Post-quantum
No computer today can break the encryption in a password manager. The problem is that a vault copied today can be kept, and your passwords, recovery addresses and one-time code seeds will still be worth reading on the day one can. This is what that means, and exactly where Mabits does something about it.
An attacker who breaches a server, or records traffic, gets ciphertext they cannot read yet. For most data that is the end of it. For a password manager it is not, because the contents do not expire: people reuse passwords, recovery email addresses outlive the jobs they were made for, and one-time code seeds and passkeys never rotate on their own. So the question is not whether a quantum computer can break this now, but whether the ciphertext will still be worth reading when one can. For passwords, it will.
So the job is precise: replace the public-key cryptography, and leave AES-256 alone. Calling the vault’s cipher “post-quantum” would be marketing, not engineering.
Sharing an item, an organisation’s keys and an emergency contact’s access are all sealed to the recipient’s public key — the step Shor’s algorithm would break. In Mabits that step is X25519 and ML-KEM-768 together.
A shared key is only as good as knowing whose it is. Key bundles are signed with Ed25519 and ML-DSA-65, both required, so a forged key needs both signatures broken.
Your own vault is AES-256-GCM, because that is already enough. There is no “post-quantum cipher” for the vault itself, because one is not needed.
ML-KEM is built on lattices, which are younger than elliptic curves and have had less time to be attacked. So Mabits never uses it alone: X-Wing hashes an X25519 secret and an ML-KEM secret together, with the X25519 public keys bound in so neither can be swapped, and the result needs both broken — a quantum computer for one, a classical break of lattices for the other.
ML-KEM-768 is NIST security category 3, and it is the parameter set Chrome and Cloudflare already use to protect TLS. The larger 1024 set buys category 5 for keys about a third bigger, and would protect nothing more here: the vault behind it is AES-256, and category 3 already exceeds any realistic master password.
ML-KEM and ML-DSA are written in this project rather than pulled from a library, and every build runs them against NIST’s own test vectors — the only way a hand-written implementation earns trust.
A Send is not on this list because there is nothing in it for a quantum computer to break: its key is a random 256-bit secret carried in the link itself, not a public key. Its safety is who you give the link to.
Post-quantum sharing is one part of how a vault is protected. The rest — your keys, what the server can see, signing in — is on the security page.