NowSecure finds no post-quantum cryptography code in 97% of mobile apps

[EpochWalker]

Mobile apps are far behind on post quantum security, according to a new study. The Quantum Insider reports that NowSecure analysed 136,711 iOS and Android apps over the 90 days to 5 October. It found that 96.9 percent contained no detectable post quantum cryptography code

Only 4,241 apps, or 3.1 percent, showed any sign of quantum safe code. Among the most popular apps in the US, fewer than one in ten did. Runtime testing also found weak old ciphers such as DES and RC4 still in use in more than 3,100 apps, which is worrying even without quantum computers

There is an important caveat. NowSecure inspected app code directly, so missing post quantum code does not mean an app is unprotected. Many apps rely on the operating system or on servers for their encryption, and Apple and Google have been adding post quantum support at the system level

The release cites Gartner's estimate that Q-Day could arrive by 2029, along with US federal deadlines for quantum safe systems. It recommends that organisations plan for a migration lasting at least two years. This is a company press release, so the numbers come from NowSecure's own analysis

Even with the caveats, the finding fits with the MITRE report and the Forbes posts we discussed. Post quantum migration is happening, but slowly and unevenly. Apps still using DES in 2026 are a reminder that old security problems never fully go away

Should app developers worry about post quantum cryptography yet? And should app stores require minimum security standards?

NowSecure Finds No Detectable PQC Code in 97% of Mobile Appsthequantuminsider.com

[Tundra94]

DES and RC4 still in 3,100 apps is shocking. Those ciphers were broken years ago

Quantum is the least of their problems. Old ciphers should have been removed years ago. It shows how slowly code gets cleaned up