Post-quantum encryption.
Encryption chosen to survive a quantum computer. The threat is not that someone breaks your file tomorrow, it is that someone copies it tomorrow and breaks it in fifteen years. That attack has a name: harvest now, decrypt later.
Post-quantum encryption uses algorithms believed to resist attack by a large quantum computer, replacing or reinforcing the elliptic-curve and RSA key exchanges that Shor's algorithm would break.
What it is
Classical public-key cryptography rests on problems that are hard for the computers we have. X25519 relies on the difficulty of the discrete logarithm on Curve25519; RSA relies on factoring. A sufficiently large, error-corrected quantum computer running Shor's algorithm solves both. Post-quantum schemes are built on different mathematics instead, most commonly structured lattices, for which no efficient quantum attack is known. ML-KEM is the lattice-based key encapsulation mechanism NIST standardised for exactly this job.
Why it matters
Ciphertext is durable. An adversary who can intercept traffic or seize a backup does not need to read your file today; they can store it and wait. When the machine that breaks X25519 eventually exists, every recording made in the meantime opens at once. That makes the relevant question not "will quantum computers arrive" but "how long does this file need to stay secret". Source code, legal discovery, medical records, journalistic material and personal archives all have secrecy lifetimes measured in decades, and classical X25519 alone does not carry them that far. Anything you encrypt today with a ten year horizon should be encrypted as though the attacker already has the recording, because they may.
Related terms
Common questions.
Does a quantum computer exist that can break X25519?
Not publicly, and not today. The point of post-quantum encryption is that the attack happens later while the recording happens now, so a file with a long secrecy lifetime needs the protection before the machine arrives.
Is X25519 broken?
No. Against every classical attacker known, X25519 remains an excellent choice. It is specifically a cryptographically relevant quantum computer running Shor's algorithm that would undo it, which is why AgePony pairs X25519 with ML-KEM rather than replacing it.
Get AgePony
Free file encryption for iOS and Android. No accounts, no tracking, no servers.