What do the A–F grades mean?

Each CipherGap report grades a host A–F on its post-quantum readiness. An A means the host negotiates a hybrid post-quantum key exchange and uses strong, non-expiring certificates; lower grades flag classical-only TLS, weak public keys, or certificate problems that leave it exposed to harvest-now-decrypt-later attacks.

What does the post-quantum probe test?

CipherGap runs a live TLS 1.3 handshake and attempts the X25519MLKEM768 hybrid key exchange, which combines classical X25519 with the ML-KEM-768 post-quantum KEM. If the host completes it, traffic to that host is protected against future quantum decryption; if not, the session relies on classical cryptography alone.

Can I export a cryptographic bill of materials (CBOM)?

Yes. Every CipherGap scan report exports a CycloneDX 1.6 CBOM — the standard machine-readable cryptographic inventory NIST and CISA recommend for post-quantum migration planning. It lists the host's TLS protocol, key-exchange algorithm with its NIST quantum security level, and certificate algorithms as linked cryptographic assets. JSON, CSV, and PDF evidence exports are also included, free.

How do I read a CipherGap report?

Start with the overall A–F grade, then review the factor breakdown: hybrid post-quantum key exchange, certificate signature algorithm, public-key strength, and expiry. Each factor shows what was found in the live handshake and how it moved the grade.

SAMPLE REPORTS

See exactly what a scan returns

Real CipherGap output across the grade spectrum — the same readiness breakdown, findings, and downloadable evidence (JSON, CSV, CycloneDX CBOM) you get from a live scan.

Hybrid PQC enabled

TLS 1.3 negotiating X25519MLKEM768 with a healthy certificate.

pqc-ready.example

PQC key exchange ready

This host negotiates hybrid post-quantum key exchange — ahead of most of the internet. Its certificate authentication is still classical (RSA/ECDSA), which is expected on the public web today.

Readiness breakdown

PQC key-exchange readinessReady

Negotiates hybrid post-quantum key exchange (X25519MLKEM768).

Classical TLS hygieneReady

TLS 1.3 with a strong ECDSA certificate.

Quantum authentication readinessPartial

Certificate authentication is still classical (ECDSA-SHA256). Post-quantum certificate signatures are not yet broadly deployable on the public web — this is expected today.

What we found

check_circle

Key exchange

Pass

Hybrid post-quantum key exchange (X25519MLKEM768) is supported.

info

Certificate key

Info

ECDSA 256-bit, signed with ECDSA-SHA256.

Modern TLS, no PQC

TLS 1.3 and a strong certificate, but no post-quantum key exchange yet.

modern.example

Largely protected

Strong TLS posture with minor gaps. A few tweaks put this host fully in the quantum-safe zone.

Readiness breakdown

PQC key-exchange readinessNot ready

Only classical key exchange is offered — sessions are exposed to harvest-now-decrypt-later.

Classical TLS hygieneReady

TLS 1.3 with a strong ECDSA certificate.

Quantum authentication readinessPartial

Certificate authentication is still classical (ECDSA-SHA256). Post-quantum certificate signatures are not yet broadly deployable on the public web — this is expected today.

What we found

warning

Key exchange

High

Only classical key exchange is offered; sessions are exposed to harvest-now-decrypt-later.

Enable a hybrid PQC key exchange (e.g. X25519MLKEM768) on your TLS terminator.

info

TLS version

Info

Negotiated TLS 1.3.

info

Certificate key

Info

ECDSA 256-bit, signed with ECDSA-SHA256.

Certificate uses classical (quantum-vulnerable) cryptography; track PQC certificate availability.

TLS 1.2 only

TLS 1.2 with a standard RSA-2048 certificate and no PQC.

legacy12.example

Partially exposed

Traffic to this host can be captured today and decrypted once a cryptographically-relevant quantum computer exists.

Readiness breakdown

PQC key-exchange readinessNot ready

Only classical key exchange is offered — sessions are exposed to harvest-now-decrypt-later.

Classical TLS hygienePartial

TLS 1.2, RSA 2048-bit.

Quantum authentication readinessPartial

Certificate authentication is still classical (SHA256-RSA). Post-quantum certificate signatures are not yet broadly deployable on the public web — this is expected today.

What we found

warning

Key exchange

High

Only classical key exchange is offered; sessions are exposed to harvest-now-decrypt-later.

Enable a hybrid PQC key exchange (e.g. X25519MLKEM768) on your TLS terminator.

info

TLS version

Info

Negotiated TLS 1.2.

info

Certificate key

Info

RSA 2048-bit, signed with SHA256-RSA.

Certificate uses classical (quantum-vulnerable) cryptography; track PQC certificate availability.

Weak, expiring certificate

An undersized RSA-1024 certificate that is also close to expiry.

weakcert.example

Exposed

This host relies on cryptography that quantum computers are expected to break. Recorded traffic is at real risk.

Readiness breakdown

PQC key-exchange readinessNot ready

Only classical key exchange is offered — sessions are exposed to harvest-now-decrypt-later.

Classical TLS hygieneNot ready

Weak certificate key (RSA 1024-bit).

Quantum authentication readinessPartial

Certificate authentication is still classical (SHA256-RSA). Post-quantum certificate signatures are not yet broadly deployable on the public web — this is expected today.

What we found

warning

Key exchange

High

Only classical key exchange is offered; sessions are exposed to harvest-now-decrypt-later.

Enable a hybrid PQC key exchange (e.g. X25519MLKEM768) on your TLS terminator.

info

TLS version

Info

Negotiated TLS 1.3.

warning

Certificate key

Med

RSA 1024-bit, signed with SHA256-RSA.

Certificate uses classical (quantum-vulnerable) cryptography; track PQC certificate availability.

warning

Certificate expiry

Med

Certificate expires in 7 day(s).

Renew the certificate.

Legacy TLS 1.0

Obsolete TLS 1.0 — critically exposed to interception and downgrade.

ancient.example

Critically exposed

Everything sent over TLS here is vulnerable to “harvest now, decrypt later.” An adversary recording traffic today could read it the day quantum arrives.

Readiness breakdown

PQC key-exchange readinessNot ready

Only classical key exchange is offered — sessions are exposed to harvest-now-decrypt-later.

Classical TLS hygieneNot ready

Negotiated legacy TLS 1.0.

Quantum authentication readinessPartial

Certificate authentication is still classical (SHA256-RSA). Post-quantum certificate signatures are not yet broadly deployable on the public web — this is expected today.

What we found

warning

Key exchange

High

Only classical key exchange is offered; sessions are exposed to harvest-now-decrypt-later.

Enable a hybrid PQC key exchange (e.g. X25519MLKEM768) on your TLS terminator.

warning

TLS version

Med

Negotiated TLS 1.0.

Disable TLS 1.0/1.1 and require TLS 1.2 or higher (ideally TLS 1.3) on your TLS terminator.

info

Certificate key

Info

RSA 2048-bit, signed with SHA256-RSA.

Certificate uses classical (quantum-vulnerable) cryptography; track PQC certificate availability.

Run one against your own host.

Free, no signup required.

Scan a host free Create an account