There isn’t any.
Morrow is free. The hosted service costs nothing and takes no card, and the platform itself is MIT‑licensed, so you can run your own copy and never speak to us at all.
Three ways to use it, none of them paid
No account. Type a domain at /check and see what its TLS endpoint negotiates today, whether any of it is quantum‑vulnerable, and what the published deadlines mean for it. The result keeps a permanent address you can link to and a badge you can put in a README.
Ask at /trial and a person reads the request. You get an organization nobody else can see, with real scanning against targets you authorize, the inventory, the CycloneDX CBOM and the evidence. There is no paid tier above it, because there is no paid tier.
Clone it and run it. Deployment covers a single server with Postgres, Redis and automatic TLS. It stays yours: your infrastructure, your data residency, your rules, and no dependency on this site continuing to exist.
Why free, and what that costs you
Post‑quantum migration is a deadline every organisation shares and most cannot yet see the shape of. A tool that answers “what cryptography am I actually running, and which of it breaks” is more useful to everyone if nothing stands between a person and the answer — no quote, no call, no procurement cycle. That is the whole reason.
What it costs you is the honest part. There is no service‑level agreement. Nobody is on call. The hosted instance is run by one operator and may be slow, may be down, and may change. Rate limits exist because capacity is finite, not because a larger plan is being withheld. If post‑quantum readiness is on a schedule your organisation is accountable for, run your own copy — that is what the licence is for, and it is the arrangement that does not depend on anyone’s goodwill.
What free does not mean
- Not unaudited. Findings carry what was observed, how it was classified and against which standard — FIPS 203/204/205, NIST and CNSA 2.0 deadlines. A model is labelled as a model and a failed check is never reported as a clean one.
- Not a data grab. The business is not advertising and there is nothing to monetise later. What is collected and why is in the privacy policy and the data boundary; the free check has its own notice covering both the person asking and the domain being checked.
- Not a licence to scan anyone. Check hosts you own, a supplier you are assessing, or a domain you are researching in good faith. Not someone else’s attack surface. The acceptable‑use policy is the line, and it is enforced.
- Not abandoned when it is inconvenient. The licence is MIT and the source is published, so if this site disappears the software does not. That is a stronger guarantee than a support contract from a company this size.
Still a conversation worth having
If you are running a structured evaluation — a defined scope, a deadline, stakeholders who need evidence they can review — the controlled pilot describes how to do that well. It is a way of working, not a product tier, and it costs nothing either.
Run the free check Request a workspace Ask a question