---
title: "Free post-quantum scan: will your website withstand quantum computers?"
description: "Harvest now, decrypt later, ML-KEM, ANSSI and EU deadlines: understand the quantum risk and test your website for free, without an account."
url: https://krakenshield.eu/knowledge/blog/free-post-quantum-scan-website/
lang: en
updated: 2026-11-05
publisher: KrakenShield (KRAKEN HOLDING SAS)
overview: https://krakenshield.eu/llms.txt
---
# Free post-quantum scan: will your website withstand quantum computers?
> Harvest now, decrypt later, ML-KEM, ANSSI and EU deadlines: understand the quantum risk and test your website for free, without an account.

Guide Published 5 November 2026

An attacker can copy your encrypted traffic today and read it ten years from now. Is your website already protected? Our post-quantum scan answers within seconds, free of charge and without an account. Here is what the threat is, what the score measures and how to improve it.

By **Belinda** 8 min read

*Chapter 9 introduction by Belinda*

> **Tip**
> Tip
> 
> **Test your website right now.** [Run the free post-quantum scan](https://krakenshield.eu/post-quantum-audit/): enter a domain and read your score out of 100 within seconds. No account, no e-mail, nothing changed on the site.

## Why talk about it now?

Quantum computers regularly make the headlines, often with alarmist titles. Let us be clear: as of today, no known machine can break the encryption that protects your connections. And yet ANSSI, the European Union, NIST and the G7 are all calling for action now.

There are two reasons for this. Some data stolen today can be decrypted tomorrow. And changing an organisation’s cryptography takes years: ANSSI estimates that the transition will last more than a decade and touch the entire digital ecosystem.

Estimates are tightening too. In 2019, breaking a 2048-bit RSA key was thought to require around 20 million qubits. In May 2025, Google researcher Craig Gidney showed that fewer than a million noisy qubits could be enough, in less than a week. That is still very far from existing machines, but the gap is closing from both ends.

28 to 49%

*probability that a quantum computer able to break today’s cryptography appears within ten years, according to a panel of 26 international experts*

Source: Global Risk Institute, Quantum Threat Timeline Report 2025 (March 2026)

## “Harvest now, decrypt later”

This is why the threat is already real. A patient adversary, typically an intelligence service or an [APT](https://krakenshield.eu/knowledge/glossary/apt/) group, can record encrypted communications it cannot read today and store them. The day it has a quantum computer, it breaks the key exchange and reads everything.

> **Nestor Former hacker turned defender:** To hit you in ten years, all it takes is keeping your exchanges safe on disk from today. A few drives, some patience, and what you thought was confidential for a long time ends up readable.

To find out whether this concerns you, ask three questions. How long must your data stay secret (medical records, contracts, trade secrets, research)? How long will it take you to migrate your systems? When could a relevant quantum computer appear? If the secrecy period plus the migration time goes beyond the third date, you are already late.

## What falls, and what holds

A quantum computer does not break everything. Shor’s algorithm targets public-key cryptography, which protects the key exchange of every [TLS](https://krakenshield.eu/knowledge/glossary/tls/) connection and signatures. Symmetric [encryption](https://krakenshield.eu/knowledge/glossary/encryption/) and [hashing](https://krakenshield.eu/knowledge/glossary/hashing/) fare much better.

| Mechanism | Use | Quantum threat | Answer |
| --- | --- | --- | --- |
| RSA, Diffie-Hellman, elliptic curves | Key exchange | Broken by Shor | ML-KEM, in hybrid mode |
| RSA, ECDSA, EdDSA | Signatures, certificates | Broken by Shor | ML-DSA, SLH-DSA, in hybrid mode |
| AES | Data encryption | Weakened by Grover | AES-256 |
| SHA-2, SHA-3 | Hashes, integrity | Little affected | Sufficient output sizes |

The answers exist: on 13 August 2024, NIST published its first three standards, ML-KEM for key exchange, ML-DSA and SLH-DSA for signatures. They are recent, and so is their cryptanalysis: in 2022, the SIKE algorithm, still in the running in the NIST competition, was broken in under an hour on an ordinary classical processor.

This is why ANSSI recommends hybridisation: combining a post-quantum algorithm with a proven classical one. If one falls, the other still protects.

> **Belinda PhD in cryptography:** Two locks of different designs are better than one: that is the whole idea of hybridisation.

## Your visitors are ready, is your server?

Good news: the transition has already begun. Since Chrome 131, in late 2024, browsers have offered the standardised hybrid exchange, called X25519MLKEM768. It combines X25519, a classical elliptic curve, with ML-KEM-768. To read the conversation, an attacker would have to break both.

60%+

*of browser connections to Cloudflare’s network offered a post-quantum key exchange in February 2026, up from under 3% in early 2024*

Source: Cloudflare, February 2026

Servers lag well behind: Cloudflare estimates that around 10% of its customers’ origin servers support this exchange. A browser can therefore offer it without your website accepting it, and nothing tells you so. That is exactly what the scan checks.

## What the free scan measures

[KrakenShield’s post-quantum scan](https://krakenshield.eu/post-quantum-audit/) opens a few TLS connections, offering what a current browser offers, reads the server’s first answer and stops there. It tests no vulnerability and changes nothing. It works on any public website: yours, a customer’s, a supplier’s.

| Point checked | Points | Why |
| --- | --- | --- |
| Hybrid exchange X25519MLKEM768 accepted | 50 | The only point that protects today’s traffic against future decryption |
| Hybrid exchange chosen for a browser | 10 | A server can accept it and still stay on the classical one |
| TLS 1.3 available | 15 | No hybrid exchange is possible without it |
| TLS 1.0 and 1.1 refused | 10 | Versions abandoned for their weaknesses |
| HSTS for at least 6 months | 10 | Browsers refuse to come back in clear |
| HTTP redirected to HTTPS | 5 | Nothing is served in clear |

You get a score out of 100 and a level: **ready** from 85, **partial** from 50 to 84, **exposed** below 50. Without a hybrid exchange, a website tops out at 40, even if the rest of its setup is perfect. Do not take this as a reproach: it is the case of many servers today, and it shows where to start.

The scan also reports what the score does not say: a firewall or load balancer that leaves an oversized negotiation message unanswered, an old version of the exchange dropped by browsers, an expired certificate. The result downloads as a PDF, to pass on to your provider or your management.

One limit, in all honesty: the score covers the visitor’s connection to the first server met. It says nothing about what happens behind that server, nor about the rest of the site’s security.

## Your score is low: what next?

1. **Move to a recent TLS library.** According to ANSSI, OpenSSL has implemented the hybrid exchange since version 3.5.0. On many servers, an operating system upgrade is what brings it: plan a backup and a time slot.
2. **Put the hybrid exchange first in the group list** , keeping the classical groups behind it for older clients. On nginx: `ssl_ecdh_curve X25519MLKEM768:X25519:secp256r1;` . On Apache: `SSLOpenSSLConfCmd Curves X25519MLKEM768:X25519:prime256v1` .
3. **Check the equipment in front of the server.** The hybrid message spans two network packets: old firewalls or load balancers can block it.
4. **If your website sits behind a CDN, look at its settings.** With a free account, KrakenShield can apply TLS 1.3 and HSTS on Cloudflare with your own token, with tracked and reversible changes.
5. **Run the scan again.** Check that the score has moved, on each of your domains.

## The timeline to keep in mind

| Deadline | What is expected |
| --- | --- |
| End of 2026 | EU Member States have started the transition: first steps, national roadmap, pilot projects |
| 2027 | ANSSI aims for post-quantum requirements when security products enter qualification |
| End of 2030 at the latest | High-risk uses have migrated; according to ANSSI, buying products without post-quantum will no longer be reasonable |
| End of 2035 | Medium-risk uses have migrated, others as far as possible |

The European roadmap also invites entities covered by the NIS 2 directive to include the quantum threat in their risk management, at board level.

## Beyond the website

The scan gives you a first figure, not a programme. For what comes next, appoint a lead and inform management, inventory your cryptography (VPN, SSH, e-mail, code signing, business applications), classify your data by how long it must stay confidential, and ask each supplier for a roadmap. [Chapter 9 of Cyber from A to Z](https://krakenshield.eu/knowledge/a-to-z/09-post-quantum/) details this approach, with Belinda.

> **Belinda PhD in cryptography:** You do not have to migrate everything this year. Measure, take stock, stop buying equipment that cannot change, and turn on hybrid as soon as it costs you nothing. The rest can be prepared calmly.

So, should you worry? No. Should you get started? Yes, and the sooner the cheaper. Start by measuring: [your post-quantum score is one click away](https://krakenshield.eu/post-quantum-audit/), free of charge and without an account.

## Key takeaways

1. The risk starts with recording: whatever is intercepted today can be decrypted the day a cryptographically relevant quantum computer exists.
2. RSA, Diffie-Hellman and elliptic curves are at risk; AES-256 and hash functions remain solid with sufficient sizes.
3. The hybrid key exchange X25519MLKEM768 already protects the confidentiality of traffic, and recent browsers offer it: servers are the ones lagging behind.
4. KrakenShield’s free scan scores a website out of 100 within seconds, with no account and no change to the site. Without a hybrid exchange, the score stays below 50.
5. Deadlines are converging: start by the end of 2026, protect high-risk uses by the end of 2030, finish around 2035.

## Frequently asked questions

**Is KrakenShield’s post-quantum scan really free?**

Yes. Just enter a domain on the scan page: no account, no e-mail, no card. The score, the detail of each point and the PDF report are available right away. A free account adds the history of your scans and the fixes on Cloudflare.

**Can the scan disrupt my website?**

No. It opens a few TLS connections, as a browser would, reads the server’s first answer and stops there. It changes nothing and tests no vulnerability. It works on any public website, with no ownership check.

**Can a quantum computer break my encryption today?**

No, no known machine can do that today. The risk comes from traffic recorded now to be decrypted later, and from how long a migration takes: ANSSI, the French cybersecurity agency, estimates the transition will last more than a decade.

**Why does my website score 40 out of 100 when its TLS setup is clean?**

Half of the points go to the hybrid exchange being accepted, and ten more to it being chosen for a browser. A server that is otherwise perfect therefore tops out at 40. This is often the sign of a TLS library that is too old: the hybrid exchange comes with OpenSSL 3.5.

**Do I need to change my TLS certificate to be post-quantum?**

Not yet. A certificate proves identity at the moment of connection: a future computer cannot use it against traffic recorded today. According to ANSSI, there is no standard yet for hybrid authentication in TLS 1.3. That is the next project.

## Sources

- [ANSSI, Post-quantum cryptography: general position and actions (in French)](https://cyber.gouv.fr/enjeux-technologiques/cryptographie-post-quantique/)
- [ANSSI, Post-quantum transition of TLS 1.3, technical sheet (2 February 2026, in French)](https://messervices.cyber.gouv.fr/guides/Transition-post-quantique-protocole-TLS-1-3)
- [ANSSI, Rules and recommendations on the choice and sizing of cryptographic mechanisms (v3.00, 20 March 2026, in French)](https://messervices.cyber.gouv.fr/guides/mecanismes-cryptographiques)
- [ANSSI, call to action of the G7 cybersecurity working group (3 September 2026, in French)](https://cyber.gouv.fr/actualites/transition-post-quantique-lanssi-et-ses-partenaires-du-g7-publient-un-appel-a-action/)
- [NIST, approval of standards FIPS 203, 204 and 205 (13 August 2024)](https://csrc.nist.gov/News/2024/postquantum-cryptography-fips-approved)
- [European Commission and NIS Cooperation Group, roadmap for the transition to post-quantum cryptography (23 June 2025)](https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography)
- [Cloudflare, measuring post-quantum encryption on Cloudflare Radar (February 2026)](https://blog.cloudflare.com/radar-origin-pq-key-transparency-aspa/)
- [Global Risk Institute, Quantum Threat Timeline Report 2025 (March 2026)](https://globalriskinstitute.org/publication/quantum-threat-timeline-report-2025b/)
- [C. Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits (May 2025)](https://arxiv.org/abs/2505.15917)

[Go further**Post-quantum: should you worry?** Cyber A to Z, chapter 9](https://krakenshield.eu/knowledge/a-to-z/09-post-quantum/) [All articles](https://krakenshield.eu/knowledge/blog/)

## More from the blog

[Guide **Qualys SSL Labs or KrakenShield: getting an A+ and keeping it**](https://krakenshield.eu/knowledge/blog/ssl-labs-vs-krakenshield-ssl-test/) [Guide **Penetration testing for small businesses: cost, the law and how to choose a provider**](https://krakenshield.eu/knowledge/blog/penetration-test-cost-choosing-provider/) [News **The biggest bank hacks of the last 30 years: from Citibank to Binance and Crédit Mutuel Arkéa**](https://krakenshield.eu/knowledge/blog/biggest-bank-hacks-30-years/)