Post-quantum TLS readiness · live check
Scan a domain
This calls a small serverless function that opens a real TLS 1.3 connection to whatever domain you type — once offering classical key exchange only, once offering a post-quantum hybrid group — and reports which one the server picked. Try cloudflare.com or google.com to see a live "PQ ready" result.
Readiness verdict
Run a scan to see a result.
>_ Activity
How this works
Each scan calls a small serverless function that hand-builds two minimal TLS 1.3 ClientHello messages — no OpenSSL group configuration, no dependencies — and reads back only as far as the ServerHello to see which key-exchange group the server chose. It never completes the handshake. A browser can't do this itself: no web API exposes the negotiated key-exchange group to JavaScript, which is the whole reason for the small backend.
The endpoint is unauthenticated and open to anyone who calls it directly, not just this page — CORS only controls which web pages' JavaScript can read the response, it isn't an access-control mechanism.