Best Post-Quantum VPNs 2026: Which Providers Actually Ship PQC

Most VPN providers have not shipped post-quantum cryptography. Some claim “quantum-safe” in marketing without having changed anything. This guide focuses on VPNs that have actually deployed PQ key exchange in production, verified against their published documentation and protocols.

The standard to meet: the VPN must use ML-KEM (or Kyber, its pre-standard equivalent) for key exchange in the tunnel establishment, so that stored VPN traffic cannot be decrypted later by a quantum computer.

The comparison table

Provider	PQ Support	Protocol	Algorithm	Since	Verification
Cloudflare WARP	✅ Shipped	MASQUE (QUIC-based)	ML-KEM	July 2026	Cloudflare blog, verified
Mullvad	✅ Shipped	WireGuard (modified)	Kyber/ML-KEM	2023+ (progressive)	mullvad.net docs, app toggle
NordVPN	❓ Announced	NordLynx	Unconfirmed	Announced, timeline unclear	Marketing claims only
ExpressVPN	❌ Not shipped	Lightway	Classical only	N/A	No PQ documentation
ProtonVPN	❓ Partial	WireGuard	Research phase	Announced	Blog post, no shipping date
Tailscale	❌ Not shipped	WireGuard	Classical only	N/A	No PQ documentation

Important: “Shipped” means the feature is available to end users in the production app today, not announced for a future release.

Cloudflare WARP: the strongest PQ VPN implementation

Cloudflare announced in July 2026 that the WARP client uses post-quantum key agreement for all tunnel traffic. This is the most comprehensive PQ VPN deployment available because it covers both consumer (1.1.1.1 with WARP) and enterprise (Cloudflare One Zero Trust) use cases.

How it works: WARP uses MASQUE (an HTTP/3 and QUIC-based tunneling protocol) instead of WireGuard. The QUIC handshake uses X25519MLKEM768 for key exchange, providing hybrid post-quantum protection for the tunnel establishment.

What is protected:

All traffic between your device and Cloudflare’s network (harvest-attack protection)
For Cloudflare One customers: end-to-end PQ encryption of private network traffic via PQ on-ramps and off-ramps

Pricing: 1.1.1.1 with WARP is free. Cloudflare One Zero Trust starts at $7/user/month.

Limitations:

WARP routes all traffic through Cloudflare’s network (you must trust Cloudflare)
Not a traditional VPN in the “hide my IP from Netflix” sense, more a security-focused tunnel
The origin-server leg may still be classical unless you configure PQ there too

Mullvad: quantum-resistant WireGuard tunnels

Mullvad was one of the first VPN providers to ship PQ protection. Their implementation adds a post-quantum key exchange layer on top of standard WireGuard.

How it works: Enable “Quantum-resistant tunnel” in the Mullvad app settings (VPN settings > WireGuard settings). This adds a Kyber/ML-KEM key exchange on top of WireGuard’s standard X25519, creating a hybrid where both must be broken.

What is protected: The VPN tunnel between your device and the Mullvad server. Traffic beyond the Mullvad server (to the destination website) is protected by that website’s own TLS, not by Mullvad.

Pricing: $5.50/month (flat rate, no tiers)

Strengths:

Simple toggle in the app, no technical knowledge needed
No-logs policy independently audited
Privacy-focused company (accepts cash payment, no email required)
WireGuard-based (fast, well-audited protocol)

Limitations:

The PQ layer is added on top of WireGuard, not natively integrated into the WireGuard protocol itself (WireGuard upstream does not have PQ support yet)
Only protects the device-to-Mullvad-server leg

What about WireGuard itself?

WireGuard (the protocol, not any specific VPN provider) does not natively support post-quantum key exchange as of mid-2026. Its key exchange uses X25519 (classical Curve25519 Diffie-Hellman).

Providers like Mullvad add a PQ layer on top via a pre-shared key derived from a Kyber/ML-KEM exchange. This is a pragmatic solution but not a native protocol upgrade. A formal PQ WireGuard specification is under discussion but not finalized.

This means: if you self-host WireGuard without modifications, your VPN is not quantum-safe.

Enterprise VPN considerations

For enterprises, the VPN PQ landscape is more complex:

IPsec/IKEv2: The IETF has published drafts for PQ key exchange in IKEv2, but most commercial IPsec implementations (Cisco, Palo Alto, Fortinet) have not shipped production PQ support yet. Some offer “quantum-safe” modes in beta or technology preview.

Cloudflare One / Zero Trust: The strongest enterprise option in 2026. Supports PQ key exchange for the entire tunnel (WARP client to Cloudflare to origin), plus PQ authentication to origins (ML-DSA signatures, shipped August 2026).

Self-hosted: If you run your own VPN infrastructure, the fastest path to PQ is wrapping WireGuard with a Kyber pre-shared key (similar to Mullvad’s approach). Multiple open-source implementations exist.

How to verify your VPN is quantum-safe

For Cloudflare WARP: Check the client app status. If connected, the tunnel uses PQ by default (no toggle needed, it is always on in the latest client).

For Mullvad: Check Settings > VPN settings > WireGuard settings. “Quantum-resistant tunnel” should be toggled on. When active, the connection log will show the additional key exchange step.

For any VPN: Capture the tunnel handshake with Wireshark or tcpdump and look for Kyber/ML-KEM key exchange messages in the initial negotiation. If you only see X25519 DH, the tunnel is classical.

Our recommendation

For individuals who want PQ protection today: Mullvad ($5.50/month) with quantum-resistant tunnel enabled. Simple, audited, privacy-focused.

For teams and enterprises: Cloudflare One with WARP client. Most comprehensive PQ coverage (tunnel + origin authentication), enterprise management features, and Cloudflare’s network performance.

For self-hosters: Add a Kyber/ML-KEM pre-shared key layer to your existing WireGuard setup. Open-source implementations are available. This is more effort but gives you full control.

Do not rely on: VPN providers that claim “quantum-safe” without specifying which algorithm is used and when it shipped. If the provider cannot point you to documentation of their PQ key exchange implementation, assume it does not exist.

FAQ

Does a PQ VPN make me completely quantum-safe?

No. The VPN protects the tunnel between your device and the VPN server. Traffic beyond the VPN server (to the destination website) is protected by that website’s own TLS. If the destination does not use PQ TLS, that final leg is still vulnerable to harvest attacks.

Is Mullvad’s PQ implementation as strong as Cloudflare’s?

Both protect the tunnel with hybrid PQ key exchange. The implementations differ (WireGuard+Kyber vs MASQUE+ML-KEM) but the security outcome is similar. Cloudflare offers additional features (PQ origin authentication, Zero Trust integration) that matter for enterprises but not for individual users.

Should I switch VPNs just for PQ support?

If you already use Mullvad or Cloudflare WARP, enable PQ (it is free). If you use a provider without PQ support and your traffic is sensitive for 10+ years, consider switching. If your traffic is ephemeral (streaming, browsing), the urgency is lower.

When will WireGuard natively support PQ?

Under discussion but no committed timeline. Mullvad’s approach (adding a PQ layer on top) is the pragmatic interim solution. A native protocol update may take years to standardize and implement across all WireGuard clients.

Is IPsec quantum-safe?

Not in most production implementations as of mid-2026. IETF drafts exist for PQ IKEv2, but major firewall/VPN vendors have not shipped production PQ support yet. Check your vendor’s specific roadmap.