Tool · Comparison
Signatures, byte for byte.
Post-quantum security costs bytes. Here’s how much, for the schemes you’re most likely to meet. The bars use a logarithmic scale, so each step to the right is roughly ten times bigger.
Reading the chart
Classical signatures are tiny because elliptic curves pack a lot of security into few bytes, but a large quantum computer breaks them. Lattice schemes like ML-DSA (FIPS 204) are the general-purpose replacement: a few kilobytes, fast, and stateless. Hash-based schemes rest on the most conservative assumptions. Stateful LMS and XMSS stay compact but demand careful key-state management, while stateless SLH-DSA (FIPS 205) avoids that at the cost of much larger signatures.
Sizes are for the named parameter sets: LMS with SHA-256, tree height 10 and Winternitz parameter 8; XMSS-SHA2_10_256; ECDSA in raw (r, s) form with a compressed public key; Winternitz public key shown as a 32-byte hash of the chain ends. FN-DSA’s signature size varies slightly; the typical value is shown.