Tools / Post-quantum readiness

Post-quantum TLS readiness checker

Check whether your website supports hybrid ML-KEM post-quantum key exchange and whether it is selected during the TLS handshake. This measures a key-exchange readiness signal, not the security of every part of your site.

Why it matters now

“Harvest now, decrypt later.” Encrypted traffic recorded today can be decrypted once large quantum computers exist. Quantum-safe key exchange protects today’s traffic against that. Governments have set migration deadlines (NIST, NSA CNSA 2.0, the EU roadmap), and auditors have started to ask.

Grades

A+ — quantum-safe key exchange (X25519MLKEM768), used by default.
A — supported, but the server still picks classic key exchange when a browser offers both.
C — TLS 1.3 is in place but not quantum-safe yet: usually a configuration change.
D — no TLS 1.3, which quantum-safe key exchange requires.

How it works

Three ordinary TLS handshakes — offering only quantum-safe groups, only classic groups, and both — exactly like a browser connecting. Nothing else is sent, and nothing is stored.

Need help migrating your servers, APIs and internal systems? Talk to us.