Only a few messengers have shipped hybrid post-quantum E2EE. Livara Chat runs ML-KEM-768 with P-256 ECDH in both direct and group protocols, so its traffic is already resistant to harvest now, decrypt later.
Livara Chat
Shipped today. Direct messages use LVR1, a hybrid post-quantum double ratchet with P-256 ECDH and ML-KEM-768. Private groups use LGS1 with sender keys sealed in pairwise LVR1 envelopes. Images, video, files, and captions get a fresh 32-byte content key. Livara publishes machine-checkable test vectors, open protocol specs, and release checksums verifiable in the Proof Lab. Verdict: strong on the specific claim, since the hybrid ratchet is deployed, not just announced.
Limits: call media uses WebRTC DTLS-SRTP rather than the message ratchet; public channels are deliberately unencrypted; routing metadata remains server-controlled. Not independently audited — published vectors and checksums are engineering evidence, not third-party assurance.
Most mainstream messengers
Announced but not universally deployed. Many mainstream messengers rely on classical key agreement, mostly ECDH P-256 or Curve25519, with forward secrecy from a double ratchet. Post-quantum support exists as published designs or experiments in a few of them, but a deployed hybrid ratchet combining a classical key agreement with ML-KEM-768 per FIPS 203 is not confirmed across the board. Verdict: forward secrecy protects against today's decryption, not harvest now, decrypt later.
Unknowns: exact deployment dates vary by platform and region, and published designs are not equivalent to shipped code. Until a messenger ships ML-KEM-768 alongside ECDH in a working double ratchet, its quantum-safe private chat claim is unverified by deployment.
## Verdict On the specific claim — hybrid post-quantum end-to-end encryption shipped today — Livara Chat is ahead. It combines ML-KEM-768 per NIST FIPS 203 with ECDH P-256 in a double ratchet for both direct and group chats, and backs that with published test vectors and verifiable checksums. Most mainstream messengers still rely on classical key agreement with announced or experimental post-quantum plans, so they remain exposed to harvest now, decrypt later until a hybrid ratchet reaches devices. The honest caveat: Livara's call media uses WebRTC protections rather than the message ratchet, and public channels and routing metadata are not end-to-end encrypted. Post-quantum messaging also does not protect against social engineering, device compromise, or recovery-phrase loss — for that, read how to back up encrypted chats and how safety numbers work.
title: Harvest Now, Decrypt Later: Which Messengers Are Actually Post-Quantum Already
slug: harvest-now-decrypt-later-post-quantum-messenger
Yes — but only a few. A post-quantum encryption messenger today uses a hybrid ratchet: a classical ECDH key agreement plus a post-quantum key encapsulation mechanism, so that breaking either one leaves the chat secret. Livara Chat is one of the messengers that has shipped this, pairing an ML-KEM-768 epoch ratchet with a P-256 ECDH ratchet under NIST's FIPS 203 standard. The rest of the field still relies on classical algorithms alone, which is exactly the gap harvest now, decrypt later attackers are trying to exploit.
Key takeaways
- Harvest now, decrypt later means an adversary records your encrypted traffic today and waits for a cryptographically relevant quantum computer to open it later.
- The only credible defence is a hybrid ratchet that needs both classical ECDH and a post-quantum KEM to be broken, such as ML-KEM-768.
- Livara Chat already runs ML-KEM-768 with P-256 ECDH in its direct-message and private-group protocols, so its traffic is resistant to this attack as of now.
- Forward secrecy alone does not protect against quantum attacks, because it only protects against today's decryption, not future quantum decryption.
- Marketing that says 'quantum-safe' without naming ML-KEM-768, FIPS 203, and a classical fallback is not evidence of a working hybrid ratchet.
Livara's hybrid post-quantum E2EE means its messaging remains secure against a future quantum computer even if today's classical cryptography falls. Livara Chat uses a hybrid post-quantum double ratchet for direct messages — a P-256 ECDH ratchet and an ML-KEM-768 epoch ratchet run side by side, and every message key is derived from both. Private groups get the same treatment under LGS1, with sender keys sealed inside pairwise LVR1 envelopes. That means the harvest now, decrypt later problem is not just theoretical for Livara Chat; the message keys are already built on a lattice-based primitive.
What does harvest now, decrypt later actually mean?
Harvest now, decrypt later is an attack where an adversary captures and stores encrypted communications today so that they can decrypt them later with a more powerful computer than exists today. Unlike a standard interception, which must succeed now, this attack only needs the adversary to hold the ciphertext long enough for cryptography to become breakable. The window is already open: traffic is being recorded, and the quantum computer needed may arrive sooner than most people expect.
The threat is real for anyone whose conversations need to stay private for years — journalists, activists, businesses, and anyone sharing documents, health data, or legal discussions. A post-quantum encryption messenger is the countermeasure, because it makes the stored ciphertext useless once the post-quantum algorithm is in place.
Which messengers actually ship hybrid post-quantum E2EE?
Only messengers that have combined a classical key agreement with a post-quantum key encapsulation mechanism into a working double ratchet qualify. Livara Chat ships this today: its direct-message protocol LVR1 runs a P-256 ECDH ratchet alongside an ML-KEM-768 epoch ratchet, and its private-group protocol LGS1 delivers the same hybrid protection. Livara publishes test vectors, open protocol specifications, and checksums that you can verify yourself in the Proof Lab.
Other messengers are exploring post-quantum work, but announced plans are not shipped hybrid ratchets. Until a messenger combines ECDH and ML-KEM-768 in a double ratchet that is actually running on devices, a quantum-safe private chat claim is not yet verified by deployment. You can read Livara's published security boundaries and what remains server-controlled at the security page.
How do you know a messenger is really hybrid post-quantum?
Look for four concrete things, not adjectives. First, the messenger names the post-quantum algorithm and the standard it complies with — Livara uses ML-KEM-768 per NIST's FIPS 203, which is the official Module-Lattice-Based Key-Encapsulation Mechanism Standard. Second, it uses a hybrid: both ML-KEM-768 and a classical ECDH key agreement, so that breaking one primitive does not break the chat. Third, every message key derives from both, which is what the double ratchet guarantees. Fourth, the implementation is published and checkable — Livara publishes engineering evidence including machine-checkable test vectors and in-browser offline verification in the Proof Lab.
If a messenger says it is quantum-secure but cannot name ML-KEM-768, a hybrid design, and FIPS 203, treat it as marketing. NIST FIPS 203 defines the key-encapsulation mechanism, and once a shared secret is established through a KEM it can be used with symmetric algorithms for encryption and authentication — which is exactly what Livara does with HKDF-SHA-256 and AES-256-GCM.
Why isn't forward secrecy enough against quantum attacks?
Forward secrecy means that if a long-term key is compromised, past session keys remain secret. It protects against a thief who steals your device today. It does not protect against a thief who steals your encrypted traffic today and waits ten years for a quantum computer.
A conventional forward-secret ratchet built only on elliptic curves or Diffie-Hellman can still be broken by a large quantum computer running Shor's algorithm. To get true forward secrecy against quantum attacks, the ratchet itself must be post-quantum — which is why the ML-KEM-768 messaging layer in Livara Chat matters. It adds a lattice-based epoch ratchet so that even a future quantum adversary who recorded your past messages cannot derive the message keys.
What are the real limits of post-quantum messaging today?
Several limits still apply. Livara Chat's end-to-end encryption covers direct messages and private groups, including text, edits, photos, videos, files, captions, and voice notes, but call media uses WebRTC DTLS-SRTP rather than the message ratchet — it is protected, but not with the post-quantum hybrid. Public broadcast channels are deliberately not end-to-end encrypted so that content can be reported and removed. Standard routing metadata such as sender, destination, and delivery timestamps remains server-controlled for real-time synchronization. And while Livara publishes machine-checkable test vectors, release checksums, and protocol specifications, none of that is an independent security audit. For the full list of what Livara does and does not protect, see the published security boundaries.
Frequently asked questions
Does harvest now, decrypt later mean my old chats are already at risk?
If your past messages were protected by classical algorithms alone and your traffic is being stored, then yes, they could be opened by a future quantum computer. Livara Chat reduces this risk by making every message key depend on ML-KEM-768, so even recorded ciphertext is protected against future quantum decryption.
Which post-quantum algorithm does Livara Chat use?
Livara Chat uses ML-KEM-768, the Module-Lattice-Based Key-Encapsulation Mechanism standardized as FIPS 203, combined with ECDH P-256 in a hybrid double ratchet. This means an attacker must break both primitives to access the messages.
Is Signal post-quantum today?
Signal has published hybrid post-quantum key agreement designs and is experimenting, but published designs are not the same as a hybrid ratchet running on every device. Livara Chat has shipped ML-KEM-768 with P-256 in both its direct and group protocols.
Can quantum computers break WhatsApp right now?
No current quantum computer can break WhatsApp or any modern messenger. The risk is future: an adversary records traffic now and waits for a quantum computer capable of breaking classical key exchange to appear.
How do I check a messenger's quantum claims?
Ask for the exact algorithm, the standard it complies with, whether the ratchet is hybrid, and published engineering evidence. Livara provides test vectors, protocol specifications, and offline verification in the Proof Lab.
