Does your site support post-quantum TLS?
One handshake tells you whether traffic to your domain is being recorded today for decryption later. Here is how to find out, and how to read the answer.
The browser checker is not live yet
The probing engine is real and you can run it right now from the command line. The hosted, paste-a-domain version is still being built, and we would rather say so than show you an input that does nothing.
One command, from your own machine
qProbe handshakes the endpoint and reports the key exchange it actually negotiated. It is read-only, it never modifies a target, and it requires you to attest that you own the host.
npx @quantakrypto/qprobe --i-own-this example.comThe static scanners read configuration; qProbe reads reality. It handshakes the live TLS and SSH endpoints you own and reports whether they actually negotiate a post-quantum hybrid key exchange. Hard-gated behind an ownership attestation: it never modifies a target and never scans ranges. Source on GitHub.
Three answers, and what each one means
X25519MLKEM768 negotiated
The handshake used a hybrid of X25519 and ML-KEM-768. Traffic captured today stays unreadable to a future quantum computer. This is the result you want.
X25519 or P-256 only
A classical key exchange. Anything recorded today can be decrypted the day a cryptographically-relevant quantum computer exists. This is harvest-now-decrypt-later exposure and it is not fixable in hindsight.
Handshake fails with a large ClientHello
A middlebox or an old TLS terminator is choking on the bigger post-quantum ClientHello. Usually a load balancer or an inspection appliance rather than your server.
For how common each result is across the public web, see the PQC Observatory, which measures a fixed panel of hosts daily.
What to change
Enabling hybrid key exchange is usually a configuration change at the edge, not a rewrite.
- Read the hybrid key exchange standards page for what X25519MLKEM768 is and which stacks support it.
- Follow the guide to migrating TLS to hybrid, including the middlebox failures a larger ClientHello triggers.
- Scan the rest of your estate with qScan: TLS is one surface, and it is rarely the one that hurts most.
Questions this raises
Does post-quantum TLS protect data I have already sent?
No. Enabling a hybrid key exchange protects sessions from the moment you turn it on. Traffic an adversary already recorded stays recorded, and stays decryptable once a quantum computer can break the classical key exchange that protected it. That asymmetry is why the deadline matters more than the arrival date.
Is a hybrid key exchange weaker than classical X25519?
No. A hybrid combines both, so it stays secure if either half holds. You are not trading classical security for post-quantum security; you are requiring an attacker to break both.
My CDN terminates TLS. Does that mean I am covered?
For the connection between your visitor and the CDN, often yes, and that is why adoption numbers look high. The connection from the CDN to your origin is a separate handshake with its own algorithms, and it is frequently still classical.
Why is the browser checker not available yet?
The probing engine exists as qProbe and runs from the command line today. The hosted single-domain version is not live. Rather than render an input that does nothing, this page gives you the command that answers the question now.
One domain is a spot check. An audit is the whole estate.
TLS is the surface everyone looks at first. The exposure that cannot be fixed in hindsight is usually somewhere else.