---
title: "Support for modern cryptographic algorithms in Workers"
description: "Cloudflare Workers now provides opt-in support for post-quantum cryptographic algorithms ML-KEM and ML-DSA within the Web Crypto API, including ML-KEM-768, ML-KEM-1024, ML-DSA-44, ML-DSA-65, and ML-DSA-87. These algorithms enable key encapsulation via encapsulateBits and decapsulateBits, and signatures via sign and verify, along with helper APIs like getPublicKey and SubtleCrypto.supports for feature detection. The implementation is gated behind the webcrypto_modern_algorithms compatibility flag and is based on a draft WICG specification, meaning it is opt-in while the specification is still moving. Developers can now use native primitives instead of bundling separate cryptographic code, reducing application size and maintenance burden for developers. Libraries such as panva/jose for JWTs and panva/hpke for HPKE can delegate ML-KEM and ML-DSA to the runtime, enabling experimentation with post-quantum protocols and preparing for the migration."
---

# Support for modern cryptographic algorithms in Workers

[Cloudflare](https://yomu.fyi/company/cloudflare) · Thibault Meunier · Oct 1, 2026

**Type:** Announcement

## Summary

Cloudflare Workers now provides opt-in support for post-quantum cryptographic algorithms ML-KEM and ML-DSA within the Web Crypto API, including ML-KEM-768, ML-KEM-1024, ML-DSA-44, ML-DSA-65, and ML-DSA-87. These algorithms enable key encapsulation via encapsulateBits and decapsulateBits, and signatures via sign and verify, along with helper APIs like getPublicKey and SubtleCrypto.supports for feature detection. The implementation is gated behind the webcrypto\_modern\_algorithms compatibility flag and is based on a draft WICG specification, meaning it is opt-in while the specification is still moving. Developers can now use native primitives instead of bundling separate cryptographic code, reducing application size and maintenance burden for developers. Libraries such as panva/jose for JWTs and panva/hpke for HPKE can delegate ML-KEM and ML-DSA to the runtime, enabling experimentation with post-quantum protocols and preparing for the migration.

## Context

The post-quantum cryptography transition requires early experimentation, but Workers previously lacked native APIs for ML-KEM and ML-DSA, forcing developers to bundle separate implementations.

## Approach / What changed

Added native Web Crypto API support for ML-KEM-768, ML-KEM-1024, ML-DSA-44, ML-DSA-65, and ML-DSA-87 in Cloudflare Workers, including encapsulateBits, decapsulateBits, sign, verify, getPublicKey, and SubtleCrypto.supports methods. Requires the webcrypto\_modern\_algorithms compatibility flag and follows the WICG modern algorithms draft.

## Takeaways

- Cloudflare Workers now supports ML-KEM-768, ML-KEM-1024, ML-DSA-44, ML-DSA-65, and ML-DSA-87 in Web Crypto, gated behind the webcrypto\_modern\_algorithms compatibility flag.
- New native APIs include encapsulateBits, decapsulateBits, sign, verify, getPublicKey, and SubtleCrypto.supports for feature detection, eliminating the need to bundle separate cryptographic implementations.
- Libraries like panva/jose and panva/hpke can delegate post-quantum operations (JWTs with ML-DSA, HPKE with ML-KEM) to the Workers runtime, enabling experimentation for protocol migration.

## FAQ

### Which post-quantum algorithms are supported in Workers?

Workers supports ML-KEM-768 and ML-KEM-1024 for key encapsulation, and ML-DSA-44, ML-DSA-65, and ML-DSA-87 for digital signatures. ML-KEM-512 is not supported.

### How do I enable these new crypto APIs?

Add "webcrypto\_modern\_algorithms" to the compatibility\_flags array in your wrangler.jsonc configuration. The APIs are opt-in while the WICG draft specification is still moving.

### Can I use these APIs with HPKE or JWT libraries?

Yes, libraries like panva/hpke and panva/jose can delegate ML-KEM and ML-DSA to the runtime via Web Crypto, as shown in the post with code examples for HPKE.Seal/Open and SignJWT/jwtVerify.

**Tags:** [Cloudflare](https://yomu.fyi/topic/cloudflare), [Cryptography](https://yomu.fyi/topic/cryptography), [Post-Quantum Cryptography](https://yomu.fyi/topic/post-quantum), [Workers](https://yomu.fyi/topic/workers)

- Source: [Cloudflare](https://blog.cloudflare.com/workers-ml-kem-ml-dsa-support)
- Source URL: https://blog.cloudflare.com/workers-ml-kem-ml-dsa-support
- Ingested by Yomu: 2026-10-01T15:00:07.261Z

[Read original post](https://blog.cloudflare.com/workers-ml-kem-ml-dsa-support)