Solutions by need / Solutions testing / Post-quantum cryptography
Mobile app post-quantum cryptography
Close the mobile gap in your post-quantum cryptography plan.
Quantum computers are expected to break the public-key encryption your apps rely on. Most PQC inventories skip mobile apps, and you can't migrate what you haven't inventoried.
NowSecure research · 136,711 apps
1 in 32
apps showed any PQC-related code
97% showed no detectable PQC code.
4,241 of 136,711 apps · 90 days ending Oct. 5, 2026 · About the results
- On this page
- Research
- The risk
- Mobile gap
- Timeline
- The plan
- How NowSecure helps
The research
How many mobile apps use post-quantum cryptography?
Very few. Of 136,711 iOS and Android apps NowSecure assessed in the 90 days ending Oct. 5, 2026, 97% showed no detectable PQC code.
of apps show no detectable PQC code
popular U.S. apps showed quantum-safe code
apps flagged for weak algorithms like DES and RC4, vulnerable today
About the results: how we counted, and what detection can and can't confirm.
The risk
Why do quantum computers put mobile apps at risk?
Quantum computers are expected to break RSA and elliptic curve cryptography, the public-key encryption behind mobile logins, payments and connections.
Harvest now, decrypt later
Traffic captured today can be decrypted later. Mobile data crosses public networks outside your control.
Protections fail on Q-Day
Key exchange, authentication and code signing break at once for any app still on classical cryptography.
Public-key cryptography protects
Each connection runs on public-key cryptography such as RSA or elliptic curve today. Select any item to see it on the phone.
The mobile gap
Why do PQC inventories miss mobile apps?
Much of an app's cryptography comes from third-party SDKs your developers didn't write and can't see in source code. Only the finished app shows what ships.
Code you didn't write
SDKs and libraries ship their own cryptography.
Source scans miss it
Dependency lists don't show what the build contains.
Apps you buy
Vendor apps need vendor fixes, on vendor timelines.
Runtime decides
OS versions and server negotiation change what runs.
“
Mobile apps are the most exposed and least inventoried part of an organization's encryption.
Alan Snyder, CEO, NowSecure
The timeline
How long does a mobile PQC migration take?
Plan on at least two years, and aim to finish by December 2028. Google has set 2029 as its own PQC migration target. Teams that move faster gain more margin.
- Start nowBegin your mobile cryptographic inventory.
- Your migration: at least two yearsThree phases, sized by business impact and risk: inventory and prioritize, remediate, retest.
- Dec. 2028Target completion.
- 2029Google's own PQC migration target.
- Dec. 31, 2030Federal deadline for quantum-safe key establishment (EO 14412).
Target date is NowSecure guidance. Phase length varies with your app portfolio. Positions are approximate.
Quantum risk within a decade
chance that a cryptographically relevant quantum computer arrives within 10 years, according to a survey of 26 experts.
Even federal agencies are early
major federal agencies fully addressed key PQC preparation practices.
GAO-27-108740, Oct. 6, 2026
Live webinar
The Mobile Gap in Your PQC Plan
A live round table on where PQC stands, five common myths and where mobile fits.
What you'll learn
- What U.S., EU and UK guidance expects you to do first
- Why mobile apps are harder to inventory, and where to start
- Five PQC myths, including why a PQC library doesn't mean an app is protected
The plan
How do you start a mobile PQC migration?
Three phases, sized to the business impact and risk of each app. Start with the apps that matter most.
Phase 1
Inventory and prioritize
Find all cryptography in first- and third-party apps. Rank apps by business impact and risk.
Phase 2
Remediate
Fix the highest-risk apps first. For vendor apps, agree on a plan or switch to one that supports PQC.
Phase 3
Retest
Confirm every fix held before the next release ships.
Do this quarter
- Name an inventory owner.
- List every in-scope app, including vendor apps.
- Ask top vendors, in writing, when they will support PQC.
- Set December 2028 as your completion target, and review progress each quarter.
How NowSecure helps
How NowSecure finds post-quantum cryptography in mobile apps
NowSecure Platform analyzes finished iOS and Android apps to find PQC-related code, weak cryptography and third-party components. Available to Platform customers today.
The finished app
What your users download
NowSecure Platform
Binary analysis + real-device testing
Mobile cryptographic inventory
- PQC-related code and libraries
- Weak or outdated cryptography
- Third-party components to review
Inventory and prioritize
Find PQC and weak cryptography. Rank apps by business impact and risk.
Route fixes to developers
Send findings into the workflows your teams already use.
Retest on real devices
Real-device and expert pen testing verify runtime behavior.
Assess the third-party apps you depend on
Vendor apps need vendor fixes, on vendor timelines. NowSecure vendor risk assessments support every phase for the apps your vendors supply.
- Inventory and prioritize vendor apps
- Build a remediation plan with the vendor
- Retest each new release
About the results. NowSecure assessed 136,711 unique iOS and Android apps (by bundle ID or package name, once per platform) in the 90 days ending Oct. 5, 2026. 96.9% (rounded to 97%) showed no detectable PQC-related code; 4,241 (3.1%) did. Static binary inspection identified PQC-related code, libraries and weak encryption. Detection confirms presence, not runtime use; absence does not rule out OS, network or server protection.
Popular apps. NowSecure’s analysis of the top 100 U.S. apps by (App Store ratings / Play Store installs) among apps in NowSecure’s mobile risk intelligence dataset.
Sources. NIST PQC standards · Executive Order 14412 · GAO-27-108740 · Google PQC migration timeline · Global Risk Institute
Updated
Customer perspective
"Whether a quantum computer exists today or not, the critical issue is how long the data we encrypt today needs to stay private. … We sought out NowSecure to independently assess the post-quantum readiness of our mobile solutions."
Colin Gounden, CEO, VIA
years of mobile security expertise
penetration tests
automated assessments
vulnerabilities identified
Trusted by leading telecom, banking, healthcare and government organizations, including the DOJ, DOD and DOS.
Start your mobile cryptographic inventory
See the PQC and weak cryptography in the apps you build and buy.
Resources
Post-quantum cryptography resources
