Google Meet now uses post-quantum encryption for calls on laptop web browsers and meeting room hardware. Google announced the change on October 12, 2026, and listed it again in its October 16 Workspace recap. Mobile apps come later. Nobody on your staff will see a difference.
This piece walks through what "post-quantum" means, why the "harvest now, decrypt later" risk is the reason it matters today, and what Google has and has not said about how it works. It also compares Zoom, Microsoft Teams and Apple, and ends with the other places in a typical nonprofit stack where the same question applies.
The short version: there is nothing to do in Meet. There is no admin setting and no user setting, and it covers every Workspace edition plus personal Google accounts. The useful move is to treat it as a prompt. Your Meet calls are now protected against a future threat. Your website traffic, VPN and email may or may not be, and those are worth a question to your vendors this quarter.
What Google changed in Meet
According to the Google Workspace Updates announcement, Meet calls now use post-quantum cryptography, starting with laptop web clients and meeting room hardware. Google says mobile support is coming, with no date given.
The rollout started October 12 for both Rapid Release and Scheduled Release domains. Google allows up to 15 days for it to reach everyone. By the time you read this, most organizations should have it.
Here is what the announcement says about who gets it and what anyone has to do.
| Question | Answer from Google | What it means for you |
|---|---|---|
| Which editions? | All Workspace customers, Workspace Individual, and personal Google accounts | Nonprofit and education editions are included |
| Which devices? | Laptop web clients and meeting room hardware first; mobile later | Phone and tablet calls are not covered yet |
| Admin control? | None | Nothing to turn on or approve |
| User impact? | No visible changes; applied automatically for hosts and participants | No staff training or notice needed |
Google’s own wording is plain: "There are no visible changes, and you can continue using Meet normally." That is the whole user-facing story.
What post-quantum encryption means, in plain terms
Today’s encryption rests on math problems that ordinary computers cannot solve in any useful amount of time. A large enough quantum computer could solve some of them quickly. The part most at risk is the key exchange, the moment two devices agree on a secret key at the start of a connection.
Post-quantum encryption swaps in math that experts believe a quantum computer cannot break either. It runs on the same laptops and servers you already have. No quantum hardware is involved.
The main standard is ML-KEM. The US National Institute of Standards and Technology published it as FIPS 203 on August 13, 2024. It defines a way for two parties to set up a shared secret key over a public network. It comes in three sizes: ML-KEM-512, ML-KEM-768 and ML-KEM-1024.
Most vendors use it in "hybrid" mode. The connection uses both the old method and the new one, so an attacker has to break both. If the new math ever turns out to have a flaw, the old method still holds.
Google’s announcement notes that no quantum computer capable of breaking today’s encryption exists yet. For background on where the hardware stands, see our explainer on Microsoft’s Majorana 2 quantum chip.
Why "harvest now, decrypt later" matters to a nonprofit
If the threat is years away, why change anything now? Because traffic can be recorded today and read later.
Google calls this "Store Now, Decrypt Later." Others say "harvest now, decrypt later." Someone copies encrypted traffic as it crosses the internet and stores it. Years from now, with a capable quantum computer, they decrypt it.
Most of what crosses your network will not matter in ten years. Some of it will. Think about what gets said on a board call or a staff meeting:
- Donor names, giving history and major gift plans
- Personnel matters and legal advice
- Member or client data shared on screen
- Strategy, mergers and funding negotiations
Google set out its own reasoning in March 2026, when it set 2029 as its target for moving to post-quantum cryptography. The post says the threat to encryption "is relevant today with store-now-decrypt-later attacks." Signatures, the part that proves who you are, are treated as a later risk.
That split is useful for planning. Encryption of data in transit is the near-term job. Login and identity systems come after. Our guide to passkeys covers the identity side as it stands today.
What Google has not said about Meet’s post-quantum encryption
The Meet announcement does not name an algorithm. It says "post-quantum cryptography" and "quantum-safe encryption" and stops there.
Google’s Meet encryption help page also does not mention it yet. That page says Meet traffic is encrypted between your device and Google’s data centers and follows the IETF standards for DTLS and SRTP. It does not say which part of that connection now uses post-quantum methods.
Here is what we can say from Google’s other pages, as of October 2026:
- Google’s web front ends use ML-KEM. Google Cloud’s post-quantum roadmap from August 11, 2026 says google.com and *.googleapis.com use ML-KEM (FIPS 203) in hybrid mode.
- Google’s internal network is covered. The same roadmap lists post-quantum protection for ALTS, Google’s internal traffic protocol, as completed in 2025.
- Client-side encrypted calls already had post-quantum encryption. The announcement says Meet “has used quantum-safe encryption previously for client-side encrypted calls (CSE).”
It is reasonable to guess Meet uses hybrid ML-KEM like the rest of Google’s stack. Google has not confirmed it for Meet. If your organization needs to state the algorithm in a security questionnaire or a grant compliance form, ask Google support for it in writing.
Client-side encryption is a separate, paid feature. Google’s CSE help page lists Enterprise Plus, Education Standard and Education Plus. With CSE, your organization holds the keys instead of Google. The new change brings post-quantum protection to everyone else.
How Zoom, Microsoft Teams and Apple compare
Google is not the first platform to move. Each vendor has taken a different path, so the comparison is worth a look if your staff use more than one tool.
| Platform | What is protected | Algorithm named | On by default? |
|---|---|---|---|
| Google Meet (Oct 2026) | Calls on laptop web and room hardware; mobile later | Not named for Meet | Yes, no setting |
| Zoom (May 2024) | End-to-end encrypted Zoom Meetings | Kyber 768 (ML-KEM) | Only when E2EE is turned on |
| Apple iMessage PQ3 (Feb 2024) | iMessage conversations | Kyber hybrid with P-256 | Yes, from iOS 17.4 and macOS 14.4 |
| Microsoft Teams | No Teams-specific announcement found | ML-KEM in Microsoft’s crypto library | Not stated |
Zoom announced post-quantum end-to-end encryption on May 21, 2024. It applies when a user turns on end-to-end encryption for a meeting. Zoom said post-quantum encryption for Zoom Phone and Zoom Rooms was coming at the time. Many organizations leave E2EE off because it disables some features, so check your own settings.
Apple’s iMessage PQ3 shipped in February 2024 with iOS 17.4, iPadOS 17.4, macOS 14.4 and watchOS 10.4. It pairs Kyber with classic elliptic curve math, the same hybrid idea.
Microsoft’s plans are broader and less specific. In June 2026, Microsoft’s Mark Russinovich wrote that the goal is to move Microsoft products and services to post-quantum cryptography by 2029. An August 2025 Microsoft post said ML-KEM was available in its SymCrypt library for Windows Insiders and Linux. We found no Teams-specific announcement on Microsoft’s own pages.
Where else to check for post-quantum encryption in your stack
Meet is one tool. The harvest-now risk applies to anything sensitive that crosses the internet. Here is where to look, in rough order of effort.
Web browsing in Chrome. Google’s security blog said in September 2024 that Chrome 131 would switch to ML-KEM for hybrid key exchange. Any Chrome browser kept up to date in 2026 is past that version. The job here is keeping browsers updated, which most managed fleets already do.
Your own website. Browser support only helps if your server or CDN supports it too. Ask your host or CDN whether post-quantum key exchange is on for your site. If you need a refresher on how HTTPS works, see our plain-English guide to HTTPS and TLS. Certificates are changing on a separate track as well; our post on shrinking SSL certificate lifespans covers that.
VPN. A VPN carries everything a remote worker sends. Ask your VPN vendor whether it supports post-quantum or hybrid key exchange, and on which versions. Our explainer on what a VPN does has the basics.
Email. Email between mail servers is usually encrypted in transit, but each provider sets its own methods. Ask your email provider and your email security gateway what they support today, and what their plan is.
AMS, CRM and payment tools. These hold donor and member data. They are usually reached through a browser, so the website question applies. Ask each vendor the same thing.
What to tell your board about post-quantum encryption
Keep it short. Google moved Meet to post-quantum encryption at no cost and with no action from us. The risk it addresses is data recorded now and read years later. We are asking our other vendors where they stand.
Avoid two mistakes. Do not buy a "quantum-safe" add-on product because of a sales call. For most small organizations, this protection arrives through software updates from vendors you already pay. Also, do not switch tools over it. Meet’s change is welcome, but it is one tool among many.
The practical step is a short vendor list with one question each. Who handles our website, VPN, email and member data, and do they support post-quantum key exchange today? Write down the answers and revisit them once a year. If you manage Workspace settings, our roundup of Gemini defaults in Google Workspace covers other recent changes that do need an admin decision.
Frequently Asked Questions
Does Google Meet use post-quantum encryption now?
Yes, for calls on laptop web browsers and meeting room hardware. Google started rolling it out on October 12, 2026, with up to 15 days to reach everyone. Mobile apps are coming later.
Do admins need to turn anything on?
No. Google says there is no admin control and no user setting. It applies automatically to hosts and participants.
Which Workspace editions get it?
All of them, according to Google, plus Workspace Individual and personal Google accounts. Nonprofit and education editions are included.
Will staff notice anything different?
No. Google says there are no visible changes. Calls look and work the same.
What algorithm does Meet use?
Google has not named one for Meet. Its web front ends use ML-KEM in hybrid mode, so that is a fair guess, but it is not confirmed. Ask Google support if you need it in writing.
What does “harvest now, decrypt later” mean?
Someone records encrypted traffic today and stores it. Years later, with a capable quantum computer, they try to decrypt it. Post-quantum encryption is meant to stop that.
Is a quantum computer able to break encryption today?
No. Google’s announcement says no such quantum computer exists yet. The concern is about traffic recorded now and read in the future.
Are Meet calls on phones protected?
Not yet. Google says mobile support is coming soon but has not given a date.
Does Zoom or Microsoft Teams offer the same thing?
Zoom added post-quantum protection to end-to-end encrypted meetings in May 2024, which users must turn on. We found no Teams-specific announcement from Microsoft as of October 2026.
What else should we check?
Ask your website host or CDN, VPN vendor, email provider and AMS or CRM vendors whether they support post-quantum key exchange. Keep Chrome and other browsers updated.
