Post-quantum TLS adoption tracker

Every Monday we re-scan the Tranco top 10,000 and watchlists for Germany, Austria and Switzerland; once a month the top 100,000. Week 2026-W45 (from 2026-11-02): 427 of the 715 top-1,000 sites that answered (59.7%) negotiate the hybrid X25519MLKEM768 key exchange.

This is the first week on record (the published study). The first week-over-week comparison appears after the next Monday scan.

Weekly share of top sites with post-quantum key exchange

Hosting providers and CDNs

Share of sites that negotiate X25519MLKEM768, by the network that serves them (7949 answering sites, 2026-W45). Behind a CDN this is the CDN's edge. Networks with fewer than 20 sites are not listed.

Watchlists: Germany, Austria, Switzerland

Hostnames as visitors reach them. Every list is checked each Monday.

Government (Germany, Austria, Switzerland)

9 of 10 enabled

Banks and central banks (DACH)

11 of 17 enabled · 1 undetermined (not counted)

Large companies (DACH)

18 of 20 enabled

Ranking by country →

Methodology and limits

Each hostname gets two connections to port 443 from a single server: one offering X25519MLKEM768 plus X25519 as Chrome does, and one ordinary TLS connection to read the certificate. Nothing else is sent and nothing is attempted. Results come from one vantage point at scan time; behind a CDN we see the visitor-to-CDN connection, not the CDN-to-origin one. "Not yet enabled" describes the key exchange only; it is not a judgement of a site's overall security.

Spotted an error, or want a hostname added or removed? Contact us via the Impressum. How we scan, and how to opt out →

Open data (CC BY 4.0): JSON · CSV · How many of the top 1,000 websites are ready for post-quantum TLS?