NowSecure Finds No Detectable PQC Code in 97% of Mobile Apps

Insider Brief

• A NowSecure analysis of 136,711 iOS and Android apps found that 96.9% contained no detectable post-quantum cryptography (PQC)-related code or libraries.
• The analysis also identified weak encryption algorithms in more than 3,100 mobile apps, pointing to existing cryptographic weaknesses alongside future quantum-related risks.
• NowSecure recommends that organizations inventory cryptography in first- and third-party mobile apps, remediate vulnerable implementations and retest applications as part of a planned PQC migration.

PRESS RELEASE — NowSecure today released an analysis, conducted with NowSecure Platform, of 136,711 iOS and Android apps. It found that 97% contain no detectable post-quantum cryptography (PQC), the new generation of encryption standards designed to withstand attacks from quantum computers. Even among the most popular U.S. apps, fewer than 1 in 10 showed quantum-safe code. Security teams often leave mobile apps out of their cryptographic inventories, and organizations cannot migrate what they have not inventoried. 

The risk does not wait for quantum computers. Using runtime testing, NowSecure flagged weak encryption algorithms in more than 3,100 Android and iOS apps during the same study. These checks detect legacy algorithms such as DES and RC4. The findings highlight the need to address existing encryption weaknesses while identifying and migrating public-key cryptography vulnerable to future quantum attacks.