Signal and iMessage already protect your chats against future quantum computers: Signal added post-quantum encryption in September 2023, and Apple did the same for iMessage in February 2024. WhatsApp's maker Meta has not announced post-quantum protection for chats, and Telegram's documentation describes none.
Below, per app, what is protected, since when, and what is not, with a link to what the maker itself published.
Why your chats matter now, not on Q-Day
Every encrypted chat starts with a key exchange. Your phone and your friend's phone agree on a secret key, over the open internet, without anyone else learning it. Today most apps do this with elliptic-curve cryptography. A large quantum computer could break that.
Think of two people agreeing on the combination of a shared safe while a stranger records every word. Today the stranger cannot work out the combination from the recording. If he keeps the tape and one day gets a machine that can, every letter ever put in that safe opens at once.
That is the attack called harvest now, decrypt later: record encrypted traffic today, decrypt it once a quantum computer exists. That is why messaging apps start with the key exchange. A post-quantum key exchange uses math that is believed to resist quantum computers. Signal and Apple both run it next to the old method, a "hybrid" design: an attacker has to break both.
Signatures, which prove who you are talking to, are a different story. Apple explains why it left them classical for now: a forged identity only helps an attacker during the conversation, not years later from a recording.
The four apps side by side
| App | What protects your chats today |
|---|---|
| Signal | Post-quantum key exchange (PQXDH, X25519 plus CRYSTALS-Kyber) since September 2023. Since October 2025 a second layer, SPQR, keeps renewing post-quantum keys during a chat; Signal is rolling it out gradually (Signal, 2023; Signal, 2025) |
| iMessage | PQ3 since iOS 17.4, February 2024: Kyber next to classical elliptic-curve keys, both at the start and while you chat. Signatures are still classical (Apple Security Research) |
| End-to-end encrypted with the Signal Protocol since April 2016 (Signal, 2016). Meta has not announced a post-quantum key exchange for chats | |
| Telegram | Ordinary chats use "server-client encryption"; only opt-in secret chats are end-to-end, with a 2048-bit Diffie-Hellman key exchange. The documentation does not mention post-quantum (Telegram API docs) |
Signal: first, and still upgrading
Signal announced PQXDH on September 19, 2023. It adds CRYSTALS-Kyber, the algorithm NIST later standardized as ML-KEM, to the existing X25519 key exchange. Signal says an attacker would have to break both to learn the key. Existing chats were moved over with app updates, and the old method was to be switched off for new chats once enough users had updated (Signal blog).
PQXDH protects the start of a chat. On October 2, 2025, Signal added SPQR, a "Triple Ratchet" that keeps mixing in fresh post-quantum keys while the conversation runs. That matters if a key ever leaks: the chat can heal itself, even against a quantum attacker. Signal says it is rolling this out slowly and will later require it for all chats; it gave no end date (Signal blog).
iMessage: PQ3
Apple introduced PQ3 on February 21, 2024, with iOS 17.4, iPadOS 17.4, macOS 14.4 and watchOS 10.4. Conversations between devices that support it switch automatically, and Apple said PQ3 would replace the old protocol in all supported conversations during 2024. PQ3 uses Kyber-1024 to set up a chat and Kyber-768 to renew keys, at first about every 50 messages and at least every seven days (Apple Security Research).
Apple rates messaging apps on its own scale from 0 to 3. It puts PQ3 at level 3, and Signal's PQXDH, as it was in early 2024, at level 2: post-quantum at the start only. Signal's SPQR has since added the ongoing part. PQ3 is the protocol of iMessage. Green-bubble SMS and RCS messages are a different system, and Apple's announcement does not cover them.
WhatsApp: no announcement
WhatsApp has encrypted chats end to end with the Signal Protocol since 2016. That protocol's original key exchange is classical. We found no statement from Meta that WhatsApp chats now use a post-quantum key exchange. Meta's engineering blog described its post-quantum migration in April 2026, but that post is about Meta's internal infrastructure and does not mention messaging (Engineering at Meta).
That does not mean WhatsApp chats are readable today. They are not. It means a recording of today's WhatsApp traffic is not protected against a future quantum computer, as far as Meta has published.
Telegram: different design
Telegram works differently. Ordinary chats use what its documentation calls server-client encryption, not end-to-end encryption. Secret chats, which you start yourself, are end to end and agree on keys with Diffie-Hellman over a 2048-bit prime. That is the kind of math Shor's algorithm breaks. The documentation does not mention post-quantum protection (Telegram API docs).
What we do not know
Whether Meta is working on it. Meta may be testing post-quantum chats without saying so. We only report what a maker publishes.
How far Signal's SPQR rollout is. Signal has not said when every chat will use it.
Whether the new math holds. Kyber is young compared with elliptic curves. That is why Signal and Apple run it next to the old method rather than instead of it.
When a quantum computer can do this. Forecasts differ, and each has a name attached. Our Q-Day timeline lists them, and the Q-Day countdown runs to the earliest.
What this means for you
Keep your apps updated: the protection only works when both phones run a version that supports it. If you send something that must stay secret for many years, such as medical, legal or business details, Signal and iMessage are the two that have published post-quantum protection for chats. Our Mosca's theorem calculator helps you judge how long "many years" is for your data. For the bigger picture, see post-quantum cryptography and how banks are preparing.