⚠ This will permanently destroy: secret.pdf ✓ Securely deleted.
Verify Your Download
Always verify a download before installing. Every QNSQY release carries three independent signature layers, so you can prove the binary is exactly what we published. Use any one of them; using more raises the bar an attacker would have to clear.
1. SHA-256 checksum (fastest)
Compare the hash of your file against the SHA-256 list published above.
# Linux (RPM or DEB) $ sha256sum qnsqy-7.2.39-1.x86_64.rpm $ sha256sum qnsqy_7.2.39-1_amd64.deb # Windows (PowerShell or cmd) PS> Get-FileHash qnsqy-7.2.39-x86_64.exe -Algorithm SHA256 > certutil -hashfile qnsqy-7.2.39-x86_64.exe SHA256 # The output must match a checksum published above. If it does not, do not run it. Re-download.
2. Post-quantum ML-DSA-87 release signature
Every release ships a checksums.txt manifest signed with our ML-DSA-87 release key (NIST FIPS 204, post-quantum security level 5). The verification key is embedded in every QNSQY binary (BLAKE3 fingerprint 50af23b47dca8d74) and is also published at quantumsequrity.com/keys/release-mldsa87.pub.
# Download the signed manifest $ curl -LO https://quantumsequrity.com/downloads/checksums.txt $ curl -LO https://quantumsequrity.com/downloads/checksums.txt.sig # Verify it with the key embedded in any QNSQY install $ qnsqy verify-release checksums.txt checksums.txt.sig RELEASE_SIGNATURE_OK # Then confirm your download's SHA-256 appears in the verified manifest.
3. Sigstore / cosign transparency log
The same manifest is signed keylessly from our public GitHub CI identity and recorded in the public Sigstore Rekor transparency log. This layer is independent of the ML-DSA-87 key: forging a release would require defeating both.
# Install cosign once, then: $ curl -LO https://quantumsequrity.com/downloads/checksums.txt $ curl -LO https://quantumsequrity.com/downloads/checksums.txt.cosign.sig $ curl -LO https://quantumsequrity.com/downloads/checksums.txt.cosign.pem $ cosign verify-blob \ --certificate-identity-regexp 'https://github.com/quantumsequrity/qnsqy/\.github/workflows/sign-release\.yml@.*' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --signature checksums.txt.cosign.sig \ --certificate checksums.txt.cosign.pem \ checksums.txt Verified OK
Installing through the apt or dnf repository adds a fourth check automatically: the repository metadata is GPG-signed (repo_gpgcheck=1) and pins each package's SHA-256, so your package manager verifies authenticity on every install and update without any extra steps.
If Windows warns you
On a fresh download, Windows SmartScreen may show a blue dialog: "Windows protected your PC. Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk. Unknown publisher." This is expected: Windows cannot verify post-quantum signatures yet, and we sign with them anyway. Your data is safe and the binary is authentic. Here is exactly what is happening and how to verify us more strongly than SmartScreen ever could.
Why SmartScreen shows "Unknown Publisher"
QNSQY releases are signed with NIST FIPS 204 ML-DSA-87 post-quantum signatures: every release ships a SHA-256 checksums.txt manifest plus an ML-DSA-87 signature (checksums.txt.sig) over it. This is cryptographically stronger than Microsoft Authenticode, which is the legacy ECDSA/RSA signing format Windows recognises by default. Windows does not yet natively verify post-quantum signatures, so SmartScreen treats the publisher as unknown.
A Microsoft Authenticode certificate from an EV CA costs money and takes weeks of vetting. We will add it as a convenience layer in a later release. The cryptography protecting the binary itself is unaffected, and we believe shipping real post-quantum signatures today matters more than waiting on a legacy certificate path.
Two ways to verify the binary on Windows
Pick whichever you prefer. Each one independently proves the binary is the one we published. A third option, cosign / Sigstore, is shown under Verify Your Download above.
1. SHA-256 hash check
Compare the hash of your download to the official SHA-256 listed above. Windows ships two ways to do this out of the box.
# Command Prompt (cmd.exe) > certutil -hashfile qnsqy.exe SHA256 # PowerShell PS> Get-FileHash qnsqy.exe -Algorithm SHA256 # The output should match the SHA-256 published on this page. # If it does not match, do not run the binary. Re-download.
2. Post-quantum ML-DSA-87 release signature
Every release publishes a checksums.txt manifest signed with our ML-DSA-87 release key (NIST FIPS 204). The verification key is embedded in every QNSQY binary (BLAKE3 fingerprint 50af23b47dca8d74), and the same public key is published at quantumsequrity.com/keys/release-mldsa87.pub. If you already have any QNSQY install on any platform, verify the signed manifest, then check your download's hash against it.
# 1. Download the signed checksums manifest $ curl -LO https://quantumsequrity.com/downloads/checksums.txt $ curl -LO https://quantumsequrity.com/downloads/checksums.txt.sig # 2. Verify the manifest signature with the key embedded in the binary $ qnsqy verify-release checksums.txt checksums.txt.sig Using embedded release public key (BLAKE3 fingerprint: 50af23b47dca8d74) RELEASE_SIGNATURE_OK # Or verify against the published key instead of the embedded one: $ curl -LO https://quantumsequrity.com/keys/release-mldsa87.pub $ qnsqy verify-release checksums.txt checksums.txt.sig --pubkey @release-mldsa87.pub # 3. Check your download's SHA-256 against the verified manifest > certutil -hashfile qnsqy.exe SHA256 # The hash must match the qnsqy.exe line in checksums.txt.
Once you have verified it: how to run past SmartScreen
After you have confirmed the binary is authentic using any method above, here is how to launch it.
- Double-click
qnsqy.exe. The blue SmartScreen dialog appears. - Click the small "More info" link in the dialog. A new line appears showing the app name and publisher (Unknown).
- Click the "Run anyway" button that has now appeared at the bottom right.
- The app starts. Windows remembers your choice for this binary, so SmartScreen will not warn again for this exact file.
If your IT policy disables "Run anyway" entirely, ask your administrator to allowlist the SHA-256 hash published above. The binary's integrity is provable from the hash alone.
System Requirements
Windows
10 / 11
64-bit (x64) required
macOS
Not yet
No ship date. Linux + Windows only.
Linux
glibc 2.35+
Ubuntu 22.04+, Debian 12+, Fedora 40+, AlmaLinux 10
Memory
256 MB
More recommended for large files
Disk Space
50 MB
Plus space for encrypted files
Network
Optional
All cryptographic operations run locally; data never leaves the machine. Free tier runs fully offline; paid tiers contact the billing endpoint only to validate the subscription (cached up to 7 days). Fully offline on-site deployment for organizations is available under NDA through sales.
Coming Soon
Additional platforms and package managers in development:
Questions?
Check out the documentation or reach out for help.