What is HQC?
HQC is a post-quantum algorithm for agreeing on secret keys that NIST selected in March 2025 as a backup to ML-KEM. It's built on different mathematics, error-correcting codes rather than lattices, so a future weakness in one is unlikely to affect the other. NIST said at the time that it expected a draft standard about a year later and a final standard in 2027. It also said plainly that HQC isn't meant to replace ML-KEM, which remains the recommended choice.
What the name means
HQC stands for Hamming Quasi-Cyclic. Hamming is a name long associated with error-correcting codes, the techniques that let data survive noisy transmission; quasi-cyclic describes the structure that keeps its keys manageable. Like ML-KEM, it's a key encapsulation mechanism: one side wraps a fresh secret using the other's public key, and only the matching private key can unwrap it.
Why a backup at all
ML-KEM has been studied intensively and no practical attack is known. But post-quantum cryptography is young, and two prominent candidates from NIST's process were broken during evaluation. Having a standardised alternative built on unrelated mathematics means organisations wouldn't be left without an option if lattice-based schemes ever weakened.
| ML-KEM | HQC | |
|---|---|---|
| Built on | Lattice problems | Error-correcting codes |
| Status | Final standard (FIPS 203, 2024) | Selected in 2025; final standard expected 2027 |
| Size and computing cost | Smaller and faster | Larger keys and ciphertexts; needs more computing resources |
| Role | Primary recommendation | Backup |
What it means for a bank today
Nothing needs to wait for HQC. ML-KEM is the algorithm to deploy now. HQC's main lesson is about design: systems should be able to swap one algorithm for another without being rebuilt, which is what crypto-agility means in practice.
Common confusions
- "HQC replaces ML-KEM." No. NIST was explicit that it's a backup.
- "ML-KEM must be broken, then." No. Choosing a backup is ordinary prudence, not a sign of a problem.
- "Code-based cryptography is new." The idea dates to the 1970s; HQC is a modern design within that family.
Sources and further reading
Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- StandardNIST selects HQC as fifth algorithm for post-quantum encryptionNIST, 2025
- StandardFIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)NIST, 2024
- Peer-reviewed paperBreaking Rainbow takes a weekend on a laptopWard Beullens, CRYPTO, 2022
- Peer-reviewed paperAn efficient key recovery attack on SIDH (the SIKE break)Wouter Castryck and Thomas Decru, EUROCRYPT, 2023