Scan your TLS endpoints
One probe shows the protocol version, cipher suite and key-exchange group your servers actually present — including whether the handshake is classical ECDHE or hybrid post-quantum.
How it works
- Open the TLS tab in the app, type a hostname (add the port if it isn’t 443), and click Scan.
- PQLens performs a real handshake from its edge and records the negotiated protocol, cipher suite and key-exchange group.
- Hybrid key exchange (
X25519MLKEM768) is reported as PQC-ready; classical ECDHE is quantum-vulnerable — which is normal today, not negligence. - Sync the result to your account to add it to your inventory and, on Pro and above, keep a history of it over time.
What “quantum-vulnerable” means here
Almost every certificate and key exchange on the public internet today is RSA or elliptic-curve — secure against classical attackers, vulnerable to a future cryptographically relevant quantum computer. That is the industry baseline, not a finding to panic over. The reason to measure it now is harvest-now-decrypt-later: recorded traffic can be decrypted retroactively, so long-lived secrets over classical key exchange are already exposed. Browsers and CDNs are moving to hybrid X25519MLKEM768 — this probe shows whether your servers have.
Why the probe runs from our edge, not your browser
Browsers have no way to open a raw TCP socket and speak the TLS handshake byte-for-byte, so this one surface is the deliberate exception to “everything stays in your browser”: the probe connects from PQLens’s edge to the host you name. Nothing about the target is stored beyond the classification you choose to sync, and only the hostname you type is ever contacted.
One caveat: TLS 1.3 hides the certificate
TLS 1.3 encrypts the certificate exchange after the handshake, so this probe reports protocol, cipher suite and key-exchange group but not certificate details for TLS 1.3 endpoints — use the certificate scan for that, against the cert file itself.
Frequently asked questions
Does scanning send anything to PQLens servers?
The probe itself only sends the hostname you type, from PQLens's edge to that host — no code, files or credentials are involved. If you sync the result to your account, the classified finding (protocol, cipher, key-exchange group) is stored there.
Is RSA-2048 in my certificate a problem today?
Against classical attackers, no — RSA-2048 is fine today. NIST plans to deprecate it after 2030 and disallow it after 2035, which is why it belongs in your inventory with a migration date, not an incident ticket.
How do I know if my server already does post-quantum key exchange?
If the negotiated group is X25519MLKEM768, PQLens reports the handshake as PQC-ready. If you see classical ECDHE groups, your TLS terminator does not offer a PQC hybrid yet.
Can I scan a domain that's itself behind Cloudflare?
Not currently — Cloudflare's own loop-prevention blocks our edge from opening a socket back into another Cloudflare-proxied domain. You'll see an honest message explaining this rather than a false result; it's a platform limitation, not a finding about the domain.