Post-quantum key generator
Generate an ML-KEM encryption keypair and an ML-DSA signature keypair, entirely in your browser. Private keys are never transmitted. No account required.
Which keypair does what
You get two, because encryption and signing are different jobs and the standards keep them apart. Generating both now means you never have to come back for the other one.
ML-KEM — so people can write to you
Others use your public ML-KEM key to encrypt something addressed to you; only your private key opens it. This is the key behind encrypted messaging and the encrypted vault. Standardised as NIST FIPS-203; it replaces RSA and ECDH.
ML-DSA — so people can trust it came from you
You use your private ML-DSA key to sign; anyone can check the signature with your public key and see the content was not altered. This is the key behind document timestamping and notary receipts. Standardised as NIST FIPS-204; it replaces RSA signatures and ECDSA.
Which security level to pick
Each algorithm comes in three sizes. Higher is not automatically better: the only cost of a larger parameter set is bigger keys and signatures, and the only benefit is more margin against future cryptanalysis. Pick by how long the data has to stay confidential, not by instinct.
| Parameter set | NIST category | Comparable to | Public key | Private key | Output |
|---|---|---|---|---|---|
| ML-KEM-512 | 1 | AES-128 | 800 B | 1,632 B | 768 B ciphertext |
| ML-KEM-768 | 3 | AES-192 | 1,184 B | 2,400 B | 1,088 B ciphertext |
| ML-KEM-1024 ★ | 5 | AES-256 | 1,568 B | 3,168 B | 1,568 B ciphertext |
| ML-DSA-44 | 2 | — | 1,312 B | 2,560 B | 2,420 B signature |
| ML-DSA-65 | 3 | — | 1,952 B | 4,032 B | 3,309 B signature |
| ML-DSA-87 ★ | 5 | — | 2,592 B | 4,896 B | 4,627 B signature |
Take the defaults (1024 / 87) unless you have a specific reason not to. They sit at NIST security category 5, the highest the standards define, and they are the sets the rest of the PQCServer ecosystem uses — PQCMail, PQCChat, PQCDrive and PQCVault all expect them, so keys generated at a lower level will not interoperate with your account on those services. The cost of the larger sets is only key and signature size; the benefit is the most margin available against future cryptanalysis, which is the whole reason to migrate at all.
The 768 / 65 and 512 / 44 sets remain available for interoperability with outside systems that require them, or where bandwidth genuinely constrains you. They are not the right choice for a PQCServer account.
Storing your private keys
There is no recovery path. Nobody at PQCServer can reset, re-issue or restore a private key, because nobody at PQCServer ever had it — that is the same property that stops us reading your files. The trade-off is that losing the key file means losing access to everything encrypted to it, permanently.
Download the key file before you leave this page, and keep it somewhere that survives a lost laptop: a password manager, an encrypted volume, or an offline copy. Your public keys are meant to be shared and can be republished at any time; only the private half is irreplaceable.
Frequently asked questions
What is a post-quantum keypair?
A keypair whose security rests on a mathematical problem quantum computers are not known to solve efficiently. PQCServer generates two: ML-KEM (FIPS-203) for encryption and ML-DSA (FIPS-204) for signatures. They replace RSA and elliptic-curve keys, which Shor's algorithm would break on a sufficiently large quantum computer.
Do my private keys leave the browser?
No. Generation runs entirely client-side and the private keys are never transmitted. Only public keys are sent, and only if you explicitly save them to a profile. Generate without an account and nothing is sent at all.
What happens if I lose my private key?
It cannot be recovered, by you or by us. Anything encrypted to the matching public key becomes permanently unreadable, and you would need a new keypair and to republish the public half. Download the file before leaving this page.
Do I need an account?
No. An account only adds a public profile so people can look up your public key by username instead of you sending it each time.
Can I use these keys outside PQCServer?
Yes. They are standard ML-KEM and ML-DSA keys as specified in FIPS-203 and FIPS-204, base64-encoded, so any conforming implementation can read them. There is no proprietary wrapper. The implementation is open source if you want to check.
What do I do next?
Send something with encrypt, store a file in the vault, or sign a document to get a timestamped receipt. The manual covers the full flow.