pqc-check_

What this checks

pqc-check tells you whether a website’s TLS 1.3 handshake already uses post-quantum key exchange — the hybrid ML-KEM (FIPS 203) groups such as X25519MLKEM768 that keep a connection secure even against a future quantum computer.

Harvest now, decrypt later

An attacker can record encrypted traffic today and decrypt it years from now, once a large enough quantum computer exists. Anything that must stay confidential beyond the next decade is already at risk. Post-quantum key exchange closes that window — which is why it matters that your servers turn it on now, not after quantum computers arrive.

How it works

Enter a hostname and pqc-check opens a standard TLS 1.3 handshake to port 443 or 8443, reads the key-exchange groups, TLS version and certificate the server offers, and reports whether a hybrid post-quantum group was negotiated. It performs no exploitation and does not alter the target in any way — see acceptable use.