What is HQC? NIST's backup to ML-KEM, explained
Short answer: HQC is a post-quantum encryption algorithm that NIST selected on 11 March 2025 as a backup for ML-KEM, the main standard for general encryption. It is built on different mathematics, error-correcting codes rather than structured lattices, so that a weakness found in ML-KEM would not take both down at once.
Some background first. In August 2024 NIST finalized three post-quantum standards. FIPS 203 covers ML-KEM, a key-encapsulation mechanism: a way for two parties to agree a shared secret key over a public network. FIPS 204 and FIPS 205 cover digital signatures. Our explainer on what ML-KEM, ML-DSA and SLH-DSA each do goes through them one by one.
HQC fills a narrow role. NIST says it is not intended to replace ML-KEM, which remains the recommended choice for general encryption. Dustin Moody, who heads NIST's Post-Quantum Cryptography project, said organizations should keep migrating to the standards finalized in 2024, and that NIST wanted "a backup standard that is based on a different math approach than ML-KEM."
The difference in mathematics is the whole point. ML-KEM is built around structured lattices. HQC is built around error-correcting codes, an idea NIST notes has been used in information security for decades. If a new attack, quantum or classical, turned out to weaken lattice schemes, a code-based scheme would not automatically fall with it.
There is a cost. Moody said HQC is a lengthier algorithm than ML-KEM and demands more computing resources, but its clean and secure operation convinced reviewers it would be a worthy backup. HQC was the only algorithm standardized from NIST's fourth round of candidates, which began with four algorithms meriting further study.
On timing, NIST said in March 2025 that it planned to issue a draft standard incorporating HQC in about a year, with a finalized standard expected in 2027. Check NIST's Computer Security Resource Center for the current status of that draft before relying on a date. For the wider migration deadlines, see our piece on NIST IR 8547 and the 2030 and 2035 dates.