--- title: "Free post-quantum scan: is your website ready?" description: "Does your website already use the hybrid key exchange of modern browsers? Free post-quantum scan, no account: a score out of 100 in seconds, with advice on…" url: https://krakenshield.eu/post-quantum-audit/ lang: en publisher: KrakenShield (KRAKEN HOLDING SAS) overview: https://krakenshield.eu/llms.txt --- # Free post-quantum scan: is your website ready? > Does your website already use the hybrid key exchange of modern browsers? Free post-quantum scan, no account: a score out of 100 in seconds, with advice on… Post-quantum audit Encrypted traffic can be recorded today and decrypted tomorrow by a quantum computer. Enter a domain: with no account, KrakenShield scores its readiness out of 100 within seconds. - Free, no account, no e-mail - Any public website, no ownership check - Nothing changed on the site What the audit checks ## What is really negotiated with a recent browser KrakenShield opens a few TLS connections and reads the server’s first answer, offering what a current browser offers. The handshake stops there. ### Hybrid key exchange Does the server accept X25519MLKEM768, the combination of classical and post-quantum cryptography used by current browsers? ### Choice made for a browser When a browser offers both, does the server really pick the hybrid exchange, or stay on the classical one? ### TLS 1.3 and old versions TLS 1.3 available, without which no hybrid exchange is possible, and TLS 1.0 and 1.1 refused. ### HSTS and HTTPS redirect Browsers told to refuse plain HTTP for at least six months, and nothing served in clear on port 80. ### Blocking appliances A hybrid ClientHello spans two network packets: the audit spots the firewalls and load balancers that leave it unanswered. ### Certificate Validity and key type, reported but not scored: a certificate cannot be used against traffic recorded today. How it works ## From the score to the fix 1. 1 ### Enter the domain Your website, a client’s or a supplier’s. The audit only uses what a browser could do, with no ownership check. 2. 2 ### Read the score A score out of 100, one explanation per point, and what to change on your server if the hybrid exchange is missing. 3. 3 ### Apply on Cloudflare If the site is served by Cloudflare, your own API token lets KrakenShield show what would change and apply only what you tick. What you get ## A score, and changes you can take back On Cloudflare, every change is recorded with its previous value and can be reverted. - Readiness score out of 100, with the detail of each point - Key exchange actually chosen for a browser - Server settings to change when the site is not on Cloudflare - On Cloudflare: TLS 1.3, minimum TLS 1.2, Always use HTTPS and HSTS, setting by setting - Journal of changes: who, when, before and after, with a revert button - PDF report to pass on, with the changes already made - Your Cloudflare token used for the request, then forgotten: never stored ### Audit cost Free This is the current price of the audit. Reading your Cloudflare settings, applying changes and checking the result add nothing. A Kredit costs €19 to €13.99 excl. VAT depending on the pack. [Pricing](https://krakenshield.eu/pricing/) ### What the audit does not do - It does not make a whole site quantum-safe: it covers the visitor’s connection to the first server met. - It does not change the Cloudflare encryption mode (Flexible, Full, Strict): a wrong value takes a site down, so it warns you and leaves the decision to you. - It does not modify servers outside Cloudflare: it says what to change. Frequently asked questions ## What people ask us **Is the scan really free, with no account?** Yes. Enter a domain on this page: no account, no e-mail, no card. The result is tied to nobody and the PDF report downloads directly. A free account adds the history of your scans and the fixes on Cloudflare. **Why act before quantum computers exist?** Because the risk starts with recording. Traffic captured today can be kept and decrypted later. Authentication can wait for computers to exist; the confidentiality of what you send today cannot. **What does the score measure exactly?** Half of the points go to the hybrid exchange being accepted, the rest to it being chosen for a browser, TLS 1.3, old versions refused, HSTS and the HTTPS redirect. Without a hybrid exchange a site stays below 50, however clean the rest is. **Do I need to prove that I own the website?** Not for the audit, which works on any public website. To change anything on Cloudflare you provide your own API token: if it does not give access to the zone, nothing is possible. **Which permissions does the Cloudflare token need?** Zone Read and Zone Settings Edit, limited to the zone concerned. We advise a token with a short lifetime. Global API keys are not accepted. **Can I really undo a change?** Yes, from the journal, which puts back the previous value and refuses if someone changed the setting since, unless you confirm. One limit is stated before you apply it: browsers that have seen HSTS remember it until its term, up to six months. **My site is not on Cloudflare. Is the audit useful?** Yes. The score and the advice apply to any server: the hybrid exchange mostly depends on a recent TLS library such as OpenSSL 3.5, and on the group order set on the server. Go further ## The other audits of the platform [Surface and SSL/TLS auditSSL/TLS grade from A+ to F, certificate, headers, DNSRead](https://krakenshield.eu/surface-audit/) [Privacy auditCookies, consent and third-party trackersRead](https://krakenshield.eu/privacy-audit/) [Code analysisDependencies, secrets and flaws, your code stays with youRead](https://krakenshield.eu/code-analysis/) [Penetration testOrchestrated, authorised, non-destructiveRead](https://krakenshield.eu/penetration-test/) [PricingPrices excluding VAT. The bigger the pack, the less a Kredit costs.Read](https://krakenshield.eu/pricing/) Take action ## Run your first audit today Free sign-up, no credit card. Buy Kredits when you need them to run your first audits. Your console is ready: start an audit or follow your running analyses. Free sign-up, no credit card. Hosted in Europe.