| Host | Country | Category | Provider | TLS 1.3 | TLS 1.2 | PQC | Negotiated group | Checked |
|---|
Tip: click a row for full details and history. · Export: CSV · JSON
PQC adoption by country
PQC adoption by category
PQC adoption by provider
ML-KEM group support
Negotiated group (default client)
Certificate signature
Adoption over time
No history in this window yet — runs accumulate as the catalogue is re-scanned.
Which hosting providers & CDNs ship post-quantum key exchange
by default — and which don't yet. Attributed from the
Server header (with an IP → ASN fallback); hosts we
can't attribute (origin servers, or an ASN outside our map) are grouped as
Unknown. Percentages are over reachable hosts. Click a row
to see that provider's hosts.
| Provider | Hosts | Reachable | TLS 1.3 | PQC | Verdict |
|---|
No providers attributed yet — attribution fills in as the catalogue is re-scanned.
PQC adoption by network owner (autonomous system) — a different axis from Providers: it groups hosts by whose network the IP sits in (GlobalConnect, Telenor, Sikt, …) rather than who terminates TLS. The ASN reflects the host that actually answers, so a site behind a CDN counts under the CDN's ASN, not its own. Resolved via Team Cymru; percentages are over reachable hosts.
| Network (ASN) | Hosts | Reachable | TLS 1.3 | PQC | Verdict |
|---|
No networks attributed yet — attribution fills in as the catalogue is re-scanned.
PQC / TLS 1.3 status flips across the catalogue (last 30 days), newest first.
What this measures
In TLS 1.3 the cipher suite only covers the symmetric AEAD + hash
(already quantum-safe enough). The quantum-relevant part is the key-exchange group,
negotiated separately. We probe whether a server accepts a hybrid post-quantum group —
chiefly X25519MLKEM768 (ML-KEM / FIPS 203). We also read the leaf
certificate to flag post-quantum signatures (ML-DSA / SLH-DSA) — the other half
of PQC TLS, which almost nobody deploys yet.
A grey PQC dot means the scanner couldn’t probe it (OpenSSL < 3.5 or host unreachable) — shown as “unknown”, never as “unsupported”.
HTTP API
GET /api/health— scanner capability + catalogue size + refresh statusGET /api/results— latest check per catalogue hostGET /api/history/{host}— full detail + check history for one hostGET /api/stats?days=&group_by=category— daily adoption series (alsogroup_by=provider)GET /api/providers— per-provider PQC leaderboard + verdictGET /api/networks— per-network (ASN owner) PQC leaderboard + verdictPOST /api/check— probe one host{ "host": "…", "force": false }POST /api/admin/import— admin-only CSV host import (rawtext/csvbody)
Inspired by quantumhello.xyz.