Scan your code
Vantax products

Falcon-512, working today.

The compact lattice signature Solana's post-quantum work has settled on. Make a key, sign and verify right here, or with vantax falcon on your own machine. The files are the same either way.

Make a key in this tab Use the command line

Key, signature, check.

Everything below runs in your browser from a 90 KB WebAssembly module. Nothing is sent anywhere, and the page keeps nothing once you close it.

Falcon-512 workbench Loading Falcon-512…

  1. Make a key

    A fresh key pair from 48 bytes of your browser's randomness.

  2. Sign

    
            
          
    3. 

          
  3. 
            
    Check
    
            
    Filled in from the first two steps. Paste or open files from the CLI to check those instead.
    
            
    
              
              
            
    
            
    
              
              
            
    
            
    
              
              
            
    
            
    
              
            
    
            
    Waiting for a signature
    
          
    4. 
        

      

    

  


  

    

      

        
Small enough to live on-chain.

        
A Solana transaction is at most 1,232 bytes. An ML-DSA-87 signature is almost four times that; a Falcon-512 signature fits with room to spare. That is why Solana's post-quantum work builds on Falcon.

      

      

        

          
Signature sizebytes, one signature

          

          
          

            Ed25519
            64
          

          

            Falcon-512
            666
          

          

            ML-DSA-87
            4,627
          

          

          
A whole Solana transaction can be at most 1,232 bytes: Falcon-512's signature fits inside that, ML-DSA-87's doesn't.

        


        

          

            Signature schemes compared
            
              
SchemePublic keySignatureSecurity

            
            
              
Ed255193264Broken by a large quantum computer

              
Falcon-512897666NIST category 1

              
ML-DSA-872,5924,627NIST category 5, FIPS 204

            
          

        

        
Sizes in bytes. Category 1 is the level of AES-128; category 5 is AES-256. Vantax signs its own records with ML-DSA-87 and uses Falcon-512 where every byte is paid for.

      

    

  


  

    

      

        
Where Solana is with it.

      

      

        
Solana accounts still sign with Ed25519, and nothing here changes that. What changed in 2026 is that Falcon-512 became the post-quantum signature the ecosystem builds on.

        
Jump Crypto's proposal for verifying Falcon inside programs is SIMD-0416. Blueshift's Vector program already checks Falcon-512 signatures on-chain, for about 184,000 compute units each, and a Squads builder says he has used it on mainnet to let a Falcon key vote in a multisig.

        
The keys and signatures this page and vantax falcon make are standard Falcon-512 in the padded encoding those verifiers take: 897-byte public keys, 666-byte signatures, signed over the raw message. vantax falcon export prints the exact bytes.

        
Vantax isn't affiliated with Solana, Jump, Blueshift or Squads. Check any on-chain verifier's own documentation before you rely on it.

      

    

  


  

    

      

        
On your own machine.

        
The vantax command does the same with your operating system's randomness, and writes key files owner-only.

        
Install the CLI

      

      


# a key pair, plus a .pub.json to share
vantax falcon keygen -o hot.json

# sign a message, a file or hex bytes
vantax falcon sign -k hot.json -m "Built to be verified." -o hot.sig.json

# check it (exit code 1 if it doesn't verify)
vantax falcon verify -k hot.pub.json -s hot.sig.json -m "Built to be verified."

# the raw bytes, in base64 and hex, for on-chain verifiers
vantax falcon export -k hot.pub.json -s hot.sig.json

        
Files from the CLI open in the workbench above, and keys made in the browser sign with the CLI.

      

    

  


  

    

      
How you can tell it's right.

      

        
          NIST test vectors, reproduced
          The browser build reruns NIST's known-answer test. Its SHA-256 matches the reference.
          91842d41138e7cfaf6e2e8f12a03c3b3411302255121e4d07d02f91a003c0395
        
        
          PQClean's implementation
          Falcon-padded-512, the same C code the CLI runs through pqcrypto-falcon.
          PQClean 36708dbf, 2025-03-05
        
        
          Browser and CLI agree
          Every build checks a signature made by the other, both ways.
          falcon/tests/vectors
        
      

      
Not independently audited yet. Keys made in a browser live in page memory: use them for demos and keys that guard little, and keep valuable keys in the CLI, a hardware module or a vault.

    

  


  

    

      
Questions.

      

        
Is my key sent anywhere?
No. Keys are made, used and checked inside this tab. The page makes no network requests for any of it, and nothing is stored once you close the tab.

        
Can I make my Solana wallet post-quantum with this?
Not on its own. A wallet's address is an Ed25519 key, and only a change to Solana itself can replace that. Today a Falcon key can authorise things through programs that verify Falcon-512 on-chain, and Vantax can bind a post-quantum key to your account and refuse actions that arrive without its signature.

        
Falcon-512 or ML-DSA-87?
Use ML-DSA-87 for keys that guard a lot and live off-chain: it is a published NIST standard at the highest security category. Use Falcon-512 where size matters, above all on-chain, where a 4,627-byte signature doesn't fit in a transaction.

        
Why does a new signature look different every time?
Falcon signs with fresh randomness each time, so two signatures over the same message differ. Both verify. Keys are the opposite: the same 48-byte seed always gives the same key.