PQC Today is an educational and demonstration platform, not a production system. Nothing it produces — keys, certificates, configurations, reports, or test results — is fit to protect real data, and none of it may be deployed or relied upon in production.

Key Encapsulation Mechanism (KEM)

Key Derivation:

1. Encapsulate

Step 1: Select Keys

Hybrid Mode

Public Key

Step 2: Run Operation

Generate or pick a public key above to enable this.

Step 3: Ciphertext Output

Ciphertext (Send to Receiver)

Step 4: Final Derived Secret

Derived Secret (HKDF Normalized)

2. Decapsulate

Step 1: Select Keys

Hybrid Mode

Private Key

Step 2: Run Operation

Step 3: Ciphertext Input

Ciphertext (Input)

Step 4: Final Derived Secret

Derived Secret (HKDF Normalized)

Data Encryption (AES-GCM)

Use the shared secret from above as the encryption/decryption key

Encrypt Message

Message to Encrypt

Shared Secret (Key)

Encrypted Data (Output)

Decrypt Message

Encrypted Data (Input)

Shared Secret (Key)

Decrypted Data (Output)

Classical Baseline: X25519 ECDH

Elliptic-curve Diffie-Hellman — broken by quantum computers (Shor's algorithm)

Two parties (Alice and Bob) each generate an ephemeral X25519 key pair, exchange public keys, and independently derive the same 32-byte shared secret. Compare this to ML-KEM above: same 32-byte output, but X25519 is broken by quantum computers.

Alice ⇄ Bob · Web Crypto · 256-bit

Digital Signatures

Sign Message

Message to Sign (Input)

Signature (Output)

Generate or pick a signing key above to enable this.

Verify Signature

Message to Verify (Input)

Signature (Input)

34 tools

OpenSSL Studio

HSM / PKCS#11

Entropy & Random

Certificates & Proofs

Digital Identity

Blockchain & Digital Assets

Protocol Simulations

Interactive Playground

What this means for you

Executive / Business Leader: This is an engineering workbench that runs real key generation, encryption and signing in your browser; the banner at the top points you to the Command Center and Compliance landscape for board-level context.
GRC / Risk & Compliance: Nothing here produces evidence for an audit — it is a hands-on workbench; the banner at the top links to the Compliance landscape and Migration framework, and the Logs tab shows only what you ran in this session.
Developer / Engineer: Generate a key pair on the Key Store tab, then Sign & Verify or KEM & Encrypt; the "Code Reference" panel under the key generator shows the same operation as OpenSSL CLI, Python (liboqs) and Go (liboqs-go), ready to copy.
Security Architect: On KEM & Encrypt, tick "Hybrid Mode" and choose the key derivation — HKDF-Extract or raw concatenation — to see how a PQC and a classical shared secret combine; the Key Store table has a Size column for every key.
Researcher / Academic: Every operation is logged with its timing: the strip under the heading shows the last result in milliseconds, and the Logs tab lists timestamp, key, operation and execution time, with "Copy Logs" for the whole run.
Certification & Validation Engineer: Every operation is logged with its timing in the Logs tab; these are educational WebAssembly builds, not a validated module, so a result here is a demonstration, not evidence.
IT Ops / DevOps: Key Store's "Backup All" exports every key as a ZIP and "Import ZIP" restores it, so a rehearsal survives a reload; Sign & Verify has a "Deterministic signing" option, and Key Store also generates classical keys for comparison.
Curious Explorer: Follow the Quick Start: generate a key pair on the Key Store tab, then create and check a signature on Sign & Verify; everything runs in your browser and the Logs tab shows each step.

Load WASM|Libraries loaded successfully|0.00 ms

Quick Start

Start with the Key Store tab to generate a key pair, then switch to Sign & Verify to create and verify a digital signature. The log panel at the bottom shows every operation in real time.

Key Store

Generate New Keys

Algorithm & Security Level

Action

Generate Classical Keys

(Web Crypto API)

Classical Algorithm