Is your code quantum-safe?
PostQuant scans your TLS endpoints and source code for quantum-vulnerable cryptography. Get a letter grade. Know your risk.
NIST says your encryption expires in 2030.
Harvest Now, Decrypt Later
Adversaries are collecting your encrypted data today. When quantum computers arrive, they'll decrypt everything. The clock started years ago.
The Deadline Is Real
NIST will deprecate RSA and ECC by 2030 and disallow them by 2035. Every organization using public-key cryptography needs to migrate. That's everyone.
Nobody's Ready
We scanned the world's top websites. Google, Apple, Chase, the FBI. The best score? C+. Nobody has deployed post-quantum cryptography.
We scanned the internet.
Here's what we found.
37 of the world's biggest sites. Banks. Governments. Security companies. The best score? C+. Nobody has deployed post-quantum cryptography.
These organizations have trillions of dollars in resources. None have deployed quantum-safe cryptography. Have you checked yours?
Scan your siteThe PostQuant Grading Scale
| Grade | Meaning | Who Gets This |
|---|---|---|
| A+ | All quantum-safe algorithms. PQC key exchange + signatures. | Nobody. Yet. |
| A | Quantum-safe with minor observations | Theoretically possible with hybrid PQC |
| B | Mostly safe, some moderate-risk items | Sites using AES-128 but PQC otherwise |
| C+ | Quantum-vulnerable, but best classical crypto (AES-256, SHA-384) | Google, Apple, Cloudflare, NSA |
| C | Quantum-vulnerable with some moderate items (SHA-256) | Amazon, GitHub, Chase, Meta |
| C- | Quantum-vulnerable with multiple moderate items (AES-128, TLS 1.2) | IBM, Oracle, Zscaler |
| D | Multiple quantum-vulnerable components | Legacy enterprise systems |
| F | Critical vulnerabilities + legacy protocols | TLS 1.1 or below, MD5, severely outdated |
+/- modifiers reflect classical crypto hygiene within each grade band. Fewer moderate findings = better modifier.
Check your quantum readiness in 30 seconds.
# Or run directly $ npx postquant scan yourdomain.com
# Scan multiple hosts $ postquant scan api.example.com app.example.com
# JSON output for CI/CD $ postquant scan example.com --format json
Requires Node.js 18+
Scan your source code for quantum-vulnerable crypto.
Detect RSA, ECDSA, DH, and other quantum-vulnerable algorithms across your codebase. Supports Python, JavaScript/TypeScript, Go, and Java.
# SARIF output for GitHub Code Scanning $ npx postquant analyze ./src --format sarif
# CycloneDX CBOM for compliance $ npx postquant analyze . --format cbom
# Filter by language $ npx postquant analyze . --language python --verbose
4 Languages
Python, JavaScript/TypeScript, Go, Java — 54 crypto detection patterns
4 Output Formats
Terminal, JSON, SARIF 2.1.0, CycloneDX CBOM 1.6
We scanned the world's most popular frameworks.
9 open source projects. 4 languages. Real results from PostQuant v0.2.0.
Scanned March 2, 2026. Run npx postquant analyze <path> to scan your own.
This is just the beginning.
March 2026
TLS Scanner CLI
LiveMarch 2026
Code Scanner + CBOM
LiveApril 2026
Migration Playbook
In ProgressMay 2026
Dashboard + Enterprise
PlannedJune 2026
CI/CD Integrations
PlannedStar us on GitHub to follow progress
Star PostQuantStay ahead of the deadline.
Get notified when new features drop. No spam.