Is This Website Quantum-Safe? Post-Quantum TLS Checker

Free quantum-safe website checker: paste one or more links and see if each site's HTTPS uses post-quantum encryption (X25519MLKEM768 with ML-KEM / Kyber), plus its TLS version, cipher and certificate, graded A to F, with how to switch your own server on.

Paste one or more website links (up to 10, one per line or separated by spaces)

Try:

What the grades mean

AQuantum-safe key exchange. HTTPS uses the post-quantum hybrid X25519MLKEM768: traffic recorded today stays secret even after Q-Day.

BOld post-quantum draft. Only the obsolete Kyber draft, which browsers have dropped.

CNot quantum-safe yet. Modern TLS 1.3, classical key exchange (X25519 or P-256).

DOlder TLS. TLS 1.2 or older with classical key exchange.

FNo HTTPS. Readable by anyone on the network today.

The certificate (RSA or ECDSA) is shown too. No browser accepts post-quantum certificates yet, so every site still has a classical one; that only matters once a quantum computer actually exists, while recorded traffic is a risk today. See how it all works in Quantum Cryptography.

Is this website quantum-safe?

This free checker connects to a website the way a modern browser does and asks for post-quantum encryption: the hybrid key exchange X25519MLKEM768, which combines the classic X25519 with ML-KEM-768 (Kyber), the NIST standard FIPS 203. If the server agrees, everything sent over that connection is protected against “harvest now, decrypt later”: attackers who record traffic today and decrypt it once a large quantum computer exists. It also reports the TLS version, the cipher, the certificate's key type, size and issuer, and redirects.

How the check works

The mes.fm server sends a TLS 1.3 ClientHello that offers only the post-quantum key share. A server that supports it answers with that group; one that doesn't asks for a classical group instead (a HelloRetryRequest). A second, normal connection reads the certificate. Nothing else is fetched from the page, the result is cached for an hour, and private or internal addresses are refused.

How to make your own site quantum-safe

Behind Cloudflare: already on for visitors, nothing to do. Vercel, Google Cloud and many CDNs have also switched it on.
nginx / Apache with OpenSSL 3.5 or newer: put X25519MLKEM768 first in the key-exchange groups, e.g. nginx ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1; (Apache: SSLOpenSSLConfCmd Groups X25519MLKEM768:X25519:prime256v1).
Caddy 2.10+, Go 1.24+: on by default. Node.js with OpenSSL 3.5+: ecdhCurve: "X25519MLKEM768:X25519".
Keep TLS 1.3 enabled: post-quantum key exchange only exists in TLS 1.3.

Questions people ask

Why does a site get C even though it uses strong TLS?: Today's X25519 and P-256 key exchanges are strong against normal computers, but Shor's algorithm on a big quantum computer would break them, and recorded traffic could then be decrypted.
My browser shows the site is secure: is it quantum-safe?: The padlock only means classical HTTPS. Chrome, Edge, Firefox, Brave, Opera and Safari 26 offer X25519MLKEM768, so the connection is quantum-safe when both your browser and the site support it. Use “Is my browser quantum-safe?” above.
What about the certificate?: Post-quantum certificates (ML-DSA) are being standardised for the web but no browser trusts them yet. Certificates protect against impersonation at the moment of the visit, so they only need replacing before a quantum computer exists, not to protect recorded traffic.
Can this check email or VPN servers?: Not yet: it checks HTTPS on port 443 only.

Comments