The short answer: ZapLock isn't fully post-quantum today, and we won't call it quantum-proof. Your files are encrypted with AES-256-GCM, which isn't the part quantum computers are expected to break. Your folder's key is split in two, so a stolen folder holds only one half. The exposed parts are the public-key pieces around that core: the P-256 wrap on the device's half, the connection to our sign-in server, and the signatures behind sign-in. That's a better starting point than a design where one broken public key gives up everything. It's not the finish line.
Why this matters before the machine exists
The threat has a name: harvest now, decrypt later. Someone copies encrypted data today and waits for a machine that can open it.
The estimates keep falling. In 2025, a Google researcher put RSA-2048 under a million noisy qubits. In March 2026, Google put 256-bit elliptic-curve keys under 500,000 physical qubits, the same key size as the P-256 curve we use. In October, Alice & Bob claimed a far lower count for its own hardware, while its largest reported error-correction chip has 12 qubits. These are estimates, not attacks. Nobody has shown one running at this scale.
The planning has moved anyway. Google and Cloudflare are both targeting 2029. NIST finalized its transition report in October, with quantum-vulnerable public-key algorithms deprecated after 2030 and disallowed after 2035.
So the useful question is simple: will your files still need to be secret in ten years? Client contracts, medical records and source code often will.
What quantum computers break, and what they don't
| Layer in ZapLock | Algorithm | Quantum outlook |
|---|---|---|
| File contents and names | AES-256-GCM | Expected to hold. NIST says AES-256 should "still be safe for a very long time" |
| Key derivation | HKDF-SHA256 | Not a target of Shor's algorithm |
| Combining the two key halves | XOR of random 32-byte shares | Math, not a hard problem. One half alone reveals nothing |
| Wrap on the device's half | P-256 ECDH | Vulnerable to Shor's algorithm |
| Connection to the sign-in server | Classical TLS key exchange | Vulnerable. Not hybrid yet |
| Sign-in and device signatures | Classical signatures | Forgeable once a large machine exists, but not a harvest risk |
A Secure Enclave or TPM doesn't change the P-256 row. It stops someone extracting a private key from your device, but Shor's algorithm works from public values.
Why the split key changes the math
A common design wraps the whole file key to a public key. Break the wrap and AES never gets attacked. The attacker just reads the key.
ZapLock doesn't store a whole key in the folder. It splits the key: masterKey = deviceShare XOR serverShare. The folder keeps the device's share, wrapped to that device's P-256 key. Our server keeps only the server share. Each device on each folder gets its own random split.
Now give an attacker a quantum computer and a stolen copy of the folder. They can break P-256 and recover the device share. What they've got is one half of a one-time pad. No amount of computing turns it into the key, because the other half isn't there to find. Cracking every device's wrap doesn't help either, since each one is split against a different random share.
That gives you a second property. When you remove someone's access, their server share gets deleted. Once it's gone from the database and its backups, a quantum computer can't recover it, because it's random and nothing derives it.
What happens in each scenario today
Each row assumes the attacker also has a quantum computer that can break P-256.
| The attacker has | Result today |
|---|---|
| A copy of your folder: a cloud drive, a lost USB stick | Can't open it. They hold one half |
| Our database, without your folder | Can't open it. There are no files to read |
| Your folder and our database | Can open it. Both halves are in hand |
| Your folder and a recording of an unlock | Can open it. The server share crossed a connection that isn't hybrid yet |
| A live attack once such a machine exists | At risk. Forged signatures could get past sign-in unless we've migrated first |
The first two rows are the point of the design: one breach isn't enough. The last three are why we won't say "quantum-proof".
Two more caveats. If you've turned on portable vaults, our server also keeps the wrapped device share so drive copies can open anywhere. That means a future P-256 break plus a database leak gives both halves, and the attacker still needs the folder. It's off unless you turn it on. Sync clients also keep file history, so old encrypted versions may outlive your deletes. They're still encrypted, but they're exactly what a harvester wants.
What we're doing next
In order, with no dates we can't keep:
Hybrid key exchange on the sign-in connection
X25519MLKEM768 pairs a classical exchange with ML-KEM (FIPS 203). It's already protecting about 70% of browser traffic to Cloudflare. This closes the recorded-unlock row.
A hybrid wrap on the device's share
P-256 plus ML-KEM, so breaking one isn't enough. This should only touch key files, not the contents of your files.
Post-quantum signatures for sign-in
As the platforms we run on support them.
Hybrid means two locks on the door. If either one holds, the key stays safe. NIST accommodates this approach, and it means we don't have to bet everything on a young algorithm.
What you can do now
- Sort by shelf life. Find what must stay secret for ten years or more, and start there.
- Keep your device list tidy. Remove people and devices when they leave.
- Check what's still in plain sight. A folder you've only hidden has no encryption for anyone to break. It's already readable.
- Ask every vendor the same question. CISA, NSA and NIST tell organizations to ask for a quantum-readiness roadmap. Ask us too.
What ZapLock won't do
Worth knowing up front, so nothing surprises you later.
- You need a free ZapQR account. That sign-in is what replaces the password.
- Opening a folder needs a connection to our service, which releases its half of the key. A new unlock waits until you're back online.
- If a folder's key lives on only one device and you lose that device, the folder can't be opened. Sign in on a second device before you lock anything you can't lose.
- No Linux, and the apps aren't open source.
- Sync services keep version history. If plain copies were ever synced, your provider may still hold them.
Post-quantum FAQ
Is ZapLock quantum-proof?
No. Its file encryption is expected to hold up and its split key limits the damage, but its public-key pieces aren't post-quantum yet.
Can a quantum computer break AES-256?
No known attack does. Grover's algorithm speeds up key search, but NIST expects AES-256 to stay safe for a very long time.
Can ZapLock open my folders?
We can't open your folders. We hold one half of each key, and the other half lives in your folder, wrapped to your device.
Will I need to re-encrypt my files later?
We don't expect it. Moving to a hybrid wrap should change key files, not file contents. Old copies of a folder, including sync history, keep the wrap they were saved with.
Do I need to do anything today?
No. Updates will come through the app. If you've got data with a long shelf life, sort it first.
Lock your first folder in a minute.
Free for one folder, for good. On Mac, Windows, iPhone, iPad and Android.