A first step toward post-quantum security

1Password has deployed post-quantum cryptography on its web application. This deployment represents the first major milestone in the company's post-quantum cryptography journey. Data for users with compatible browsers such as Chrome or Firefox is now protected with no action required. The move addresses potential future threats from quantum computers capable of breaking public-key cryptographic algorithms used in communication protocols. The company noted the risk of harvest now, decrypt later attacks in which adversaries intercept and store encrypted traffic for later decryption. Protections are being implemented to safeguard long-term confidentiality of customer data. The initial rollout targets internet-facing traffic. 1Password supports hybrid post-quantum key exchange with X25519MLKEM768 for all web application connections. A compatible browser negotiates a TLS handshake that combines classical cryptography with a quantum-resistant algorithm such as ML-KEM. This hybrid method preserves compatibility while adding protection against future quantum adversaries. The process happens automatically without configuration changes or performance penalties. The company stated it will provide updates as it expands post-quantum cryptography coverage to other parts of its infrastructure.