NIST selected HQC on 11 March 2025 as a backup key-establishment algorithm in case ML-KEM is ever broken. It uses a different mathematical approach. HQC does not replace ML-KEM, and NIST says organizations should keep migrating to the standards finalized in 2024.
What was announced
NIST described HQC as the fifth post-quantum algorithm it has chosen. ML-KEM, the main general-purpose encryption standard, relies on structured lattices. HQC relies on error-correcting codes. NIST said it wants "a backup standard that is based on a different math approach than ML-KEM".
Why a backup matters
If one family of math problems turns out to be easier than expected, everything built only on it is exposed. Having a second, unrelated option reduces that single point of failure. This is the same reasoning behind SLH-DSA, which NIST described as a backup in case ML-DSA proves vulnerable.
Timeline
NIST said it planned a draft HQC standard in about a year after the announcement, followed by a 90-day public comment period, with a final standard expected in 2027. The NIST project page, last updated August 2026, still describes the HQC process as underway. Check the NIST page for the current draft status before you plan around a date.
What it means for developers
- Do not wait. ML-KEM is the recommended choice for general encryption, and NIST encourages integrating the finalized standards now.
- Design for agility. If your code hard-codes one algorithm, adding a second later is painful. Make the key exchange choice configurable.
- Expect hybrid and multi-algorithm setups to appear in libraries and protocols. Follow your library's release notes rather than building your own.
- Do not implement these algorithms yourself. Use maintained, reviewed libraries.
A common misunderstanding
"HQC was picked, so ML-KEM must be weak" is wrong. NIST's stated reason is diversification, not a known flaw in ML-KEM.
For how to take the first step, see Start a cryptographic inventory this week.
A short glossary
Key encapsulation is a way two parties agree on a shared secret key. ML-KEM and HQC are both key-encapsulation mechanisms, so they do the same job with different mathematics.
Lattice-based and code-based describe those mathematical families. NIST's stated reason for choosing HQC was to have a backup based on a different approach from the lattices underneath ML-KEM.
Backup standard means a standard kept ready in case the main one is weakened. It does not mean it is preferred for new deployments today. For general encryption, NIST says ML-KEM remains the recommended choice.
What not to do.
Do not delay your plans to wait for HQC. Do not remove ML-KEM support from a design because a backup exists. And do not treat a draft as final: the project page still describes the process as underway, so wait for the published standard before adopting it in production.
Quick check
Does HQC replace ML-KEM?
No. NIST says ML-KEM remains the recommended choice and HQC is a backup.
When is the final HQC standard expected?
NIST's March 2025 announcement said 2027. Check NIST's project page for current status.
Sources
- NIST news: HQC selected as a backup post-quantum encryption algorithm
- NIST: first 3 finalized post-quantum encryption standards
- NIST: Post-Quantum Cryptography project
Last reviewed: 19 October 2026.
