ML-DSA-65 · FIPS 204

Post-quantum signaturesfor Solana.

Real ML-DSA keys, generated, signed and verified right here in your browser. The first quantum-resistant proof-of-concept on Solana — small enough that you can read every line of it.

Run the proof Read the docs

The problem

Solana signs everything with Ed25519. It is fast, tiny and completely fine against classical computers. It is not fine against Shor's algorithm: a sufficiently large quantum computer derives the private key from the public key, and on a public ledger every spent address has already published its public key.

Nobody knows the date. That is exactly why the migration work should be boring, public and done early — "harvest now, decrypt later" applies to signatures too, because the keys are already out there.

The approach

Use ML-DSA-65, the NIST-standardised lattice signature scheme from FIPS 204 (formerly CRYSTALS-Dilithium). A user holds a post-quantum keypair alongside their normal Solana keypair, and binds the two by signing their Solana address with the post-quantum key.

solana address  ──┐
                  ├─► ML-DSA-65 sign  ──►  pq signature (3309 B)
pq secret key   ──┘                            │
                                               ▼
                              anyone verifies with the pq public key
                              (next step: anchor it on-chain)

Step one is making that verifiable by anyone, with no trust in this website. That is what the demo does.

Proof, running live

Generate a real post-quantum keypair, sign a message, verify it — then break it on purpose and watch verification reject it.

Loading crypto…

The anchor transaction

The full ML-DSA-65 public key (1952 B) and signature (3309 B) over the contract address are written into Solana mainnet as memo transactions — not a hash, the whole thing. Pull them off the chain and verify locally; nothing here has to be trusted.

Header txQWqyNnjX6YYyvLDYkogmuLUVvJ8pHVfNWLkoi9yrB7Uhko11Ry4FxFNGYba1Q9ByNJAsfaWoPstqPo7WCmoxJG4

Payload18 transactions

Signer3MJMH5KsXcCefvCE92Ja4UcSZSxeaKDoFysnomrTx7Jo

pk sha256251aea56e17883d29fc8e88da87226e30a39871a0e2b13778922ec1f79c3d17a

All payload transactions

Token

Ticker$QSOL

Contract

Launchpump.fun

On-chainSolscan

The token is a community coin around this experiment. It is not an investment, it does not secure the protocol, and the code above works with or without it.

FAQ

Is Solana broken today?: No. Ed25519 is safe against every computer that exists right now. The concern is a future, large, fault-tolerant quantum computer running Shor's algorithm, which would recover a private key from a public key. Any address whose public key has been exposed on-chain would be at risk.
So what does this actually do?: It brings a NIST-standardised post-quantum signature scheme (ML-DSA / Dilithium, FIPS 204) into the Solana world, starting with a fully verifiable browser implementation. Every key, signature and verification on this page is real — no mock, no server.
Why should I believe it works?: Don't believe it — check it. Copy the public key, message and signature from the demo, and verify them yourself with any FIPS 204 implementation. Tamper with a single byte and watch verification fail.
Why are the signatures so big?: Lattice signatures trade size for quantum resistance: ~3.3 KB versus 64 bytes for Ed25519. That size is the main engineering challenge for putting them on-chain, and it's what the next phase is about.
What is next?: Anchoring a post-quantum signature to a Solana transaction, so a wallet can prove control of an address with a quantum-safe key. The page will link the transaction when it's live.
Who made this?: One dev, nights and weekends, in the open. If something is wrong, open an issue — being corrected is cheaper than being confidently wrong.