Is Your Website Quantum-Ready?

What this checks

Your browser and a website agree on encryption keys during the TLS handshake. Classical key exchange (X25519, ECDH) can be recorded today and broken later by a cryptographically relevant quantum computer, the "harvest now, decrypt later" problem. The fix is hybrid post-quantum key exchange (X25519MLKEM768, combining X25519 with NIST-standardized ML-KEM-768), already live on much of the modern web.

This tool connects to your domain on port 443, offers the standardized post-quantum groups in a real TLS 1.3 ClientHello, and reports which key exchange your server actually selects. No signup, no scanning beyond a single handshake, results cached for one hour.

The grade, and exactly how we assign it

Grade A, Quantum-Ready: your server negotiates hybrid post-quantum key exchange. Traffic recorded today cannot be retroactively decrypted by a future quantum computer. Google, Cloudflare, and Wikipedia are here already.

Grade C, Modern but classical: TLS 1.3 with classical key exchange only. Fine against today's attackers, but recorded traffic is exposed to future quantum decryption. The fix is usually one server or CDN configuration change.

Grade F, Legacy: no TLS 1.3 at all. Post-quantum key exchange requires TLS 1.3, so this needs attention regardless of the quantum timeline.

What the grade does not cover, on purpose: it measures the key exchange of the one endpoint we probe, because key exchange is what harvest-now-decrypt-later attacks. It does not measure certificate signatures (still classical across essentially the whole web today), other subdomains, mail servers, or your data at rest. A single handshake, results cached for one hour. If you think we graded your domain wrong, tell us: hello@quantumsequrity.com.