Is my site post-quantum?

Enter your domain. We check up to 20 public hosts, including your app and API, and show which ones negotiate hybrid post-quantum key exchange.

What this checks

Which key exchange each host picks when a modern browser offers post-quantum key exchange (X25519MLKEM768, using ML-KEM from NIST FIPS 203).
Which hosts carry customer data (app, API, login) and which are the public website.
Whether a CDN in front of a host provides the post-quantum key exchange.

What it can't see

Traffic behind your CDN or load balancer, and between your own services.
Signatures, certificates and stored data: post-quantum certificates for public websites aren't generally available yet.
Anything not on port 443.

Questions

What does post-quantum key exchange protect against?

Someone recording encrypted traffic today and decrypting it later with a quantum computer. Hybrid key exchange adds ML-KEM to the classical X25519, so the connection stays protected if either is broken.

Why does my grade show a certificate as classical?

That's expected today. This check grades key exchange; certificates for public websites are still classical everywhere.

Do you store my results?

Results are kept for 90 days unless you turn them into an answer pack. They're reachable only by their link and never indexed by search engines.