Can a quantum computer read your website's traffic?
Enter a domain. We connect the way a browser does and tell you whether its encryption holds up against a future quantum computer. Free, no sign-up.
0/100
Each check
Connection details
Results reflect the public TLS configuration, tested from one location. Sites behind a CDN may answer differently elsewhere. This is not a full security assessment.
Your website is only the front door
VPNs, internal APIs, databases, code signing and partner integrations rely on the same algorithms a quantum computer can break. Quackbase maps where your organisation uses cryptography and builds a migration plan your team can actually carry out.
Why this matters before quantum computers exist
Attackers don't have to wait. They can record encrypted traffic today and decrypt it once a capable quantum computer exists. Anything that must stay secret for years, such as health records, contracts or trade secrets, is already exposed.
- 2024
NIST publishes the first post-quantum standards: ML-KEM (FIPS 203) for key exchange and ML-DSA (FIPS 204) for digital signatures.
- Today
Chrome, Edge, Firefox and Safari offer X25519MLKEM768 by default. The server is the missing half.
- 2030
NIST's draft transition plan (IR 8547) proposes deprecating RSA and elliptic-curve algorithms for most uses.
- 2035
The same draft proposes disallowing them entirely.
How the score works
100 points across five checks. Key exchange carries 60 of them, because it is the only part that can be recorded now and broken later. A site without post-quantum key exchange can score at most 40.
- 60Post-quantum key exchange
- Whether the server chooses X25519MLKEM768 or another hybrid group when a browser connects. Supporting it without choosing it earns 20.
- 10TLS 1.3
- Post-quantum key exchange only exists in TLS 1.3. Without it, nothing else can move.
- 10Legacy protocols
- TLS 1.0 and 1.1 should be off. Old protocols keep weak algorithms around.
- 10Certificate signature
- RSA of 2048 bits or more, or ECDSA, still earns full marks, because ML-DSA certificates aren't in general use yet.
- 10Certificate trust
- The certificate must be valid, unexpired and issued by a trusted authority.
Made by Quackbase
Quackbase is a cybersecurity consultancy based in Bangkok. If you want to know how ready your internal systems, VPNs and code are, book a free 30-minute call with us.