Post-quantum encrypted cloud storage is cloud storage that encrypts your files with algorithms designed to withstand a future quantum computer, not only today's classical attackers. The file is still encrypted on your device before it is uploaded — that part is ordinary zero-knowledge encryption — but the step that establishes the encryption key uses a post-quantum algorithm such as ML-KEM-1024 (FIPS 203), instead of, or alongside, the classical elliptic-curve cryptography that a quantum computer could eventually break. This page explains what that actually requires, which providers do it on stored files today, and who genuinely needs it.
Why post-quantum matters for stored files
The threat is not that a quantum computer reads your files tomorrow. It is a strategy called "harvest now, decrypt later."
An adversary who can capture encrypted traffic or copy encrypted data does not need to break it today. They can store the ciphertext and wait — keeping it until a quantum computer capable of breaking classical key exchange exists, then decrypting it retroactively. Everything hinges on how long the file needs to stay confidential. A one-week-old logistics spreadsheet is uninteresting by the time such a machine arrives. A sealed legal record, a medical history, a journalist's source material, or a trade secret may still need to be private in fifteen years.
For that second category, the decision about post-quantum protection is made at the moment of upload. You cannot retrofit it onto data an adversary already holds. If the file was uploaded under classical-only encryption and someone copied the ciphertext, adding post-quantum encryption later does nothing for that copy. This is the specific reason post-quantum matters for storage in a way it does not for, say, a short-lived login session.
What "post-quantum" actually requires
The term is now used loosely in marketing, so it is worth separating substance from label. Three things distinguish real post-quantum storage from a badge.
A standardized post-quantum algorithm. In 2024, NIST published ML-KEM as FIPS 203 — the module-lattice key-encapsulation mechanism. ML-KEM-1024 targets NIST security level 5, the highest standardized level. "Post-quantum" should mean a named, standardized algorithm like this one, not an unspecified proprietary scheme.
Protection at rest, not only in transit. TLS between your browser and the server can use post-quantum key exchange and still leave the stored file protected only by classical encryption. For "harvest now, decrypt later," the property that counts is post-quantum encryption of the file at rest — the key that actually protects the stored ciphertext.
On by default, not opt-in. A post-quantum option that is off unless a user finds and enables it protects almost no real files, because almost no one enables it. Default matters more than availability. The honest question to ask a provider is not "do you support post-quantum?" but "is every new upload post-quantum, without me doing anything?"
A hybrid construction — pairing a post-quantum algorithm with a classical one — is the current best practice, because a weakness later found in either component alone does not expose the file. Hybrid is a strength, not a hedge to be embarrassed about.
Which providers offer it on stored files today
Most zero-knowledge storage is still entirely classical. That is not a criticism — these are good products — but it is the state of the field as of 22 September 2026.
| Provider | Zero-knowledge | Post-quantum on stored files |
|---|---|---|
| ShieldFive | Client-side encryption with authentication trust | Hybrid default on web and Android, AES fallback |
| Proton Drive | Yes | No (post-quantum ships in Proton Mail since May 2026, opt-in; not Drive storage) |
| Tresorit | Yes | Not yet — hybrid ML-KEM-1024 announced (February 2026 post), not yet live |
| Internxt | Yes | Partial — hybrid Kyber-512 (level 1) on account and sharing keys, not file keys |
| NordLocker | Yes | No — architecture described as "ready" (July 2026), not switched on |
| Sync.com | Yes | No |
| MEGA | Yes | No |
| pCloud | Opt-in (Crypto) | No |
| Icedrive | Opt-in (Encrypted folder) | No |
| Filen | Yes | No — states "no plans" |
This table reflects each vendor's public documentation as of 22 September 2026 and is updated as products change. If a provider not listed here ships post-quantum storage, the right move is to check its current spec directly rather than trust any comparison, including this one.
How ShieldFive implements post-quantum
Web uploads default to the ML-KEM-1024/XChaCha20-Poly1305 hybrid format, with an AES-256-GCM fallback. Android also writes the hybrid format by default, with the same AES-256-GCM fallback, and reads both formats. The format used by a particular client matters; we do not promise post-quantum hybrid encryption for every upload.
Files are encrypted on your device before upload. Your password never reaches our servers: the browser turns it into a separate login value with Argon2id and sends only that, and the key that opens your vault is derived separately and stays on your device. The app code is delivered by ShieldFive, so the client you are served is part of the trust boundary: client-side encryption does not establish that ShieldFive is technically unable to decrypt your files. See the security overview before deciding whether this model meets your requirements.
Two properties make the claim checkable rather than a promise:
- An open crypto core. ShieldFive's encryption library is published under Apache-2.0 — the same code that runs in your browser. You can read the specification and test vectors, and diff the published source against what ships. The point is not that open source is automatically more secure, but that you do not have to take the encryption on description.
- EU data residency. Encrypted data is stored in the EU, under EU and GDPR jurisdiction. This is independent of the post-quantum property but often shares the same buyer: someone whose files have a long confidentiality lifetime usually also has a jurisdiction requirement.
Who actually needs this
Post-quantum storage is not a universal upgrade, and pretending otherwise is the kind of overclaim this field does not need. It matters where the confidentiality lifetime is long:
- Legal and financial records kept for years or decades under retention rules.
- Medical and health data that stays sensitive for a patient's lifetime.
- Journalism and source protection, where exposure years later can still endanger a source.
- Trade secrets, research, and government-adjacent work with a multi-decade secrecy horizon.
If your files stop being sensitive in a month, the harvest-now-decrypt-later threat is weak for you, and post-quantum storage is a reasonable thing to skip. The useful approach is risk-tiering: move the files where a future decryption would actually cause harm, and do not agonize over the rest.
Limits and honest caveats
Post-quantum encryption closes one specific window. It does not fix everything, and it is worth being clear about that.
- It does not protect a compromised device. If your endpoint is malware-infected, the attacker reads plaintext before encryption ever happens. Post-quantum cryptography is irrelevant to that path.
- Hybrid still depends on sound classical crypto too. The classical half of the hybrid must remain secure against classical attacks; post-quantum is added protection, not a replacement for getting the classical part right.
- An open core is not the same as a completed audit. ShieldFive's crypto is open to review, but it has not yet completed an external third-party audit — that audit is planned, not done. If an independent audit is a hard requirement for you today, that is a real gap and worth weighing.
Evaluating it in practice
The way to judge post-quantum storage is to test it on files that do not matter yet — upload something low-stakes, share it with an expiry, then revoke it, and confirm each step behaves as expected before moving anything with a long confidentiality lifetime. If you are comparing providers, the best zero-knowledge cloud storage comparison ranks them on the post-quantum axis alongside jurisdiction, audits, and open source.
This page reflects each vendor's public documentation as of 22 September 2026 and will be updated as the products change.