Is your website ready for post-quantum cryptography?
Scan your public HTTPS endpoints and get a scored assessment report: key exchange, TLS version, ciphers and certificates, with clear next steps.
Access is by API key issued by evoAI. Informational assessment only; scan only systems you are authorised to test.
Sample result (illustrative)
Public CAs do not yet issue post-quantum certificates, so the two warnings are expected for every public site.
Encrypted traffic recorded today can be read later.
Attackers can store encrypted traffic now and decrypt it once quantum computers are powerful enough. Hybrid ML-KEM key exchange, standardised by NIST as FIPS 203, closes that gap, and many sites already support it. The question is whether yours does, on every address you serve.
What the assessment report covers
Every endpoint is tested individually, IPv4 and IPv6, and the evidence is shown so you can verify each result.
Key exchange
Whether the server accepts hybrid ML-KEM, confirmed with a browser-like handshake. Carries the most weight in the score.
TLS version and ciphers
TLS 1.3 support, whether old versions are still accepted, and the strength of the negotiated cipher.
Certificate and signature
The key type and signature algorithm of your certificate, and how they fit the post-quantum timeline.
Score and next steps
A 0 to 100 readiness score, findings per target, and a prioritised list of what to fix first.
PDF report
Download a full report with the scoring method, or a brief one for routine sharing.
Dashboard and API
Use the web dashboard for one-off scans, or the API to check your endpoints on a schedule.
How it works
From domain name to report in three steps.
Get your access key
Send the request form and evoAI issues an API key for the scanner.
Scan your domains
Enter the hostnames you want assessed. The scanner resolves every address and tests each one.
Review and download
Read the findings and next steps, then export the PDF or CSV.
Common questions
How do I get access?
The scanner uses API keys issued by evoAI. Request one using the form, then enter it in the scanner dashboard or send it in the X-API-Key header when using the API.
Why is the best score 79 and not 100?
Full marks on certificate checks need a post-quantum certificate, and publicly trusted CAs do not issue them yet. The report shows the score against what is achievable today.
Is this a compliance audit?
No. It is an informational technical assessment of what your servers offer at scan time. It does not certify compliance with any standard.
Can I scan any website?
Only systems you own or are authorised to test.
Will the score change over time?
Standards and browser support are moving quickly, so the scoring rules are reviewed regularly. Each report states the scanner version and when the standards data was last reviewed.
Request your PQC Readiness Assessment Key
Tell us who you are and which domains you want assessed. We will send you an API key for the scanner.
Prefer email? info@evoaiglobal.ai