01
Features
Post-quantum data encryption software with the features you need across the data stack: CLI, GUI, TUI, and MCP server. From personal use to business deployments. Professional services (database migration, cold storage PQC, migration-as-a-service, PQC readiness assessment) are scoped separately; see Pricing.
Core Capabilities
02
Argon2id
Memory-hard KDF. Brute-force impractical even with ASICs.
03
AES-256-GCM
Authenticated encryption. Detects any tampering instantly.
04
Air-Gapped
Fully offline for file operations. No cloud storage of your files, no file-operation telemetry. The only network path is an encrypted billing check-in, pinned to billing.quantumsequrity.com by application-layer controls; on Linux CLI, seccomp-bpf then kills ALL network syscalls before any crypto operation (seccomp cannot filter by host).
05
Secure Shred
Multi-pass overwrite. Forensic recovery impossible.
06
Zstd Compression
Compress before encrypt. Smaller files, same security.
NIST ACVP Test Vectors
18,703 NIST ACVP vectors passed, zero failures, out of 29,962 total vectors in ACVP-Server v1.1.0.42 (commit 15c0f3deeefbfa). 11,259 vectors skipped (parameter sets QNSQY does not implement, e.g. RSA, ECDSA, AES-CBC). 33 of 50 algorithm directories at 100% NIST coverage, including HMAC (all 22 directories), ML-DSA keyGen and sigVer, ML-KEM keyGen, SLH-DSA across all 12 parameter sets, SHA-2-256 / 512 / 512-256, SHAKE-128 (FIPS 202), and XECDH-SSC (X25519).
Reproducible: a standalone, self-contained reproducer harness with step-by-step instructions is published on the Validation page; full source access for customers and auditors is available on request under NDA. These are NIST ACVP test vectors replayed against the algorithm implementations compiled into the shipped qnsqy binary's own source tree, plus internal end-to-end format tests. This is reproducible test-vector evidence, not FIPS 140-3 / CMVP certification (on the roadmap), and not an external audit. See the full write-up.
Feature Comparison by Tier
| Feature | Free | Pro | Business |
|---|---|---|---|
| Key Encapsulation (Hybrid KEM) | |||
| ML-KEM-512 + X25519 | |||
| ML-KEM-768 + X25519 | |||
| ML-KEM-1024 + X25519 | |||
| HQC-128 + X25519 (Code-based) | |||
| HQC-192 + X25519 | |||
| HQC-256 + X25519 | |||
| Symmetric Encryption | |||
| AES-256-GCM | |||
| XChaCha20-Poly1305 | |||
| Digital Signatures | |||
| ML-DSA-44 (NIST Level 2) | |||
| ML-DSA-65 (NIST Level 3) | |||
| ML-DSA-87 (NIST Level 5) | |||
| SLH-DSA (Hash-based) | |||
| Ed25519 (Classical) | |||
| Hybrid ML-DSA + Ed25519 | |||
| FN-DSA-512 (Falcon, NTRU lattice) | |||
| FN-DSA-1024 (Falcon) | |||
| Hybrid FN-DSA + Ed25519 | |||
| LMS (Stateful hash-based, SP 800-208) | |||
| Hashing & Integrity | |||
| BLAKE3 | |||
| Merkle Tree Verification | |||
| HKDF-SHA3-256 | |||
| Password Hashing (Argon2id) | |||
| 128 MB / 3 iterations | |||
| 256 MB / 4 iterations | |||
| 512 MB / 6 iterations | |||
| Custom Parameters | |||
| Commands | |||
| encrypt / decrypt | |||
| shred (secure delete) | |||
| hash / hash-verify | |||
| encode / decode | |||
| sign / verify | |||
| batch (multiple files) | |||
| rekey (password change) | |||
| symmetric (password-only) | |||
| vault (password manager) | |||
| split / combine (Shamir) | |||
| threshold-encrypt / threshold-decrypt (M-of-N) | |||
| keyfile (generate/encrypt/decrypt) | |||
| deniable (create/open) | |||
| timelock encrypt / decrypt / calibrate | |||
| stego hide / extract / capacity | |||
| scan / migrate (PQ migration) | |||
| groups / policy / escrow | |||
| polyglot (embed in PDF/ZIP/PNG) | |||
| R74 Pro+ Advanced (Pro & Business) | |||
| Triple-polyglot (JPEG + ZIP + PDF in one) | |||
| Self-extracting polyglot (.sh / .bat carrier) | |||
| Tripwire URL (canary token in PNG) | |||
| Keyfile-from-any-file (BLAKE3 derived AES key) | |||
| ABE (Attribute-Based Encryption, PQC-safe) | |||
| Interfaces | |||
| Command-line (CLI) | |||
| Graphical UI (GUI, Linux .deb/.rpm and Windows installer) | |||
| Terminal UI (TUI) | |||
| MCP server (Model Context Protocol, JSON-RPC 2.0) | |||
| Limits & Features | |||
| Max File Size | 100 MB | 25 GB | Unlimited |
| Zstd Compression | |||
| Streaming Mode | |||
| Security & Audit | |||
| Memory Protection (mlock) | |||
| Sandbox (seccomp-bpf) | |||
| Audit Logging (hash-chain, exportable) | |||
| Enhanced Audit (SIEM export, hash-chain verify) | |||
| Shamir Secret Sharing | |||
| License | |||
| Personal Use | |||
| Commercial Use | |||
| Priority Support | |||
Who Uses QNSQY
Legal Professionals
Client confidentiality with decades-long retention requirements
Healthcare Organizations
Long-retention patient record protection. HIPAA encryption requirements are your auditor's call; QNSQY provides the algorithm choices and audit artifacts.
Financial Institutions
Long-retention protection for financial data and trade secrets (QNSQY is not SOC 2 or PCI DSS certified; your auditor owns the compliance call)
Journalists & Activists
Source protection and confidential communications
Research Institutions
Intellectual property and grant data security
Privacy-Conscious Individuals
Family documents, passwords, private memories
Pro Tier Features
A
Streaming Encryption
Process files of any size without loading them entirely into memory. Essential for encrypting large databases, backups, and video files on systems with limited RAM.
B
Memory Locking
Prevents sensitive data (passwords, keys) from being swapped to disk. Protects against cold boot attacks and forensic memory analysis.
C
Hash-Based Signatures (SLH-DSA)
Sign files with FIPS 205 hash-based signatures. SLH-DSA doesn't rely on lattice mathematics, providing an alternative post-quantum approach. Choose SLH-DSA-128s/192s/256s based on your security level needs.
D
Key Management
Generate, import, and export signing keypairs. Share public keys with colleagues. Manage multiple identities. Full control over your cryptographic keys.
E
Audit Logging
Track all cryptographic operations. Know when files were encrypted, decrypted, signed, or verified. Essential for compliance and security audits.
F
Commercial License
Use QNSQY in commercial settings. Deploy across your organization. Integrate into business workflows without licensing concerns.
Pro Tier Exclusive
01
Hybrid Signatures (ML-DSA + Ed25519)
Defense-in-depth signatures using AND construction. Both ML-DSA (post-quantum) and Ed25519 (classical) signatures are computed. Verification requires BOTH to be valid. If either algorithm is broken, the other still protects.
02
Password Change (Rekey)
Change the password on encrypted files without decrypting and re-encrypting the entire file. Required for key rotation policies across many files.
03
Higher Argon2 Presets
Access the 256 MB / 4-iteration Argon2id preset for stronger password hashing. Business tier adds the 512 MB / 6-iteration preset and fully custom parameters.
04
Algorithm Selection
Full control over cryptographic algorithms. Choose between AES-256-GCM and XChaCha20-Poly1305. Select ML-DSA or SLH-DSA signature algorithms. Configure hybrid modes for maximum security.
05
Password Vault
Encrypted password/secret manager. Master password → Argon2id → AES-256-GCM vault. Single encrypted blob prevents metadata leakage. CSPRNG password generator.
06
Batch Operations
Encrypt, decrypt, or shred multiple files in a single command. Essential for workflows involving large numbers of documents or automated pipelines.
07
Audit Logging
Track all cryptographic operations with hash-chain signed logs. Know when files were encrypted, decrypted, signed, or verified. Essential for compliance and security audits.
08
25 GB File Size Limit
Encrypt large files up to 25 GB with streaming mode. Handle databases, backups, and media libraries that exceed the Free tier's 100 MB limit.
R74 Advanced (Pro & Business)
Five new capabilities that ship on Pro and Business tiers. All five are PQC-safe by construction and run fully offline. Free tier customers can upgrade to Pro to unlock them.
R1
Triple-Polyglot
One artefact that opens correctly as JPEG, ZIP, and PDF at the same time, with the encrypted payload hidden inside. Survives upload to platforms that strip metadata, because every byte serves three legitimate formats. Available on Pro and Business.
R2
Self-Extracting Polyglot
A .sh or .bat carrier that re-execs qnsqy on itself when run, decrypting in place. Rename the same artefact to .png and it opens as an image. Two faces, one signed payload. Pro and Business.
R3
Tripwire URL (Canary Token)
Embed a tracking URL inside a PNG carrier. If an adversary opens or scans the carrier, you get notified. Useful for bait data, leak attribution, and supply-chain integrity probes. Pro and Business.
R4
Keyfile-From-Any-File
Derive a 256-bit AES key from any data you already own. An MP3, a photo, a scanned document, anything. BLAKE3 turns the carrier into a deterministic high-entropy key. The carrier looks innocuous; only you know it doubles as a key. Pro and Business.
R5
ABE: Attribute-Based Encryption
Encrypt under a policy expression like (role=doctor AND dept=cardio) OR clearance>=4. Every recipient whose attributes satisfy the policy can decrypt. Built on lattice primitives, no classical pairings, so it stays PQC-safe. Pro and Business.
Business Tier: Full Platform
Business includes everything in Pro plus advanced algorithm families, threshold cryptography, and organizational tools. Maximum algorithm diversity means if a vulnerability is found in one family, you have alternatives ready.
01
FN-DSA (Falcon) Signatures
NTRU-lattice signatures standardized as FIPS 206 (draft). FN-DSA-512 produces signatures around 666 bytes, making it the most compact post-quantum signature scheme. Standalone or hybrid with Ed25519.
02
HQC Key Encapsulation
Code-based KEM selected by NIST as a backup to ML-KEM. Uses error-correcting codes instead of lattices. Always hybridized with X25519 for defense in depth. Three security levels: HQC-128, HQC-192, HQC-256.
03
LMS Stateful Signatures
Hash-based signatures per NIST SP 800-208. Security relies only on the collision resistance of SHA-256, with no algebraic assumptions. Stateful: each signature consumes a one-time key leaf. Four parameter sets from 32 signatures to 1 billion.
04
Threshold Encryption (M-of-N)
Encrypt to N recipients, requiring M keys to decrypt. Each share protected by ML-KEM public keys. Ideal for organizational key escrow and multi-party access control.
05
Key Recovery (Shamir)
M-of-N threshold key recovery using Shamir's Secret Sharing. Split your secret among trusted parties. Any M of N shares can reconstruct it. Ideal for organizational continuity and disaster recovery.
06
Groups, Policy & Escrow
Define recipient groups, enforce encryption policies across your organization, and configure key escrow for compliance. Set minimum password requirements, mandatory signing, and other security baselines.
07
Deniable Encryption
Two passwords, two payloads, one container. Real password reveals real data; decoy password reveals plausible cover data. Container is indistinguishable from random bytes.
08
Time-Lock Encryption
Encrypt data so it requires a calibrated amount of sequential computation to decrypt. No secret key needed for time-release. Uses iterated hashing that cannot be parallelized.
09
Steganography
Hide encrypted data inside PNG images. The output looks like a normal photo. Useful when you need to conceal the existence of encrypted data, not just its contents.
10
PQ Migration Scanner
Scan directories for files encrypted with classical-only cryptography. Automatically migrate them to post-quantum hybrid encryption. Essential for organizations transitioning to quantum-safe infrastructure.
11
Keyfile Encryption
Encrypt/decrypt using only a 256-bit key file (no password). AES-256-GCM with the key file directly. Generate, encrypt, and decrypt with qnsqy keyfile.
12
Unlimited File Size
No restrictions on file size. Encrypt multi-terabyte databases, complete system backups, and large media libraries without artificial limits.
Ready to get started?
Download the free tier and start encrypting your data with quantum-safe algorithms today. For database, backup, or cold-storage migration at scale, see professional services.