Post-quantum cryptography on web app traffic changes long-term identity risk

At a glance

What this is: 1Password has deployed hybrid post-quantum key exchange on its web application to protect credential traffic from harvest-now, decrypt-later risk.

Why it matters: IAM and NHI teams need to treat transport confidentiality as part of identity design because intercepted credential traffic can remain valuable long after capture.

Context

Post-quantum cryptography changes the trust model for web traffic that carries credentials, session data, and other identity-sensitive information. The issue is not only whether current encryption resists today’s attackers, but whether captured traffic stays confidential against future decryption capabilities.

For identity programmes, this matters because web sessions are part of the control plane for human and non-human access. When long-lived sensitivity is built into the data being transported, the security conversation moves from current-session protection to future-proof confidentiality and migration readiness.

Key questions

Q: How should IAM teams prioritise post-quantum protection for web traffic that carries credentials?

A: Prioritise the web flows that expose the most durable identity data, especially login, session, and account-management traffic. The goal is not to upgrade everything at once, but to protect the paths whose compromise would still matter if intercepted traffic were decrypted later. That usually means external, internet-facing identity sessions first.

Q: Why does harvest-now, decrypt-later change identity risk planning?

A: Because it extends the useful life of captured traffic far beyond the original session. A connection can be secure against today’s attackers and still become a liability if its encrypted contents remain valuable later. That forces teams to think in terms of confidentiality lifetime, not only current exploitability.

Q: What breaks when PQC support is only available in some browsers?

A: Coverage becomes uneven, and the organisation can no longer assume that every credential-bearing session is protected the same way. The control exists only where the client and server negotiate it successfully, so unsupported browsers create a residual exposure boundary that needs to be measured and governed.

Q: What is the difference between transport encryption and long-term identity confidentiality?

A: Transport encryption protects data while it moves, but long-term identity confidentiality asks whether that data will still be safe if recorded and decrypted later. For credentials and account data, the second question matters more because the value of the information can outlive the session in which it was sent.

How it works in practice

Hybrid post-quantum TLS for credential traffic

Hybrid post-quantum TLS combines a classical key exchange with a quantum-resistant algorithm during the handshake. In this case, the browser and web application negotiate X25519MLKEM768, which lets the connection preserve compatibility while adding protection against future cryptanalytic advances. The important technical point is that the data path is still standard TLS from the user’s perspective, but the key establishment layer now carries dual assurance. That means the risk being addressed is not payload secrecy alone, but the durability of the session key agreement itself over time.

Practical implication: treat key exchange choice as a governance decision for any web flow that carries long-lived identity data.

Harvest-now, decrypt-later risk in identity systems

Harvest-now, decrypt-later means an attacker records encrypted traffic now and waits until a future capability can break the underlying cryptography. For identity systems, that creates a long-tail exposure problem because credentials, tokens, and account data can retain value well after the session ends. The threat does not require immediate compromise of the live connection; it only requires that archived traffic remain readable later. That makes transport-layer confidentiality part of an identity lifecycle issue, not just a network encryption issue.

Practical implication: classify credential-bearing traffic by future sensitivity, not only by present-day attack resistance.

Browser support and negotiated security boundaries

PQC support is negotiated, not universal. If the browser does not support the hybrid exchange, the connection falls back to non-PQC behavior, so the security boundary depends on client capability and version. That means the protected state is conditional rather than guaranteed across every endpoint. In practice, the architecture requires visibility into which user populations and devices are actually negotiating the stronger exchange, because the control is only effective where the client and server both support it.

Practical implication: verify which browsers and managed endpoints are actually taking the PQC path before treating coverage as complete.

NHI Mgmt Group analysis

Long-term confidentiality is now an identity design requirement, not a transport afterthought. Web traffic that carries credentials and session data has always been sensitive, but post-quantum risk changes the time horizon. Encryption that looks sufficient today may not be sufficient against future decryption capability, so identity teams have to assess confidentiality across the full retention life of captured traffic. The practitioner conclusion is that transport design now sits inside identity governance.

Harvest-now, decrypt-later breaks the assumption that encryption only needs to outlast the session. That assumption was designed for adversaries operating in the present, not for archives that may become readable later. When the threat model includes delayed cryptanalysis, the relevant question becomes whether identity data remains sensitive after capture, not whether it is safe in transit right now. Practitioners must rethink how long credential-bearing traffic must remain confidential.

Hybrid PQC is a transitional control, not a finished state. Combining classical and quantum-resistant algorithms preserves compatibility while reducing near-term migration friction, but it also signals that cryptographic agility is now part of the identity platform lifecycle. The field should treat early PQC deployment as a governance pattern for staged adoption across internet-facing identity flows. The practitioner conclusion is to plan migration as an ongoing control programme, not a one-time upgrade.

Browser-negotiated security creates uneven protection unless client inventory is known. The protection only applies where the client can negotiate the hybrid exchange, so partial adoption is a real governance boundary. That means the control is not just server-side configuration; it is also endpoint and browser estate management. The practitioner conclusion is to measure actual negotiation coverage before assuming all credential traffic is equally protected.

Ephemeral session confidentiality and long-lived data sensitivity now meet in the same control decision. The traffic may be transient, but the value of what it carries is durable. That gap is where identity programmes can lose confidence in transport security if they continue to treat web encryption as a solved background service. The practitioner conclusion is to align identity assurance with cryptographic lifespan, not just session duration.

From our research library:

• Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
• 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
• Read next: Secrets Management Guide

What this signals

Post-quantum confidentiality is becoming part of identity architecture: if credential traffic can be harvested now and decrypted later, the transport layer is no longer a background concern. Identity programmes should separate transient session protection from information that must remain confidential for years, then set migration priorities accordingly.

The practical signal for IAM and NHI teams is cryptographic agility. Systems that carry credentials, recovery flows, or account state need a roadmap that assumes algorithm change will happen during the lifecycle of the service, not after a convenient rewrite window.

For practitioners

• Map credential-bearing web flows to long-term confidentiality risk Identify which login, session, and account-management paths carry data that would still matter if decrypted years later, then prioritise them for PQC-ready transport design.
• Inventory browser and endpoint PQC support Check which managed browsers and user populations can negotiate hybrid post-quantum key exchange, and separate supported from unsupported clients in policy reporting.
• Plan staged PQC rollout for internet-facing identity traffic Start with external web applications that carry credentials or account data, then expand coverage as client compatibility and infrastructure support mature.
• Treat archived traffic as a future exposure class Reclassify captured or retained encrypted sessions as potential future risk when the content includes credentials, tokens, or account recovery data.
• Build cryptographic agility into identity roadmaps Track where TLS, certificates, and key exchange depend on fixed assumptions so PQC migration can proceed without ad hoc exceptions.

Key takeaways

• Harvest-now, decrypt-later risk pushes identity teams to judge web traffic by future sensitivity as well as current encryption strength.
• Hybrid post-quantum key exchange changes the transport layer for credential-bearing sessions without changing the user experience, which makes adoption easier but not automatic across all clients.
• The control decision now is whether your identity architecture can keep sensitive traffic confidential long enough to survive future cryptanalytic advances.

Key terms

• Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
• Hybrid Key Exchange: A transitional cryptographic setup that supports both classical and post-quantum key exchange during session negotiation. It reduces compatibility risk while improving resilience, but it is not a final endpoint because the surrounding certificate and identity estate may still rely on quantum-vulnerable components.
• Harvest now, decrypt later: An attacker strategy where encrypted traffic or stored data is collected today and decrypted later when better computing power becomes available. It matters to NHI governance because machine identities often protect the data paths and secrets most worth preserving over time.
• Cryptographic agility: The ability to change cryptographic algorithms, key lengths, or trust models without reworking every application. For machine identities, it reduces the risk that long-lived services will fail when standards shift or when post-quantum migration becomes necessary.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.