Is your website ready for post-quantum cryptography?
Enter a domain. In a few seconds you get its post-quantum key exchange status, TLS versions, cipher suites and certificate cryptography, checked against official deadlines.
Passive TLS handshakes only, like a browser. Results are cached for one hour.
What the scan checks
Hybrid ML-KEM key exchange
Whether the server negotiates X25519MLKEM768 or another standardized post-quantum group, which protects traffic against harvest now, decrypt later.
TLS versions
TLS 1.0 to 1.3 support. Legacy versions are flagged: TLS 1.3 is required for post-quantum key exchange.
Cipher suite inventory
Every accepted cipher suite per protocol version: the inventory PCI DSS requirement 12.3.3 asks you to document and review each year.
Certificate cryptography
Key type and size, signature algorithm and expiry for the whole chain, mapped to NIST, ANSSI, BSI and EU deadlines.
HSTS and HTTPS redirect
Whether browsers are forced onto HTTPS, so post-quantum protection is not bypassed by a downgrade.
CDN detection
Behind a CDN, you see the edge configuration. We flag it so you also check the origin server.
Why act now
Encrypted traffic recorded today can be decrypted once a large quantum computer exists. Regulators have set dates: inventories first, then migration of the most sensitive systems before 2030.
- 2030EU roadmap: high-risk systems migrated to post-quantum cryptography
- 2035NIST (draft IR 8547): RSA and elliptic curves disallowed
- 12 monthsPCI DSS 12.3.3: review cycle of your cipher suite inventory
Key dates
- PCI DSS 12.3.3 cipher suite inventory becomes mandatory
- Cyber Resilience Act reporting obligations apply
- EU roadmap: first steps and national PQC roadmaps
- ANSSI aims to require PQC for product qualification
- Cyber Resilience Act fully applies
- EU high-risk systems migrated; US federal PQC key exchange
- RSA and ECC disallowed (NIST draft); EU medium-risk migrated
Sourced reference
Get the monthly post-quantum briefing
New deadlines, adoption data from our observatory and practical migration guides. One e-mail a month, no spam, unsubscribe in one click.
Frequently asked questions
What does post-quantum ready mean for a website?
It means the server can negotiate a post-quantum or hybrid key exchange such as X25519MLKEM768 in TLS 1.3. The session keys then stay secret even against a future quantum computer. Certificates are a separate step: public web certificates are still RSA or ECDSA today.
Is the scan intrusive?
No. It performs standard TLS handshakes and one HTTP request, like a browser would. It never tries to log in, exploit or stress the server, and results are cached for an hour to avoid repeated connections.
My site is behind Cloudflare or another CDN. Is the result valid?
It is valid for the CDN edge, which is what visitors connect to. The connection between the CDN and your origin server is a separate TLS link: check it too, because it may still use classical key exchange only.
Is this a compliance certification?
No. The scan documents facts about your externally visible TLS configuration, with dates and sources. It helps build the inventory that PCI DSS, DORA or the CRA expect, but it is not an audit or a certificate.
Which deadlines apply to my company?
It depends on your sector and market: PCI DSS for card payments, DORA for EU financial entities, NIS2 for essential and important entities, the CRA for products sold in the EU. Our regulations page lists every requirement with its primary source.