Post-Quantum TLS 1.3 + hybrid ML-KEM checker by @singe

QuantumHello

Enter a hostname or HTTPS URL to check for post-quantum encryption support. The checker proves support by negotiating a supported ML-KEM hybrid key exchange in TLS 1.3 handshakes, including the wider ML-KEM hybrid list now supported by Go.

Examples: cloudflare.com, https://google.com, example.com:443

✓ good

Post-quantum encryption is in normal use

The endpoint selected X25519MLKEM768 in a normal TLS 1.3 handshake. Authentication remains classical.

Readiness details

Key establishment

Post-quantumi

Normal TLS selected X25519MLKEM768.

Authentication

Classicali

The server authentication key is ECDSA P-384.

Certificate chain

Classicali

The verified chain contains classical certificate signatures.

Deployment

Consistenti

Tested address-family paths produced equivalent readiness results.

TLS baseline

Healthyi

TLS 1.3 and certificate validation succeeded.

Harvest-now/decrypt-later: protected by the observed hybrid key establishment.

Connection details
Host
reelix.h4ck.me
Port
443
SNI
reelix.h4ck.me
TLS version
TLS 1.3
Cipher
TLS_AES_256_GCM_SHA384
ALPN
h2
HelloRetryRequest
no
OCSP stapled
no
SCTs
0

Key establishment

Normal: X25519MLKEM768 · PQ-only: X25519MLKEM768

Certificates

Verified chain

leafCN=reelix.h4ck.me
Public key
ECDSA P-384
Certificate signature
ECDSA-SHA384
Valid until
2026-11-21T14:45:59Z
verifiedCN=YE2,O=Let's Encrypt,C=US
Public key
ECDSA P-384
Certificate signature
ECDSA-SHA384
Valid until
2028-09-02T23:59:59Z
verifiedCN=Root YE,O=ISRG,C=US
Public key
ECDSA P-384
Certificate signature
ECDSA-SHA384
Valid until
2032-09-02T23:59:59Z
root_or_lastCN=ISRG Root X2,O=Internet Security Research Group,C=US
Public key
ECDSA P-384
Certificate signature
ECDSA-SHA384
Valid until
2040-09-17T16:00:00Z
View JSON / APIDownload JSON

API usage

Use the JSON endpoint for scriptable checks.

Request:

curl 'https://quantumhello.xyz/api/check?url=cloudflare.com'

Pretty-print or download the same schema with &pretty=1 or &download=1.

Response:

{
  "schema_version": "2",
  "grade": "good",
  "status": "supported",
  "checked_ip": "104.16.124.96",
  "control_probe": {
    "offered_curves": ["X25519MLKEM768", "SecP256r1MLKEM768", "SecP384r1MLKEM1024", "X25519", "CurveP256", "CurveP384", "CurveP521"],
    "negotiated_curve": "SecP256r1MLKEM768"
  },
  "pq_probe": {
    "offered_curves": ["X25519MLKEM768", "SecP256r1MLKEM768", "SecP384r1MLKEM1024"],
    "negotiated_curve": "SecP384r1MLKEM1024"
  }
}

Replace the host with any HTTPS hostname you want to check. Support means the checked address negotiated a supported ML-KEM hybrid, not necessarily the same one every time.