Terms for the free check.
Last updated 2026-10-04. These terms cover the free post-quantum readiness check at /check and its public API. There is no account and no signup box to tick, so they bind on use: if you submit a domain, you accept them.
Acceptance Without A Signup
There is no account, no login and no click-through for this service, so acceptance works on use. Submitting a domain to the checker, or calling its public API, means you accept these terms and the acceptable-use policy. If you do not accept them, do not submit a domain.
So that this is not buried, the same statement and the links to it sit inside the form on /check, with the box you type into, and again on the result page. The boundaries the service enforces are also printed on that page, read live from its configuration, rather than only described here.
The version in force for your use is the one published at the moment you use it. The operator may change these terms; the date above says when this text last changed.
What The Service Is
You type a hostname. The service reads public Certificate Transparency records for that name and makes at most two TLS connections to that hostname on port 443 — the same kind of connection a browser makes — and publishes what it observed at a shareable URL.
Public Certificate Transparency logs, read through a third-party search service. The checked host is not contacted for this.
At most two connections, to one hostname, on port 443. One ordinary verified TLS handshake, and one ClientHello that offers post-quantum key-exchange groups so hybrid support can be observed. No HTTP request is ever sent to the checked host.
Published at /r/{domain} and readable by anyone with that URL, with JSON and CycloneDX exports and an embeddable badge. It is cached, so a popular domain is checked once per cache window rather than once per visitor, and it is recorded, so the address keeps resolving indefinitely. Both are described in the privacy notice.
The exact technical behaviour is set out on the scanner identity page, and the live limits this deployment enforces are published by GET /api/public-check/config and shown on /check.
Provided As-Is, With No Warranty
The service is provided as-is and as-available, free of charge, with no warranty of any kind, express or implied, including any warranty of accuracy, completeness, availability, fitness for a particular purpose or non-infringement, to the fullest extent the law allows.
For counsel: the formula above needs to be checked against Mauritian law and against the consumer-protection rules of the places visitors are likely to come from. Some of these exclusions may not be excludable for consumers.
In particular, and as a statement of fact rather than a disclaimer: the Certificate Transparency source is a third-party service that is frequently slow or unavailable. When it does not answer, the result says so. An unavailable source is never reported as “this domain has no certificates”.
A Point-In-Time Observation, Not An Audit
A result is one endpoint, at one moment, as seen by one client. It is not a security audit, a penetration test, a certification, an attestation, a compliance statement or advice.
- It covers the hostname you typed on port 443. Other names, other ports and anything behind a different load balancer were not checked.
- It describes what that server negotiated with this client, just now. A different client, a different data centre or tomorrow's configuration can differ.
- “Not observed” means not observed. It is never a statement that something is absent.
- The Q-Day year, the break probabilities and the harvest-now-decrypt-later tier are a stated planning model, not a measurement and not a forecast. The result labels them as such.
- A check that reached nothing is reported as failed, with no verdict. It never scores better than an endpoint that answered honestly.
If you need an assurance you can rely on, or evidence an auditor will accept, commission an assessment. The free check is a first look, and it says so on its own page.
No Liability For Decisions Taken On A Result
To the fullest extent the law allows, the operator is not liable for any loss or damage arising from the use of this service or from reliance on a result, including decisions about migration, procurement, supplier assessment, disclosure or risk. You decide what to do with what you read here, and that decision is yours.
For counsel: whether this exclusion is enforceable, whether a liability cap should be stated instead for a free service, and how it interacts with the consumer and data-protection rules of a visitor's own country all need confirming before this page is published.
Only Check What You Have A Reason To Check
You must not use this service against systems you have no legitimate interest in checking. Checking your own estate, a supplier you are assessing, or a domain you are researching in good faith is fine. Using it to look over someone else's fence is not.
You are responsible for your own legal position in your own jurisdiction and in the jurisdiction of the host you name. The connection this service makes is the kind a browser makes, and reading a public TLS handshake is ordinary; that is not a defence everywhere, and it is not legal advice.
The acceptable-use policy sets out what is permitted and what is prohibited in detail, and it forms part of these terms.
The Right To Refuse, Limit And Stop
The operator may refuse a request, rate-limit you, block you, or switch the service off, at any time and without notice. Several of these are automatic rather than discretionary:
Targets that are not a single public hostname are refused before anything is contacted: IP addresses, wildcards, credentials before the host, single-label names, any port other than 443, and names that resolve to a private, loopback, link-local, carrier-grade NAT or reserved address.
Per requesting address, per target domain, and for the whole service, by the hour and by the minute. A target domain has an hourly ceiling whoever asks, so the service cannot be pointed repeatedly at one host even from many addresses. The live numbers are published by GET /api/public-check/config.
A domain whose owner has asked not to be checked is refused before its name is resolved. See abuse and opt-out.
The whole service can be switched off while leaving these pages readable.
A refused or limited request gets a plain reason and, where it applies, a retry hint. Nothing was contacted for a refused target.
Results Are Public
A result is published at a shareable URL and is readable by anyone who has it. The checker is for public TLS endpoints and the result is a statement about a public endpoint, so do not submit a hostname that you need to keep private: submitting it makes the name part of a public URL. The privacy notice for the checker describes this in full, for both the person asking and the party being checked.
Abuse, Opt-Out And Privacy
If this service has been pointed at something it should not have been, or you operate a domain and never want it checked here, the abuse and opt-out page is the route. An opt-out is honoured before the domain is resolved, covers everything under the domain, and deletes the cached result.
What is recorded about you, what is recorded about a checked host, and for how long, is in the privacy notice. The platform privacy policy covers the paid product and accounts, not this free check.
Self-Hosting
This checker ships with the platform source under the MIT licence and runs from the command line as well as this web page. If you run your own copy, these terms do not cover it: you are the party making the connections, and the responsibility for what your copy contacts is yours, under your own jurisdiction's rules and your hosting provider's acceptable-use policy.
Governing Law And Contact
The operator of this deployment is Yasseen Nandally, based in Mauritius. These terms are intended to be governed by the laws of Mauritius, with the courts of Mauritius as the forum.
For counsel: this clause is a placeholder for a lawyer to confirm. It needs checking against Mauritian law, against whether a choice of law and forum can be imposed on a visitor who never signed anything, and against the consumer and data-protection rules that follow a visitor from their own country regardless of this clause. No company registration details or registered address are stated here because none have been supplied.
Notices, abuse reports and opt-out requests: no abuse address is configured on this deployment, so the only route is the contact page. The same address is published on /check and on the abuse and opt-out page.