{"attribution":"PQ Crypta PQC Readiness Scanner, https://pqcrypta.com/pqc-ready/","browser_key_exchange":[{"n":438,"name":"X25519MLKEM768"},{"n":149,"name":"x25519"},{"n":62,"name":"secp256r1"},{"n":13,"name":"secp384r1"},{"n":2,"name":"RSA key transport"},{"n":1,"name":"DHE 2048 bits"}],"capabilities":[{"evidence":"negotiated","n":438,"name":"Post-quantum key exchange","note":"The handshake a browser makes: X25519MLKEM768 and X25519 key shares, P-256 and P-384 listed.","of":665,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"browser"},{"evidence":"negotiated","n":585,"name":"TLS 1.3","note":null,"of":665,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"browser"},{"evidence":"accepted","n":436,"name":"Any standard ML-KEM group","note":"FIPS 203 ML-KEM alone or in an RFC 10024 hybrid.","of":579,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"server"},{"evidence":"accepted","n":436,"name":"X25519MLKEM768","note":null,"of":579,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"server"},{"evidence":"accepted","n":84,"name":"SecP256r1MLKEM768","note":null,"of":579,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"server"},{"evidence":"accepted","n":21,"name":"SecP384r1MLKEM1024","note":null,"of":579,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"server"},{"evidence":"accepted","n":4,"name":"ML-KEM-768 alone","note":null,"of":579,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"server"},{"evidence":"accepted","n":14,"name":"ML-KEM-1024 alone","note":"The only key establishment the CNSA 2.0 TLS profile admits.","of":579,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"server"},{"evidence":"accepted","n":149,"name":"Pre-standard Kyber still accepted","note":"X25519Kyber768Draft00 and its P-256 twin, marked OBSOLETE by IANA; no current browser offers them.","of":579,"own_domains":[],"own_n":0,"own_of":9,"section":"server"},{"evidence":"accepted","n":0,"name":"Experimental KEMs (OQS)","note":"Open Quantum Safe codepoints: research algorithms with no IANA assignment.","of":579,"own_domains":["api.pqcrypta.com","fated.org","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":6,"own_of":9,"section":"server"},{"evidence":"accepted","n":396,"name":"Insists on post-quantum","note":"Of servers accepting a standard ML-KEM group and a classical one: offered the classical group first, they still chose ML-KEM.","of":436,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"server"},{"evidence":"accepted","n":529,"name":"Chooses by its own preference","note":"Of servers accepting two or more groups: the same groups in the opposite order got the same choice.","of":574,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"server"},{"evidence":"accepted","n":12,"name":"ML-KEM-1024 when listed first","note":"Of servers accepting ML-KEM-1024: offered as a CNSA 2.0 client offers it, they chose it rather than a hybrid.","of":14,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"server"},{"evidence":"negotiated","n":26,"name":"TLS 1.3 only","note":null,"of":665,"own_domains":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":9,"own_of":9,"section":"versions"},{"evidence":"negotiated","n":639,"name":"TLS 1.2 still accepted","note":"TLS 1.2 has no post-quantum key exchange: a client pushed onto it gets classical.","of":665,"own_domains":[],"own_n":0,"own_of":9,"section":"versions"},{"evidence":"negotiated","n":65,"name":"TLS 1.1 still accepted","note":"Deprecated since 2021 (RFC 8996).","of":665,"own_domains":[],"own_n":0,"own_of":9,"section":"versions"},{"evidence":"negotiated","n":59,"name":"TLS 1.0 still accepted","note":"Deprecated since 2021 (RFC 8996).","of":665,"own_domains":[],"own_n":0,"own_of":9,"section":"versions"},{"evidence":"presented","n":3,"name":"ML-DSA certificate presented","note":"Asked for an ML-DSA-87, -65 or -44 signature, the server presented a post-quantum certificate.","of":663,"own_domains":["api.pqcrypta.com","pqc.pqcrypta.com","pqcrypta.com"],"own_n":3,"own_of":9,"section":"auth"},{"evidence":"presented","n":0,"name":"ML-DSA certificate from a public CA","note":"Of ML-DSA certificates presented: no public CA issues ML-DSA yet.","of":3,"own_domains":[],"own_n":0,"own_of":3,"section":"auth"},{"evidence":"completed","n":149,"name":"Post-quantum key exchange over QUIC","note":"Of servers that completed a QUIC handshake: HTTP/3 runs its own TLS stack and can differ from TCP.","of":163,"own_domains":["api.pqcrypta.com","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":7,"own_of":7,"section":"quic"},{"evidence":"published","n":96,"name":"HTTPS DNS record","note":null,"of":651,"own_domains":["api.pqcrypta.com","fated.org","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":5,"own_of":9,"section":"ech"},{"evidence":"published","n":16,"name":"ECH config published","note":null,"of":651,"own_domains":["api.pqcrypta.com","fated.org","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":5,"own_of":9,"section":"ech"},{"evidence":"completed","n":16,"name":"ECH accepted over TCP","note":"Of servers publishing an ECH config: a handshake with it completed.","of":16,"own_domains":["api.pqcrypta.com","fated.org","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":5,"own_of":5,"section":"ech"},{"evidence":"completed","n":14,"name":"ECH accepted over HTTP/3","note":"Of servers publishing an ECH config that answer HTTP/3.","of":14,"own_domains":["api.pqcrypta.com","fated.org","pqcrypta.com","pqpdf.com","stlweb.dev"],"own_n":5,"own_of":5,"section":"ech"}],"cnsa":{"meets":0,"of":665,"own_meets":["api.pqcrypta.com","pqc.pqcrypta.com","pqcrypta.com"],"own_of":9,"requirements":[{"n":583,"name":"TLS 1.3"},{"n":576,"name":"TLS_AES_256_GCM_SHA384"},{"n":14,"name":"Accepts ML-KEM-1024 on its own (no hybrid)"},{"n":12,"name":"Picks ML-KEM-1024 when a client lists it first"},{"n":0,"name":"Signs with ML-DSA-87, every certificate included"}]},"excluded":{"own_grades":{"A+":9},"self_operated":["api.pqcrypta.com","core.fated.org","fated.org","philibert.stlweb.dev","philibertsecurity.com","pqc.pqcrypta.com","pqcrypta.com","pqpdf.com","stlweb.dev"]},"generated_at":"2026-10-11T08:43:37.336417-05:00","grader_version":"2026.10.1","grades":{"A":12,"A+":10,"B":416,"C":1,"F":226},"ladders":[{"note":"A server whose group probes did not all get answers counts below \"Negotiates TLS 1.3\" only where what it accepted was seen, so the lower rungs are lower bounds.","rungs":[{"n":665,"rung":"Domains measured"},{"n":585,"rung":"Negotiates TLS 1.3"},{"n":438,"rung":"Accepts a standard ML-KEM group"},{"grade":"B","n":437,"rung":"Gives a browser ML-KEM"},{"grade":"A","n":22,"rung":"and TLS 1.3 only"},{"grade":"A+","n":10,"rung":"and insists on it, no Kyber draft"}],"technology":"ML-KEM for every browser"},{"rungs":[{"n":651,"rung":"DNS answered"},{"n":96,"rung":"Publishes an HTTPS record"},{"n":16,"rung":"with an ECH config"},{"n":16,"rung":"Accepted over TCP"},{"n":14,"rung":"and over HTTP/3"}],"technology":"Encrypted Client Hello"}],"license":"https://creativecommons.org/licenses/by/4.0/","movement":{"changes":0,"improvements":4,"regressions":7,"since":"2026-10-10T12:08:40.867238-05:00"},"own_domains":[{"cnsa2":true,"domain":"api.pqcrypta.com","ech":true,"experimental":true,"grade":"A+","key_exchange":"X25519MLKEM768","ml_dsa":true},{"cnsa2":false,"domain":"core.fated.org","ech":false,"experimental":false,"grade":"A+","key_exchange":"X25519MLKEM768","ml_dsa":false},{"cnsa2":false,"domain":"fated.org","ech":true,"experimental":true,"grade":"A+","key_exchange":"X25519MLKEM768","ml_dsa":false},{"cnsa2":false,"domain":"philibert.stlweb.dev","ech":false,"experimental":false,"grade":"A+","key_exchange":"X25519MLKEM768","ml_dsa":false},{"cnsa2":false,"domain":"philibertsecurity.com","ech":false,"experimental":false,"grade":"A+","key_exchange":"X25519MLKEM768","ml_dsa":false},{"cnsa2":true,"domain":"pqc.pqcrypta.com","ech":false,"experimental":true,"grade":"A+","key_exchange":"X25519MLKEM768","ml_dsa":true},{"cnsa2":true,"domain":"pqcrypta.com","ech":true,"experimental":true,"grade":"A+","key_exchange":"X25519MLKEM768","ml_dsa":true},{"cnsa2":false,"domain":"pqpdf.com","ech":true,"experimental":true,"grade":"A+","key_exchange":"X25519MLKEM768","ml_dsa":false},{"cnsa2":false,"domain":"stlweb.dev","ech":true,"experimental":true,"grade":"A+","key_exchange":"X25519MLKEM768","ml_dsa":false}],"probe_version":"2026.10.9-hrr","sample":{"domains":665,"enumerated":579,"first_scan":"2026-10-07T11:06:19.539716-05:00","last_scan":"2026-10-11T02:25:30.263299-05:00","not_enumerated":4},"server_first_choice":[{"n":426,"name":"X25519MLKEM768"},{"n":104,"name":"x25519"},{"n":27,"name":"secp256r1"},{"n":7,"name":"secp521r1"},{"n":4,"name":"SecP384r1MLKEM1024"},{"n":3,"name":"SecP256r1MLKEM768"},{"n":3,"name":"secp384r1"},{"n":2,"name":"MLKEM1024"},{"n":1,"name":"X25519Kyber768Draft00"},{"n":1,"name":"ffdhe4096"},{"n":1,"name":"x448"}],"success":true}