Can't find what you're looking for? Ask for help.
Learn how to Quantum-Proof your data with SafeQuard by pQCee and protect your information in the age of quantum computing. Full implementation of SafeQuard into FormSG.
As quantum computing edges closer to practical reality, securing our digital infrastructure against future threats has never been more critical. In this blog post, I’ll walk you through my experience integrating SafeQuard, a quantum-safe encryption/decryption solution by pQCee, into FormSG, an open-source form builder used widely for secure data collection.
This isn’t just a technical deep dive—it's a reflection of why this integration matters. We’ll explore the entire encryption and decryption flow within FormSG, discuss how SafeQuard fits into the existing architecture, how easily it can be implemented into other structures and unpack the challenges and considerations that come with implementing quantum-safe cryptography.
Whether you're a developer looking to future-proof your systems, or just curious about the real-world applications of post-quantum security, this walkthrough offers practical insights into building resilient, quantum-ready web applications.
The urgency behind quantum-resistant encryption stems from a rapidly emerging cybersecurity risk: Harvest-Now-Decrypt-Later (HNDL). While today’s encryption standards (like RSA and ECC) are secure against classical computers, they’re fundamentally vulnerable to quantum attacks. Once advanced quantum machines arrive, algorithms like Shor’s algorithm will break these encryptions in polynomial time—putting sensitive data at risk.
HNDL is a long-term cyberattack strategy where adversaries steal and store encrypted data today (e.g., via man-in-the-middle attacks or malware) to decrypt it later using quantum computers. This threatens data secured with classical encryption, including:
Even HTTPS/TLS isn’t foolproof—attackers exploit weak endpoints to harvest data now and wait for quantum decryption.
The attack surface for HNDL lies in communications between users and servers. Examples of exploitation include:
At-risk sectors (healthcare, finance, government) must adopt post-quantum cryptography to mitigate this looming threat.
To mitigate this risk, I have integrated SafeQuard by pQCee into FormSG. SafeQuard enables client-side, post-quantum encryption—meaning form data is encrypted inside the user’s browser before it’s transmitted. It uses post-quantum cryptographic algorithms designed to resist attacks from both classical and quantum computers.
Key Functionalities:
This approach ensures that even if attackers manage to intercept network traffic, the stolen payload remains undecipherable—now and in the future. Ultimately, this isn’t just about protecting data today. It’s about ensuring long-term confidentiality, maintaining public trust, and future-proofing critical systems against a rapidly evolving threat landscape.
The SafeQuard implementation in FormSG follows three main steps:
Refer to the Figure 1 & 2 for a quick overview of how it works.
In the next section, I’ll break down each step in detail—how it was implemented, challenges faced, and key learnings from the process.
The first stage of the SafeQuard integration happens entirely on the client side, where encryption is now built directly into the form submission process.
Previous Method: All form data—including responses, metadata, and file buffers—was transmitted over HTTPS but remained unencrypted at the application layer. While TLS provided transport security, the lack of additional encryption meant that if HTTPS were ever compromised, the raw data could be exposed.
Current Solution: Now, every submission is encrypted at the source (client-side) before transmission, using quantum-resistant algorithms. This ensures end-to-end protection, safeguarding data even against future threats like quantum decryption. SafeQuard maintains security beyond just transport-layer HTTPS, providing an extra defense layer where it matters most—before the data even leaves the user’s device..
To maintain the existing security workflow, attachments still need to be scanned for viruses—even after being encrypted on the frontend. This step ensures that functionality remains intact while integrating SafeQuard.
Note: This virus scanning and decryption step—detailed above—is actually a sub-step within the larger backend handling phase.
Implementation Note: The example in Figure 7 uses a static secret key for demonstration purposes. In production environments, SafeQuard's API can use Confidential computing (Intel SGX TEE) or HSMs for secure ML-KEM key processing.
The final step in the SafeQuard integration ensures that encrypted data—from form responses to file attachments—is properly decrypted and formatted for downstream processing and storage.
Implementation Note: The example in Figure 8 uses a static secret key for demonstration purposes. In production environments, SafeQuard's API can use Confidential computing (Intel SGX TEE) or HSMs for secure ML-KEM key processing.
Looking back at the integration process, one of the things that stood out to me was how straightforward SafeQuard’s quantum-safe algorithms were to work with. Both the frontend and backend libraries are thoughtfully designed, with clean, well-documented functions that are ready to use out of the box. Most of the heavy lifting was already handled by the SafeQuard files—all I had to do was understand where to plug it into the FormSG codebase.
That said, the key challenge wasn’t so much in using SafeQuard itself, but in understanding how FormSG is structured. FormSG has a well-architected flow, but getting familiar with how data moves across different layers—from the client to the backend, through middleware, and finally into storage—was crucial. Once I had a clear grasp of that, integrating SafeQuard’s encryption and decryption steps felt natural and seamless.
I’ve also implemented SafeQuard in other contexts before—web apps, standalone web pages, and form-based platforms as you can see in FormSG—and the experience has been consistent. Its API design is developer-friendly, and it doesn’t require a deep cryptography background to implement effectively. That’s what makes it powerful: it brings cutting-edge quantum-safe protection to everyday web applications without the complexity you might expect.
Overall, implementing SafeQuard into FormSG was not only technically rewarding but also felt like a meaningful step forward in securing user data against future threats. It’s reassuring to know that such robust security can be added without compromising on usability or developer experience.
As we move closer to a world where quantum computing becomes mainstream, it's critical that we start future-proofing our applications today. Forms—often used to collect sensitive personal or organizational data—are a prime target and must be protected from evolving threats.
Implementing quantum-safe encryption like SafeQuard ensures that data remains secure not just now, but in the years to come. Whether it's forms, web apps, or any data-driven service, adopting these technologies early is a smart and necessary step toward resilient, next-gen security.
| FormSG Without SafeQuard | FormSG With SafeQuard | |
|---|---|---|
| Application Layer (Form Data) | No additional encryption (plaintext) | Post-quantum E2E encryption (data encrypted before sending) |
| Quantum Resistance | Vulnerable to Quantum Attacks | Quantum-Safe |
Author
Yu Hueng is an intern at pQCee. Enthusiastic about the rapid transformation of cybersecurity toward the post-quantum era, he is excited to play an active role in shaping the quantum-safe future while pursuing his Computer Science degree.
Using QKDLite to implement Digital QKD: Supporting Quantum-Safe Communications for Cloud Applications
This article explores how pQCee’s QKDLite offers a practical, software-based approach to quantum-safe key management without the complexity of physical QKD systems.
Shanelle Tan
Don't have an account? We will create one for you.
Enter the OTP send to
in seconds.
