Is your TLS quantum-vulnerable?
Type a domain. You get what its public endpoint negotiates today — protocol, cipher, certificate key, signature, and whether the key exchange is already post‑quantum — plus what the published migration deadlines mean for it. One endpoint, one moment, public data only, and every figure says where it came from.
Result
What was measured
| What | Value | Source |
|---|
Algorithms this endpoint depends on
Certificate Transparency
What the published deadlines say
Quoted from the issuing authority. Whether a deadline binds this domain depends on who operates it, which this check cannot know.
Harvest now, decrypt later
What this check does not tell you
Take it with you
This result is public at its permanent address and readable by anyone who has the link, now and later. What was recorded about the person who asked and about the endpoint that was checked is in the privacy notice for this checker. It is a point‑in‑time observation, not an audit — see the terms of use. If this is your domain and you want it gone, opt out: the cached result is deleted, the permanent record is hidden, and the domain is refused before DNS. If you are the operator who saw the handshake, this is what connected to you.
Acceptable use
This tool reads public Certificate Transparency data for a domain and makes one TLS handshake to it on port 443. That is the same kind of contact a browser or SSL Labs makes, and nothing more.
Abuse reports and opt‑out requests. If this service has been pointed at something it should not have been, or you operate a domain and do not want it checked here, write to the address published on our contact page. An opted‑out domain is refused before anything is resolved or connected to, and its cached result is deleted. The opt‑out covers the domain and everything under it.
Every check is logged: the domain, the time, a salted hash of the requester's address, and the outcome. That is what makes an abuse report investigable. It is described in the privacy notice for this checker, and nothing here is stored against a customer account.
The full documents: terms of use · acceptable‑use policy · abuse and opt‑out · privacy notice · scanner identity. They are drafts awaiting review by a qualified lawyer. The statement above is served live from /api/public-check/config, so it cannot drift from the running code; if it and the policy pages ever disagree, this one describes the software.
The guardrails, and their current settings
Read from this deployment's live configuration, not from this page.
| Guardrail | Setting here |
|---|---|
| Loading… | |
What a full assessment adds
This check is free and it is real, but it is one endpoint at one moment. Here is what it cannot see, stated plainly so you can decide whether you need more than this.
Want the whole estate?
The platform discovers every endpoint, repository and certificate you own, prices the harvest‑now‑decrypt‑later exposure, and produces signed evidence and validated migration changes. It is the same classification you just read, applied to everything rather than one host.
Self‑hosting: this checker ships with the platform under the MIT licence and runs from the command line as well as the web page — see docs/PUBLIC_CHECKER.md. If you run your own copy, what it contacts is your responsibility, under your own jurisdiction's rules.