What this checks, and what it does not
Checks
- Negotiated TLS version and cipher suite.
- The key-exchange group a modern client gets.
- Whether the server accepts a hybrid post-quantum key exchange (X25519MLKEM768 or SecP256r1MLKEM768) when that is all a client offers.
- The leaf certificate: name match, trust, validity, issuer, key and signature algorithm.
- Whether TLS 1.0 or 1.1 is still accepted.
Does not check
- Anything the server does not expose in a public handshake.
- Internal systems, APIs behind the edge, VPNs, databases or other ports.
- Cryptography in your source code, libraries, keys or data at rest.
- Changes over time: it is a one-time snapshot of one endpoint.
A CDN or load balancer usually terminates TLS, so the result describes that edge, not the servers behind it.
How to read the verdict
- Key exchange is where the quantum risk is today. If a session uses only classical key exchange (X25519, P-256), an attacker who records the traffic now could decrypt it once a large quantum computer exists: harvest now, decrypt later. Hybrid groups combine X25519 or P-256 with ML-KEM (FIPS 203) and close that gap for clients that support them.
- Authentication (the certificate) is classical everywhere for now. Publicly trusted post-quantum certificates do not exist yet, so an RSA or ECDSA certificate is expected and is not a misconfiguration. Plan for it, but there is nothing to switch on today.
- Old protocols (TLS 1.0 and 1.1) are flagged because they are deprecated, not because of quantum computers.
There is no overall score: one public endpoint says little about an organisation’s cryptography.
Privacy
The domain you enter is used only to run the check. It is not written to any database or log by our code; the result is kept in memory for up to 10 minutes so repeat checks do not hit the server again. Your IP address is used transiently, in memory, for rate limiting. Details are in our privacy policy.
Your public website is the easy part. CRYPTAGION inventories the cryptography in your code, certificates and internal TLS endpoints, and turns it into a migration plan.
Find every algorithm in your code and internal endpoints → book a demo← Home · HNDL exposure · ML-KEM explained · Readiness assessment