Find the crypto in your source code
PQLens reads your source and reports every cryptographic API call it recognises — the algorithm, the key size where it is stated, the library, and the exact file and line — across Python, JavaScript/TypeScript, Java/Kotlin and Go.
How it works
- Open the Code tab and pick a folder — your browser reads it locally via the File System Access API (or a folder upload as a fallback); nothing is sent anywhere.
- The scanner matches known crypto APIs and constructions in four language families and extracts key sizes where they appear in the call.
- Each occurrence is classified — an
RSA.generate(1024)is broken, RSA-2048 is quantum-vulnerable, AES-128 is quantum-weakened, AES-256 is PQC-ready. - Results render as a table right in the tab; sync them to your account, and export as HTML, CSV, Excel or a CycloneDX 1.6 CBOM on Pro and above.
What it catches that grep does not
The classifier knows the APIs, not just the names: hashlib and cryptography.io in Python, WebCrypto and node:crypto in JS/TS, JCA/JCE in Java, crypto/* in Go. It extracts key sizes from the call site, so it can tell RSA-1024 from RSA-4096 — the difference between broken and quantum-vulnerable with a 2035 deadline. The rules are an open YAML catalog, so you can read exactly why a finding got its status.
We find the crypto you use, not the keys you leaked
PQLens is not a secret scanner. It reports algorithms and usage, not credentials — pair it with your existing secret scanner rather than replacing it.
Frequently asked questions
Which languages are supported?
Python, JavaScript/TypeScript, Java/Kotlin, and Go. Crypto that lives in other languages usually still surfaces via the dependency, SBOM, config, certificate or endpoint scans.
Does my source code leave my machine?
No. The scan runs entirely inside the browser tab you have open, compiled to WebAssembly. Your files are read locally and never uploaded; only the findings you choose to sync (algorithm names, statuses, locations) reach your account.
Is AES-128 broken by quantum computers?
No. Grover's algorithm weakens it (roughly halving effective key strength in theory, with enormous practical caveats), which is why PQLens marks AES-128 quantum-weakened — not broken. AES-256 is classified PQC-ready.
How large a folder can I scan?
Free tier caps a single scan at 5MB of content. Pro raises that to 250MB; Enterprise has no artificial cap (bounded only by what a browser tab can hold in memory for one scan).