PQC support

Cloudflare's deployment of post-quantum hybrid key agreements is supported by different software as listed below. Contributions to keep the listing up-to-date are welcome.

Warning

The list below is for reference only. Responsibility for third-party software lies with their respective maintainers. Use them at your own discretion.

X25519MLKEM768

• Default for Firefox 132+ ↗ (Desktop) and Firefox 145+ (Android)
  • For QUIC/HTTP3, use Firefox 135+ (Desktop)
• Default for Chrome 131+ ↗
• Default for Safari 26+ ↗
  • System-wide support in iOS 26, macOS Tahoe 26, and other Apple operating systems ↗
• Default for Edge 131+ ↗
• Default for recent Opera ↗ and Brave ↗
• Default for Tor Browser 15.0+ ↗
• Cloudflare's fork of Go ↗
• Default for Go 1.24+ ↗
• Default for OpenSSL 3.5.0+ ↗
• Default for Node 24.5.0+ ↗ and 22.20.0+ (backported ↗)
• BoringSSL ↗
• GnuTLS ↗
  • 3.8.9+ compiled with leancrypto 1.2.0+
  • 3.8.8-3.8.9 compiled with liboqs 0.11.0+
• rustls 0.23.22+ ↗
• Default for rpxy 0.9.4+ ↗
• Default for NGINX ↗ compiled with OpenSSL 3.5+ (instructions ↗)
• Open Quantum Safe ↗
  • C library: liboqs 0.10.0+
  • OpenSSL provider: oqs-provider 0.7.0+
• Zig 0.14.0+ ↗ (client)
• Default for Caddy HTTP server 2.10.0+ ↗
• Traefik ↗
  • Default for 3.4.2+, 2.11.26+ (commit ↗)
  • Configurable with curvePreferences in 3.5.0-rc.1+ ↗
• Botan C++ library 3.7.0+ ↗

X25519Kyber768Draft00

• Default for Chrome 124-130 ↗ on Desktop
  • For older Chrome or on mobile, toggle TLS 1.3 hybridized Kyber support (enable-tls13-kyber) in chrome://flags.
• Default for Edge 124-130 ↗
• Firefox 124-131 ↗ if you turn on security.tls.enable_kyber in about:config
  • For QUIC/HTTP3, use Firefox 128+ with network.http.http3.enable_kyber.
• Cloudflare's fork of Go ↗
• Default for Go 1.23 ↗
• BoringSSL ↗
• GnuTLS ↗
  • 3.8.8-3.8.9 compiled with liboqs 0.11.0+
  • 3.8.7 compiled with liboqs 0.10.1+
• Cloudflare's fork of QUIC-go ↗
• Goutam Tamvada's fork of Firefox ↗
• Open Quantum Safe ↗
  • C library: liboqs 0.5.0+
  • OpenSSL provider: oqs-provider 0.5.0-0.8.0
• Zig 0.11.0-0.13.0 ↗ (client)
• nginx ↗ when compiled with BoringSSL ↗ (guide ↗)
• Botan C++ library 3.2.0+ ↗ (instructions ↗)