Use Cloudflare Radar’s Post-Quantum Encryption host test to check a public hostname: enter the hostname and TLS port (443 by default), then look for the negotiated hybrid key-agreement group X25519MLKEM768. The result describes the handshake Radar initiated, not every connection your visitors make. To check a particular visitor-facing connection, inspect its negotiated key agreement in the browser; if your site uses a CDN or reverse proxy, assess the visitor-to-edge and edge-to-origin TLS connections separately.
Run a check against the hostname and port you actually use
- Choose the endpoint. Identify the public hostname and TLS port for the service you want to assess. Radar uses port 443 by default; enter another port if that is where the TLS service listens.
- Open Radar’s host test. Go to Cloudflare Radar’s Post-Quantum Encryption page, enter the hostname and, if needed, the port, and start the check. Radar initiates a TLS handshake with that host and examines the key exchange negotiated for that connection. Cloudflare announced the host checker on February 27, 2026. Cloudflare’s announcement describes the feature.
- Read the group name, not just a pass/fail label. Look for
X25519MLKEM768, the hybrid group recommended in Cloudflare’s documentation. A support check and a live negotiated result are not interchangeable: Radar’s origin scanner checks whether an origin supports the group, not whether it has configured that group as its preference.
Check a specific browser connection
If you need to know what a particular browser negotiated with the site, inspect that active connection rather than relying on the browser’s general compatibility. In Chrome, open DevTools, select the Security tab, and inspect the connection’s key-agreement information. Cloudflare documents this as one way to view the negotiated key agreement. The result applies to that browser-to-endpoint session; other browsers, clients, endpoints, or connection conditions can produce a different result. See Cloudflare’s post-quantum cryptography documentation.
As an Amazon Associate I earn from qualifying purchases.
Know what a positive result establishes
It establishes hybrid key agreement for the tested handshake
X25519MLKEM768 combines classical X25519 elliptic-curve key exchange with ML-KEM, the post-quantum key encapsulation mechanism selected by NIST. In this hybrid agreement, TLS combines shared secrets from the two components. Cloudflare describes the design as retaining X25519 protection while adding the post-quantum component. The documented hybrid groups require TLS 1.3-based protocols, including HTTP/3. Cloudflare’s documentation was marked last updated July 3, 2026.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteIt does not establish that the site’s certificate or signature is post-quantum
The handshake’s key agreement is separate from the certificate and signature used to authenticate the site. Cloudflare treats post-quantum signatures and certificates as a distinct migration area, with different deployment coverage. A positive hybrid key-agreement result should not be described as proof of a post-quantum certificate. Cloudflare’s post-quantum overview discusses the separate areas.
#1 Best Overall
Do not treat an obsolete draft group as the current recommendation
Cloudflare marks X25519Kyber768Draft00 obsolete. If a tool reports it, do not describe that draft name as equivalent to the currently recommended X25519MLKEM768.
For a CDN or reverse proxy, check both TLS legs
A CDN that terminates TLS creates separate connections: the visitor negotiates TLS with the CDN edge, and the CDN may establish another TLS connection to your origin. A positive result for visitor-to-edge says nothing by itself about edge-to-origin. Check each leg using the appropriate endpoint or provider telemetry.
Rank #2
For Cloudflare customers, visitor-to-Cloudflare key-exchange groups can be inspected in HTTP Traffic Analytics and logs; origin-connection visibility is available separately in logs. Cloudflare says its TLS 1.3 websites and APIs support hybrid post-quantum key agreement when the client also supports it. The origin’s own support matters for the origin leg; Cloudflare also documents Cloudflare Tunnel as an option for connecting legacy origins. See Cloudflare’s documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
If you see a classical group or no post-quantum result
- Confirm the endpoint and port. Check that the test targeted the hostname and TLS service you intended, rather than another hostname, port, CDN edge, or origin.
- Confirm the protocol. The documented hybrid groups require TLS 1.3-based protocols. A connection using an older protocol will not negotiate them.
- Check the client capability. A server can support a hybrid group while a particular browser or non-browser TLS client does not offer it. Cloudflare notes that classical groups or an absence of observed post-quantum traffic can reflect clients lacking compatible TLS 1.3 or hybrid-group support.
- Separate support from actual negotiation. A scanner that checks support can report capability even when its own handshake or a visitor’s handshake negotiates another group. Compare what the tool measures before treating results as contradictory.
- For proxied sites, identify the leg. Establish whether the result describes visitor-to-edge or edge-to-origin, then check the other connection independently.
Interpret traffic statistics within their scope
Cloudflare Radar displays live figures for HTTPS requests served through Cloudflare and for daily scans of Cloudflare customer origins. Those measures cover Cloudflare traffic and scanned customer origins, not all websites on the internet. They are also different populations and metrics, so a displayed percentage is meaningful only with its date range, geography, population, and metric. Aggregated traffic need not be entirely post-quantum even when a service supports hybrid negotiation with compatible clients.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
