What does the free quantum risk scan check?

It reads only what a browser already sees during a public TLS handshake: the certificate's key type and length, the signature algorithm, and the protocol versions a server will negotiate. From that it derives a PQC-readiness score, a risk tier, and your regulatory exposure. No login, and nothing is stored.

Why is an RSA-2048 certificate a quantum risk?

RSA and elliptic-curve cryptography rely on factoring and discrete-log problems that Shor's algorithm solves efficiently on a cryptographically-relevant quantum computer. Data captured today can be decrypted later once such a machine exists — the harvest-now, decrypt-later problem.

Is the scan safe and non-intrusive?

Yes. The scan performs a standard, read-only TLS handshake against a public endpoint — the same negotiation any web browser performs. It does not log in, send payloads, or probe internal systems, and the request is transient.

Quantum Risk Scan — Is Your Domain's TLS Quantum-Safe?

What the scan actually does

Reads the handshake

We negotiate a standard TLS connection — exactly what your browser does — and read the certificate and protocol versions the server offers. Read-only, no login.

Scores the exposure

The platform maps each algorithm against Shor's and Grover's reach, weighs harvest-now-decrypt-later risk, and returns a PQC-readiness score and risk tier.

Maps the mandate

Findings are tied to the Indian regulatory bodies — CERT-In, DST / NQM, RBI — that now expect a documented post-quantum migration roadmap.

We only read what is publicly negotiated in a TLS handshake — no login, nothing stored. The full per-asset migration plan, signed CBOM, dependency graph and board PDF are delivered with your report.

Beyond a single domain

Your scan reads one domain. The console maps the whole estate.

The free scan inspects one site's public TLS handshake. Inside KavachQ, every scan folds into a single, deduplicated inventory of the certificates and algorithms you run — each one scored, tiered, and mapped to its post-quantum replacement. These are real console screens, captured on a demo tenant; the numbers are illustrative and client identifiers are omitted.

KavachQ console — CBOM map plotting each estate asset as a node coloured by quantum risk: vulnerable, weakened, or quantum-safe. — **The estate as a CBOM.** Each certificate and algorithm you run, plotted by quantum risk — vulnerable, weakened, or already quantum-safe.

KavachQ console — crypto dependency graph linking application risk tiers to the vulnerable algorithm families they depend on. — **Crypto dependency graph.** Which applications, grouped by risk tier, lean on which quantum-vulnerable algorithm families.

Captured from the working KavachQ console on a demo tenant · illustrative data · client identities blurred or omitted.

Scan your domain, get the full report

Or explore the full console →

Is your website quantum-safe?

Where should we send it?

Thank you — we've got it.

Reads the handshake

Scores the exposure

Maps the mandate

Your scan reads one domain. The console maps the whole estate.