Google Meet Adds Post-Quantum Encryption

Google Meet is adding post-quantum cryptography to calls, giving everyday video meetings an extra layer of protection against a threat that does not exist at practical scale yet: a future quantum computer capable of breaking widely used public-key encryption.

Google began the gradual rollout on October 12, 2026, for laptop web clients and Google Meet room hardware. Mobile support is coming later. The change is automatic, applies to personal and paid Workspace accounts, and does not add a new button or setting. That simplicity is welcome, but it also makes the update easy to misunderstand.

Google Meet post-quantum encryption at a glance

Google is adding post-quantum cryptography, or PQC, to Meet calls to reduce future quantum-computing risk.
The rollout started October 12 for laptop web clients and Meet room hardware, with up to 15 days for visibility.
Mobile support is planned, but Google has not announced a specific Android or iPhone date.
The protection is available to all Workspace customers, Workspace Individual subscribers and personal Google accounts.
There is no administrator control or user setting, and Google says no action is required.

What Google changed inside Meet

Google says Meet calls now use post-quantum cryptography as an additional protection for the cryptographic exchanges that secure a session. The first wave covers browsers on laptops and Google Meet room hardware. The rollout is server-managed, so a host does not need to recreate meetings, change an organization policy or ask every participant to enable a feature.

The update is designed to be invisible during normal use. Meeting links, joining steps, call controls, captions, recordings and collaboration features should behave as before. Google has not announced a special PQC badge, and its rollout post explicitly says users can continue using Meet normally.

Google previously used quantum-safe encryption for client-side encrypted Meet calls. The October rollout expands that direction to ordinary Meet traffic rather than reserving quantum-resistant protection for organizations using the more specialized client-side encryption configuration.

Why “store now, decrypt later” matters

A cryptographically relevant quantum computer does not exist today. The concern is that an attacker could capture encrypted traffic now, preserve it for years and attempt to decrypt it after future hardware becomes powerful enough. Security teams call this a “store now, decrypt later” attack.

That risk is most important when information remains valuable for a long time. A routine team check-in may age quickly, while legal discussions, medical research, product plans, government work or merger conversations can stay sensitive for years. Protecting today’s traffic before a capable quantum computer arrives reduces the value of collecting that traffic in advance.

This is also why migration is beginning before the threat becomes immediate. Encryption changes take years to standardize, test and deploy across browsers, mobile apps, room systems, networks and identity services. Waiting until a large quantum computer is operational would leave too little time to replace vulnerable systems safely.

What post-quantum cryptography does—and does not do

Post-quantum cryptography uses mathematical problems that are believed to resist both conventional and quantum attacks. NIST has finalized standards including ML-KEM for establishing shared secrets and ML-DSA and SLH-DSA for digital signatures. Google has been deploying standardized PQC in hybrid configurations that combine new algorithms with established cryptography.

A hybrid approach is important because it avoids betting the connection on only one new construction. The classical component preserves familiar protection, while the post-quantum component adds resistance to future quantum attacks. Google’s Meet announcement does not publish every protocol detail, so readers should not assume a specific algorithm or parameter set beyond what Google has formally documented.

PQC does not make a meeting invulnerable. It cannot stop a participant from recording the screen, prevent phishing, repair a compromised Google account or remove an unwanted guest who was admitted. It also should not be confused with a promise that every Meet session is end-to-end encrypted.

How this differs from Meet’s existing encryption

Google Meet already encrypts meeting traffic in transit between a participant’s device and Google’s data centers. Recordings stored in Google Drive are encrypted at rest. Google’s help documentation says standard meetings and upgraded Meet calls are cloud-encrypted, using established transport protections including DTLS and SRTP.

Personal accounts can enable additional end-to-end encryption for certain direct calls, although doing so disables some cloud-assisted features. Business and education accounts use cloud encryption for normal calls and do not receive that personal-account toggle.

Client-side encryption is a separate enterprise feature. With CSE, an organization connects an external identity provider and key service, and Google’s servers cannot decrypt the meeting media. It is limited to eligible Workspace editions and changes how meetings are created, joined and managed. The new PQC rollout does not replace CSE or eliminate its administrative requirements.

Who gets the upgrade and when

Google lists the new protection for all Google Workspace customers, Workspace Individual subscribers and users with personal Google accounts. Rapid Release and Scheduled Release domains share the same rollout window because the change is infrastructure-level rather than a visible productivity feature.

The initial deployment began October 12 for laptop web clients and meeting room hardware, with Google allowing up to 15 days for the rollout. Mobile support is described only as “coming soon.” Until Google publishes a mobile date, Android and iPhone users should not assume the feature has reached every call.

There is no admin control and no end-user toggle. That means an organization cannot accelerate the deployment, while an individual cannot verify it by hunting through Meet settings. The safest interpretation is that eligible web and room clients receive the protection progressively as Google completes the rollout.

What users and administrators should do

Google says no action is required to receive the update. Even so, normal maintenance still matters because a secure service depends on the browser, operating system, room hardware and account remaining trustworthy.

Keep Chrome or another supported browser updated and restart it after major security updates.
Keep Meet room hardware and mobile apps on their supported release channels.
Use multifactor authentication or passkeys to reduce the risk of account takeover.
Review guest access, host controls and recording permissions for sensitive meetings.
Use client-side encryption when organizational policy requires control of encryption keys and the edition supports it.

Organizations with long-lived confidential data should treat Meet’s rollout as one part of a wider migration. NIST advises organizations to inventory quantum-vulnerable cryptography and begin moving toward finalized standards now. Email gateways, VPNs, code signing, identity systems, backups and custom applications will not become quantum-ready merely because a meeting service has been upgraded.

A practical upgrade for clearer Meet calls

Encryption works in the background, but call quality still depends on the camera and microphone. Readers improving a laptop meeting setup can compare the Logitech Brio 4K webcam on Amazon. It supports 4K video, HDR correction and multiple fields of view, although actual Meet quality also depends on bandwidth, lighting and account settings.

ReaderSpice may earn a commission from qualifying purchases made through affiliate links, at no additional cost to you.

Bottom line

Google Meet’s post-quantum rollout is a meaningful infrastructure update precisely because most users will not notice it. It reduces the future value of intercepted meeting traffic without changing how people schedule or join a call, and Google is extending the protection across personal accounts, paid Workspace editions and room systems.

It is not a signal that today’s encryption has suddenly failed, nor is it a substitute for access controls, account security or client-side encryption. The practical takeaway is simpler: keep clients current, continue applying ordinary meeting security, and let Google’s gradual rollout add quantum-resistant protection in the background.