Methodology: Post-quantum TLS checks
Post-quantum TLS readiness
- Conditions
What we test. Whether a website's server agrees to the hybrid post-quantum key exchange X25519MLKEM768 in a TLS 1.3 connection to its hostname on port 443.
What counts as a value. Yes, when our TLS 1.3 test connection negotiates X25519MLKEM768; No, when the server chooses a classical key exchange (the group it chose is shown); with the date of the test. Each result needs two connections that agree.
What it is not. One TLS connection to one hostname: another server or network of the same site can answer differently, and the result does not describe the organization's security as a whole. A post-quantum key exchange does not make the certificate post-quantum; certificate signatures are a separate step. QUIC, ECH and other post-quantum groups are not tested. A provider's own claim is shown only where we quote it from the provider's public page.
When a value is Unknown. When the connection does not complete or the two connections disagree. Unknown is never shown as No.
How often. Every host is tested once a day.
Hybrid TLS Adoption Watch. The share of hosts with a valid result on the date that negotiated X25519MLKEM768, overall and by category, with the number of hosts (N). The hosts are an editorial selection of prominent websites, banks, public bodies, CDN companies and webmail providers — not a traffic ranking or a random sample.
Version. Version 1 of this method, in effect since 27 September 2026; description revised 15 October 2026.
- Coverage
- On : 60 hosts.
- Region
- Switzerland