DEV Community

Rushikesh Kakadiya
Rushikesh Kakadiya

Posted on

The Quantum Threat Is Real — Meet QSafe PQC, a Post-Quantum Cryptography API (And We Need Beta Testers!)

#security #cryptography #api #opensource

> TL;DR: I built a Post-Quantum Cryptography API platform called QSafe PQC. It gives developers access to NIST-standardized PQC algorithms via a simple REST API and multi-language SDKs. I'm looking for volunteer testers to stress-test it, break it, and give feedback. Read on to see how it's built and why it matters.

Why Post-Quantum Cryptography Matters Right Now

In 2024, NIST finalized the first post-quantum cryptography standards — ML-KEM (formerly Kyber), ML-DSA (formerly Dilithium), and SLH-DSA (SPHINCS+). These are the cryptographic algorithms designed to resist attacks from quantum computers.

Here's the uncomfortable truth: the systems securing your data today — RSA, ECC, even HTTPS — are broken the moment a sufficiently powerful quantum computer exists. "Harvest now, decrypt later" attacks are already happening. Nation-state actors are collecting encrypted traffic today, betting they'll be able to decrypt it in 5–10 years.

Most developers know this is coming. But integrating PQC into an existing app still feels like assembling a nuclear reactor from scratch. The libraries are low-level, the documentation is sparse, and the API surface is nothing like what we're used to.

That's the gap QSafe PQC is designed to close.

What Is QSafe PQC?

QSafe PQC is a developer-first API platform that wraps NIST-standardized post-quantum algorithms behind a clean, familiar REST interface. Think of it as "Stripe for PQC" — you shouldn't need a PhD in lattice cryptography to protect your users' data from quantum attacks.

Here's what you can do with it today:

Keypair Generation

Generate quantum-safe keypairs using NIST-approved algorithms. No local library setup, no FFI headaches — one API call and you have a keypair ready to use.

Encrypt & Decrypt

Encrypt messages with a recipient's public key. Decrypt with the private key. Works exactly like you'd expect, just quantum-safe.

Sign & Verify

Sign documents and messages. Verify signatures. Same mental model as RSA or ECDSA, but built on ML-DSA or SPHINCS+ under the hood.

File Operations

Upload files to sign or verify them in bulk — perfect for verifying the integrity of binaries, release artifacts, or any document pipeline.

API Keys & Quotas

Generate time-limited API keys (auto-expire after 1 year), monitor your daily quota usage, and manage 2FA from the dashboard.

The Tech Stack (And Why I Chose Each Piece)

I wanted to build this on a modern, developer-friendly stack that's also production-grade. Here's what's powering QSafe PQC:

Neon — Serverless PostgreSQL

Neon is the database backbone. I chose Neon because its serverless branching model is a perfect fit for a project at this stage — I can spin up database branches for feature development without paying for multiple full Postgres instances. Cold-start performance is excellent for API workloads, and the connection pooler handles traffic spikes gracefully.

User accounts, keypairs (encrypted at rest), API keys, usage logs — all stored in Neon. The schema-first approach with Postgres gives me the relational guarantees I need for cryptographic key metadata.

Upstash — Serverless Redis

Upstash handles all things ephemeral and fast: rate limiting, API key validation caching, and session state. The per-request pricing model is ideal since traffic is bursty and unpredictable at this stage.

Using Upstash for rate limiting means I can enforce per-API-key quotas at the edge without hitting Neon on every request. A sliding window rate limiter in Upstash keeps abuse in check while adding barely any latency.

Vercel — Frontend

Vercel hosts the React frontend. The dashboard (keypair management, crypto operations, file uploads) is a Vite + React SPA deployed on Vercel's global CDN. Preview deployments on every PR mean I can review UI changes in context before merging.

Hugging Face — Backend API

The backend API is deployed on Hugging Face Spaces. Hugging Face gives me a reliable, always-on hosting environment for the API server without the overhead of managing infrastructure. It also makes it easy to iterate quickly — pushing a new model or algorithm implementation is as simple as a git push.

GitHub CLI + Git — CI/CD, Actions & Releases

The entire release pipeline runs through GitHub Actions:

  • On every PR: lint, type-check, unit tests, and a Vercel preview deployment spin up automatically.
  • On merge to main: integration tests run against a Neon branch, and if green, the production deployment kicks off.
  • Releases: SDK packages are published to npm, PyPI, Maven Central, and pkg.go.dev via tagged releases. The GitHub CLI (gh) is used in CI to create GitHub Releases with generated changelogs and attach SDK artifacts.

This gives me a clean, reproducible release process where every SDK version is traceable back to a specific commit.

Multi-Language SDKs

PQC shouldn't be a JavaScript-only party. QSafe ships SDKs for four ecosystems:

JavaScript / TypeScript 

import { QSafeClient } from '@qsafe/sdk';

const client = new QSafeClient({ apiKey: 'your-api-key' });

// Generate a keypair
const { publicKey, privateKey } = await client.generateKeypair({ algorithm: 'ML-KEM-768' });

// Encrypt a message
const ciphertext = await client.encrypt({ publicKey, message: 'Hello, quantum-safe world!' });

// Decrypt it back
const plaintext = await client.decrypt({ privateKey, ciphertext });
Enter fullscreen mode Exit fullscreen mode

Python 

from qsafe import QSafeClient

client = QSafeClient(api_key="your-api-key")

# Generate a keypair
keypair = client.generate_keypair(algorithm="ML-KEM-768")

# Sign a document
signature = client.sign(private_key=keypair.private_key, message=b"Important document")

# Verify the signature
is_valid = client.verify(public_key=keypair.public_key, message=b"Important document", signature=signature)
Enter fullscreen mode Exit fullscreen mode

Go 

import "github.com/qsafe/qsafe-go"

client := qsafe.NewClient("your-api-key")

// Generate a keypair
keypair, err := client.GenerateKeypair(ctx, qsafe.AlgorithmMLKEM768)

// Encrypt
ciphertext, err := client.Encrypt(ctx, keypair.PublicKey, []byte("secret message"))

// Decrypt
plaintext, err := client.Decrypt(ctx, keypair.PrivateKey, ciphertext)
Enter fullscreen mode Exit fullscreen mode

Java / Kotlin 

val client = QSafeClient(apiKey = "your-api-key")

// Generate a keypair
val keypair = client.generateKeypair(algorithm = Algorithm.ML_DSA_65)

// Sign
val signature = client.sign(privateKey = keypair.privateKey, message = "release-v1.0.0.tar.gz".toByteArray())

// Verify
val isValid = client.verify(publicKey = keypair.publicKey, message = "release-v1.0.0.tar.gz".toByteArray(), signature = signature)
Enter fullscreen mode Exit fullscreen mode

Why I'm Looking for Beta Testers

QSafe PQC is functional and running in production, but I'm a solo developer — my blind spots are real. Here's specifically what I need help with:

API Correctness — Do the cryptographic operations actually produce the expected outputs? Are there edge cases with key serialization, large message sizes, or binary data handling?

Performance Under Load — How does the platform hold up with concurrent requests? Are there rate limiting edge cases? Quota tracking bugs?

SDK Developer Experience — Is the API surface intuitive? What's confusing? What would you name differently?

Dashboard UX — The React dashboard covers keypair management, crypto operations, and file uploads. Is anything broken, confusing, or missing?

Security Review — I've done my best, but fresh eyes on the API design, key storage, and authentication flow are always welcome.

Cross-Platform SDK Testing — Can you confirm the SDKs work on Windows, Linux, macOS, Deno, Bun, Python 3.9+, Go 1.21+, and JVM 17+?

How to Sign Up as a Tester

  1. Create a free account at qsafepqc1.vercel.app
  2. Take the built-in tour — it walks you through keypair generation, crypto ops, file ops, and API key creation in ~5 minutes
  3. Break things — try unusual inputs, large files, rapid API calls, concurrent requests
  4. Report bugs or feedback — drop me an email at rushikesh.n.kakadiya@gmail.com or leave a comment below

If you're a security researcher, cryptographer, or just someone who cares about quantum-safe infrastructure, I'd especially love to hear from you.

What's Coming Next

  • Webhook support — trigger events when signatures verify or keys expire
  • Team workspaces — shared keypair vaults for engineering teams
  • HSM-backed key storage — hardware security module integration for enterprise use
  • More algorithms — FALCON, HQC, and BIKE support as they progress through standardization
  • OpenAPI spec + Postman collection — to make testing even easier

The Bigger Picture

Post-quantum cryptography is infrastructure. It's not glamorous, it doesn't have a slick marketing angle — but it's going to be as foundational as TLS in the next decade. My goal with QSafe PQC is to make the migration path approachable for every developer, not just those with deep cryptography expertise.

If you've read this far, you're exactly the kind of developer I built this for. Come try it, break it, and help make it better.

Try QSafe PQC -> qsafepqc1.vercel.app

Built with Neon, Upstash, Vercel, Hugging Face, and GitHub Actions. Questions or feedback? Reach me at rushikesh.n.kakadiya@gmail.com

Top comments (0)