01 · Particle
Security for a quantum future.
Quantum computers will break the public-key cryptography that protects today's data, identities and digital assets. Particle builds the replacement now, on the NIST post-quantum standards, and lets you test it right here.
Every tool in the Lab runs locally in your browser. Nothing you type is sent anywhere.
02 · The threat
Shor's algorithm breaks the math under RSA and elliptic curves.
Secure connections, software updates, certificates and crypto wallets rely on two problems: factoring large numbers and computing discrete logarithms. A large, error-corrected quantum computer solves both efficiently. Symmetric ciphers and hashes survive, but lose about half their strength to Grover's algorithm.
Classical strength from NIST SP 800-57 Part 1. Grover figures are the theoretical upper bound; in practice the attack parallelises poorly.
03 · Harvest now, decrypt later
Traffic recorded today can be opened later.
An attacker does not need a quantum computer yet. They only need to store your encrypted traffic until one exists. Michele Mosca's rule makes the risk concrete: if the years your data must stay secret (x) plus the years your migration takes (y) exceed the years until a quantum attacker arrives (z), that data is already exposed.
These are your own assumptions. Nobody can give z with confidence; see the timeline below for what is known.
04 · What is at stake
What a quantum attacker can reach.
Particle's work is organised around the three things public-key cryptography protects. Open a row to see what breaks and what we do about it.
-
- Relies on
- RSA or elliptic-curve key exchange (ECDH) to agree on the symmetric key.
- What breaks
- Recover the key exchange and every recorded session opens. This is the harvest-now risk above.
- Particle's answer
- Hybrid key encapsulation (ML-KEM-768 + X25519) feeding AES-256-GCM. Try it in the Vault.
-
- Relies on
- RSA, ECDSA and Ed25519 signatures in TLS certificates, code signing, passkeys and documents.
- What breaks
- Derive a private key from its public key and you can sign as that person, server or vendor.
- Particle's answer
- ML-DSA signatures (FIPS 204). Sign and tamper with a message in Signatures.
-
- Relies on
- ECDSA (secp256k1), Schnorr and Ed25519 signatures that prove who may move funds.
- What breaks
- Many chains reveal the public key on the first spend. From then on, Shor's algorithm could recover the key that controls the funds.
- Particle's answer
- Tooling to find exposed keys and move to post-quantum signatures as chains adopt them. See the roadmap.
05 · The approach
Hybrid by default. An attacker has to break both.
ML-KEM is young. X25519 is well studied but falls to a quantum computer. Particle combines them, the same way Chrome, Signal and OpenSSH now do, so a flaw in either one alone does not expose your key. Select a step to see what it does.
08 · Roadmap
The quantum clock, and what Particle does at each mark.
Published research, standards and deadlines, each with its source, alongside Particle's plan (the filled markers). Plans are targets and can change. Select an entry for detail.
09 · Questions
What people ask before they trust a new lock.
Start with one file.
Seal something you care about with a hybrid post-quantum key, keep the key file, and open it again. It takes under a minute.