Post-Quantum Readiness
Post-Quantum Connection Tester
Is the encryption protecting this connection ready for quantum computers? This checks the TLS key exchange your browser just negotiated — live, in your browser, with nothing sent to any third party.
Checking this connection…
Reading the negotiated key exchange group…
Connection details
- Key exchange
- —
- Quantum-safe
- —
- TLS version
- —
- HTTP version
- —
- SNI
- —
- Cloudflare edge
- —
Server side, mylesagnew.com already offers post-quantum hybrid key exchange, so this result reflects your browser and network.
Turn on post-quantum key exchange
Most current browsers negotiate it automatically. If this test says your connection is classical, one of these usually explains it:
- Chrome / Edge 131+: on by default. If off, enable
chrome://flags/#post-quantum-key-agreement(or check the enterprise policyPostQuantumKeyAgreementEnabled). - Firefox 132+: on by default. In
about:config, setsecurity.tls.enable_kybertotrue. - Safari: post-quantum TLS is still rolling out — expect a classical result on most versions today.
- Corporate networks: a TLS-inspecting proxy, VPN, or old firewall often strips the post-quantum group. A classical result on a managed device usually points here.
What this test actually checks
TLS — the padlock on every HTTPS site — starts with a key exchange: your browser and the server agree on a secret that encrypts the rest of the session. Classical key exchange (like X25519 or ECDH P-256) is safe against today’s computers but breakable by a future cryptographically-relevant quantum computer.
A post-quantum hybrid key exchange — today that means X25519MLKEM768,
combining classical X25519 with the NIST-standardised ML-KEM-768 (formerly Kyber) —
stays secure against both classical and quantum attackers. This tool reads which one your connection
chose. It does not test signatures, certificates, or data at rest.
Why it matters now: “harvest now, decrypt later”
An attacker doesn’t need a quantum computer today. They can record your encrypted traffic now and store it until a quantum computer exists — then decrypt it retroactively. Anything with a long shelf life (health records, legal files, credentials, IP, government data) is at risk the moment it crosses a classical-only connection.
Post-quantum key exchange closes that window: traffic protected by a hybrid group can’t be decrypted later, even by a future quantum computer. That’s why it’s worth turning on before the threat is here, not after.
How this tool works (and what it doesn’t do)
This site is served through Cloudflare, which terminates TLS and exposes the negotiated key exchange
via its diagnostic endpoint /cdn-cgi/trace. The page makes a single same-origin
request to that endpoint, reads the kex= field, and classifies it. That’s the whole test.
- No backend, no tracking. The only request is to this site’s own trace endpoint. Your IP address is never displayed, stored, or sent anywhere.
- It reflects your browser + network. The server already supports post-quantum, so the result tells you about your side of the connection.
- It’s the real handshake. Not a simulation — it reports the actual group your browser negotiated to load this page.
FAQ
My connection is classical — is something wrong?
No. It means your browser or network isn’t offering post-quantum key exchange yet. Your connection is still encrypted and safe against today’s computers; it’s just not future-proofed against “harvest now, decrypt later.” See the enable steps above.
Does a “quantum-safe” result mean I’m fully protected?
It means the key exchange for this connection is post-quantum. Full post-quantum security also needs quantum-resistant certificate signatures, which are still being standardised and rolled out across the web. This is the most important and most deployed piece today.
Why does it only work on mylesagnew.com?
The test needs a same-origin server that reports its negotiated key exchange. It can’t read that for arbitrary third-party sites from your browser — cross-origin rules and TLS design both prevent it. So it measures your connection to this site specifically, which is representative of what your browser negotiates everywhere post-quantum is supported.
What is ML-KEM / Kyber?
ML-KEM (Module-Lattice Key Encapsulation Mechanism) is the NIST-standardised post-quantum key exchange algorithm, published as FIPS 203. It was known as Kyber during standardisation. Browsers deploy it in hybrid mode — combined with classical X25519 — so you’re never worse off than before.
Building this into your own security baseline?