Security Tools › PKI & Certificates › Post-quantum cryptography
Post-quantum lab
Run the NIST post-quantum standards in your browser: ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205). See real key, ciphertext and signature sizes and timings, and how they compare with today’s algorithms.
- 3 free tools
- Nothing uploaded or stored
- FIPS 203 · 204 · 205
Post-quantum cryptography
The NIST standards that replace RSA and elliptic curves before large quantum computers arrive — running live in your browser.
NIST post-quantum standards FIPS 203 · 204 · 205 (August 2024)
Key encapsulation (from CRYSTALS-Kyber) for setting up shared keys. Parameter sets 512, 768, 1024.
Lattice-based digital signatures (from CRYSTALS-Dilithium). The general-purpose replacement for RSA and ECDSA signatures. Sets 44, 65, 87.
Stateless hash-based signatures (from SPHINCS+). Conservative security based only on hash functions; larger and slower. 12 parameter sets.
| Where it is standardised for PKI | Specification |
|---|---|
| ML-DSA keys and signatures in X.509 certificates and CRLs | RFC 9881 (Oct 2025) |
| ML-DSA in CMS / PKCS#7 signatures | RFC 9882 (Oct 2025) |
| SLH-DSA in X.509 | RFC 9909 (Dec 2025) |
| ML-KEM keys in X.509 certificates | RFC 9935 (Mar 2026) |
Getting ready. Inventory where you use RSA and elliptic curves, start with data that must stay secret for years ("harvest now, decrypt later"), make your systems crypto-agile, and test with PQC-capable software such as OpenSSL 3.5 or later. Major browsers already negotiate the hybrid X25519MLKEM768 key exchange in TLS 1.3. NIST's draft transition plan (IR 8547) proposes deprecating 112-bit RSA and ECC after 2030 and disallowing quantum-vulnerable public-key algorithms after 2035. Check that your HSM firmware supports ML-DSA and ML-KEM before you plan a PQC CA.
Post-quantum lab ML-KEM · ML-DSA · SLH-DSA PQC
Run the real algorithms in a background thread of your browser and see sizes and timings for yourself. Uses the open-source, audited noble-post-quantum library (MIT licence), served from this site.
How big are post-quantum keys and signatures?
Post-quantum security costs bytes. Compare sizes on a logarithmic scale (each step is ten times larger).
Sizes in bytes from FIPS 203, 204 and 205; ECDSA P-256 signature shown at its maximum DER size. Purple bars are post-quantum.