Protecting data that must stay secret ten years from now is a problem for today: an adversary can capture your encrypted traffic now and decrypt it once quantum capability exists (harvest now, decrypt later). Quipu is a free hybrid post-quantum encryption library for data at rest: it combines proven classical cryptography with the new kind, so that it only breaks if both fall at once.
Pure Rust, and why
Quipu started out aiming at several languages: a Rust core with a C ABI on top and bindings for Python, Node and Go. It worked, but the lesson was clear: maintaining a stable C interface plus four bindings, each with its own packaging and interoperability tests, was complexity that did not pay for itself against the real goal — protecting data at rest — and it widened the attack surface with unsafe we did not want.
Today Quipu is pure Rust: memory safe, no garbage collector, no first-party unsafe. And for people who do not write Rust, it ships as a native Python wheel via PyO3 — the surface that non-Rust users actually need. One codebase, one thing to audit. It is the same philosophy that guides the rest: where good cryptography exists, reuse it; simplicity is a security decision, not a convenience.
