Is your website ready for quantum computers?
In 10 seconds, find out if your HTTPS already uses post-quantum encryption. Free, no sign-up.
The scan is the easy part
Every free checker — ours included — tells you yes or no, once. The hard part is fixing it, and keeping it fixed as your servers, CDNs and browsers change.
- Scan — free — Grade your TLS in 10 seconds, the same public check any free tool runs.
- Fix — the $49 report — Exact remediation for nginx, Apache, Caddy and Cloudflare, not just a grade.
- Stay safe — daily monitoring — We scan all your domains every day and email you the moment post-quantum key exchange drops, a grade falls, or a certificate nears expiry. From $29/month — the thing one-off checkers do not do.
What we check
- TLS version and TLS 1.3 support
- Key exchange: quantum-resistant hybrid, or classical and exposed to harvest-now-decrypt-later
- Whether the server copes with the large ClientHello modern browsers send
- Certificate algorithm, key size, validity and expiry
How the scan works
We make two ordinary connections to port 443, as any browser would, read what the server chooses and close. No data is sent and no exploit is attempted. Only public internet domains are scanned.
What this scan does not cover
- Grade A does not mean your site is fully "quantum-safe" or free of vulnerabilities. We measure the public TLS connection on port 443 only.
- If your site is behind a CDN or proxy (such as Cloudflare), we test the visitor-to-CDN connection, not the CDN-to-origin connection.
- We do not test the web application itself, email, VPNs, internal systems or how your data is stored.
- Certificates are still classical (RSA/ECDSA) on every site today, because browsers do not accept ML-DSA certificates yet. That is not a mistake in your setup.
- The result is a snapshot at scan time; any change to the server or CDN can change it.
Pricing
Free summary $0
- Grade (A / B / C / F)
- Quantum-resistant key exchange status
- TLS version and certificate algorithm
Full report $49
- Every finding, with what it means and its priority
- Fix steps for nginx, Apache, Caddy and Cloudflare
- Certificate and handshake details
- Timeline context: NIST standards and published RSA-breaking estimates
- A printable copy you can save as PDF
For teams: daily monitoring of many domains with email alerts, from $29/month →
Frequently asked questions
What is X25519MLKEM768?
A hybrid TLS 1.3 key exchange combining classical X25519 with post-quantum ML-KEM (FIPS 203). Chrome, Firefox and Edge negotiate it by default today. It protects session keys against "harvest now, decrypt later" attacks.
Is my website at risk from quantum computers today?
No quantum computer can break TLS yet, but traffic recorded today could be decrypted years from now once one exists. Post-quantum key exchange matters now for any data that stays sensitive for years.
How do I enable post-quantum TLS on my server?
You need a TLS library with ML-KEM: OpenSSL 3.5+ for nginx and Apache, a recent Caddy, or putting Cloudflare in front of your site. We publish step-by-step guides for each.
Does an A grade mean my site is fully quantum-safe?
No. We measure the key exchange on the public TLS connection only. Certificates are still classical on every site (browsers do not accept ML-DSA certificates yet), and we do not test your application or the CDN-to-origin link.
How much does it cost?
The scan and summary are free. The full report with fix steps is a one-off $49. Daily monitoring of all your domains starts at $29/month.
When do you have to move? NIST, CNSA 2.0, EU and UK deadlines →