Read this first
The migration off quantum-vulnerable cryptography is happening now, one server at a time, and almost nobody is keeping score in public. The PQC Observatory does: once a day we perform a single read-only TLS handshake to a fixed panel of public hosts, record whether each one negotiates the hybrid group X25519MLKEM768 and how its certificate is signed, and publish the trend. Read-only, restrained, and open about its method.
You can measure a single site's post-quantum posture in a second: our open-source qProbe does exactly that for endpoints you own. What has been missing is the aggregate, the answer to a simple question a journalist or a board asks: is the web actually adopting post-quantum key exchange, and how fast? The observatory is our attempt to answer it in the open, day over day.
What it measures
- Hybrid key exchange. Whether the server selects X25519MLKEM768, the hybrid that stays secure if either the classical or the post-quantum half holds. This is the single clearest signal that a host has started its migration.
- Certificate posture. The negotiated TLS version and the leaf certificate's signature algorithm and expiry, so the series also tracks the slower-moving question of signature agility.
- Reachability. Whether the host completed a handshake at all, so a drop in coverage never reads as a drop in adoption.
How it works, and what it will not do
The method is deliberately dull, because a measurement you cannot trust is worse than none. Once a day a worker performs one read-only TLS handshake per host, spaced out and rate-limited, with a hard timeout and no retries. It never sends application data, never attempts anything beyond the handshake, and honors a refusal or an opt-out immediately. This is the same class of unauthenticated measurement that public scanners such as SSL Labs and Censys have run for years.
It is a separate, self-contained project, pqc-observatory, rather than a mode of our endpoint prober. qProbe is gated behind an ownership attestation because it is meant for endpoints you control; the observatory measures hosts we do not own, so it keeps its own narrower, read-only policy and its own opt-out. The panel and the policy are open, and anyone can propose a host by pull request.
Why keep a public series
Migration timelines are driven by evidence, not exhortation. A single number, published every month, does three things at once: it makes progress legible to people who are not cryptographers, it gives early movers a reason to move before a mandate forces them, and it accumulates into a dataset nobody can backfill later. The trend matters more than any single month, which is precisely why it has to start now. See the harvest-now-decrypt-later argument for why the clock is already running.
The current numbers, the panel, and the full methodology live at quantakrypto.com/observatory. If you run one of the hosts we measure and would like it removed, contact us and we will drop it within one measurement cycle.