Cloudflare Workers has added opt-in support for post-quantum-resistant cryptographic algorithms through Web Crypto. Announced on October 1, the update gives developers native building blocks for experimenting with newer key exchange and signature schemes.
The initial implementation includes ML-KEM for key encapsulation and ML-DSA for digital signatures, together with helper APIs for checking algorithm support and obtaining public keys. Developers must enable the webcrypto_modern_algorithms compatibility flag while the underlying API specification remains a draft.
Cloudflare says native support can reduce the need to bundle a separate cryptographic implementation into an application. The runtime uses BoringSSL primitives, and the company has limited this release to part of the wider modern algorithms proposal.
The distinction for developers is between having cryptographic primitives and completing a protocol migration. ML-KEM supplies shared key material; it is not a complete encryption system by itself. Applications and libraries still need compatible protocols, correct integration and testing. Cloudflare also notes that larger post-quantum keys and signatures remain a practical consideration even when the runtime handles the operations natively.
Related: Cloudflare opens beta for a privacy-focused OHTTP Gateway.
