- Home
- Security audits
- Post-quantum audit
Free post-quantum scan: is your website ready?
Encrypted traffic can be recorded today and decrypted tomorrow by a quantum computer. Enter a domain: with no account, KrakenShield scores its readiness out of 100 within seconds.
- Free, no account, no e-mail
- Any public website, no ownership check
- Nothing changed on the site
What is really negotiated with a recent browser
KrakenShield opens a few TLS connections and reads the server’s first answer, offering what a current browser offers. The handshake stops there.
Hybrid key exchange
Does the server accept X25519MLKEM768, the combination of classical and post-quantum cryptography used by current browsers?
Choice made for a browser
When a browser offers both, does the server really pick the hybrid exchange, or stay on the classical one?
TLS 1.3 and old versions
TLS 1.3 available, without which no hybrid exchange is possible, and TLS 1.0 and 1.1 refused.
HSTS and HTTPS redirect
Browsers told to refuse plain HTTP for at least six months, and nothing served in clear on port 80.
Blocking appliances
A hybrid ClientHello spans two network packets: the audit spots the firewalls and load balancers that leave it unanswered.
Certificate
Validity and key type, reported but not scored: a certificate cannot be used against traffic recorded today.
From the score to the fix
- 1
Enter the domain
Your website, a client’s or a supplier’s. The audit only uses what a browser could do, with no ownership check.
- 2
Read the score
A score out of 100, one explanation per point, and what to change on your server if the hybrid exchange is missing.
- 3
Apply on Cloudflare
If the site is served by Cloudflare, your own API token lets KrakenShield show what would change and apply only what you tick.
A score, and changes you can take back
On Cloudflare, every change is recorded with its previous value and can be reverted.
- Readiness score out of 100, with the detail of each point
- Key exchange actually chosen for a browser
- Server settings to change when the site is not on Cloudflare
- On Cloudflare: TLS 1.3, minimum TLS 1.2, Always use HTTPS and HSTS, setting by setting
- Journal of changes: who, when, before and after, with a revert button
- PDF report to pass on, with the changes already made
- Your Cloudflare token used for the request, then forgotten: never stored
Audit cost
Free
This is the current price of the audit. Reading your Cloudflare settings, applying changes and checking the result add nothing.
A Kredit costs €19 to €13.99 excl. VAT depending on the pack.
PricingWhat the audit does not do
- It does not make a whole site quantum-safe: it covers the visitor’s connection to the first server met.
- It does not change the Cloudflare encryption mode (Flexible, Full, Strict): a wrong value takes a site down, so it warns you and leaves the decision to you.
- It does not modify servers outside Cloudflare: it says what to change.
What people ask us
Is the scan really free, with no account?
Yes. Enter a domain on this page: no account, no e-mail, no card. The result is tied to nobody and the PDF report downloads directly. A free account adds the history of your scans and the fixes on Cloudflare.
Why act before quantum computers exist?
Because the risk starts with recording. Traffic captured today can be kept and decrypted later. Authentication can wait for computers to exist; the confidentiality of what you send today cannot.
What does the score measure exactly?
Half of the points go to the hybrid exchange being accepted, the rest to it being chosen for a browser, TLS 1.3, old versions refused, HSTS and the HTTPS redirect. Without a hybrid exchange a site stays below 50, however clean the rest is.
Do I need to prove that I own the website?
Not for the audit, which works on any public website. To change anything on Cloudflare you provide your own API token: if it does not give access to the zone, nothing is possible.
Which permissions does the Cloudflare token need?
Zone Read and Zone Settings Edit, limited to the zone concerned. We advise a token with a short lifetime. Global API keys are not accepted.
Can I really undo a change?
Yes, from the journal, which puts back the previous value and refuses if someone changed the setting since, unless you confirm. One limit is stated before you apply it: browsers that have seen HSTS remember it until its term, up to six months.
My site is not on Cloudflare. Is the audit useful?
Yes. The score and the advice apply to any server: the hybrid exchange mostly depends on a recent TLS library such as OpenSSL 3.5, and on the group order set on the server.
The other audits of the platform
Surface and SSL/TLS audit
SSL/TLS grade from A+ to F, certificate, headers, DNS
ReadPrivacy audit
Cookies, consent and third-party trackers
ReadCode analysis
Dependencies, secrets and flaws, your code stays with you
ReadPenetration test
Orchestrated, authorised, non-destructive
ReadPricing
Prices excluding VAT. The bigger the pack, the less a Kredit costs.
Read
