Findings · 2026-11-03 · By VSNARY | Emmanuel Orta
Six in ten websites already use post-quantum encryption. Whether yours does mostly depends on one thing
We tested 1,295 websites for the post-quantum key exchange that protects today’s traffic from being decrypted later. 59.6% support it. Behind Cloudflare, 99.7% do; everywhere else, 44.8%.
On 3 November 2026, 772 of 1,295 reachable websites (59.6%) completed a TLS 1.3 handshake that offered only the post-quantum hybrid group X25519MLKEM768. Among sites that accept TLS 1.3, it was 772 of 1,194 (64.7%). The biggest factor was the network in front of the site: 349 of 350 sites behind Cloudflare supported it (99.7%), against 423 of 945 sites that were not (44.8%). By group: US local businesses 59.9%, software companies 62.8%, US government .gov sites 52.7%, wider web 58.9%.
Every HTTPS connection starts with the two sides agreeing a secret key. If someone records that traffic today, a sufficiently powerful quantum computer could one day recover the key and read it. Post-quantum key exchange closes that gap now: the key agreement mixes a classical method with ML-KEM, a method built to resist quantum attacks, so recorded traffic stays private even later. The question for a site owner is simple: does my site do it yet?
The measurement #
On 3 November 2026 we sent every site in a sample of 1,303 a TLS 1.3 handshake that offered only the hybrid group X25519MLKEM768. A completed handshake means the site supports it; a refusal means it does not. 1,295 sites answered. The sample has four groups: US local businesses, software companies, US government .gov domains and the wider web.
| Group | Sites supporting | Sites measured | Share |
|---|---|---|---|
| All sites | 772 | 1,295 | 59.6% |
| Behind Cloudflare | 349 | 350 | 99.7% |
| Not behind Cloudflare | 423 | 945 | 44.8% |
| US local businesses | 415 | 693 | 59.9% |
| Software companies | 93 | 148 | 62.8% |
| US government (.gov) | 29 | 55 | 52.7% |
| Wider web | 235 | 399 | 58.9% |
One thing decides most of it #
The sector a site belongs to barely matters: local businesses, software companies, government and the wider web all land between 53% and 63%. What matters is the network in front of the site. 349 of the 350 sites behind Cloudflare supported post-quantum key exchange; Cloudflare’s documentation says every site it serves over TLS 1.3 has supported it since October 2022, so the site owner did nothing to get it. Among the 945 sites not behind Cloudflare, 44.8% supported it: those sites got it from their own server software, hosting company or another network.
So for most small businesses, post-quantum protection is not a project. It arrives with the hosting or the CDN, or it does not arrive at all.
Check your own site #
- From a terminal with OpenSSL 3.5 or newer:
openssl s_client -connect example.com:443 -tls1_3 -groups X25519MLKEM768. A completed handshake means yes; a handshake failure means no. - If the answer is no and you use a CDN or managed host, ask them whether X25519MLKEM768 is available on your plan. If you run your own server, it comes with recent versions of the TLS library (OpenSSL 3.5 and later support it).
- Visitors need it too. The connection is only post-quantum when the visitor’s browser also offers the group, so a yes from your site protects visitors with current browsers.
How this was measured #
Each site was probed once from a network outside any CDN. The handshake offered TLS 1.3 and only the X25519MLKEM768 group, so it can only complete if the site agrees it. A site that does not accept TLS 1.3 counts as not supporting it. “Behind Cloudflare” means the site’s answer carried a cf-ray header. The local businesses come from OpenStreetMap, the software companies from Wikidata, the .gov domains from CISA’s public list and the wider web from the Tranco list and linked sites. The probe repeats weekly; the latest figures are on the TLS posture data page (CC BY 4.0). Site names are not published.
Share this finding:LinkedInXEmailFollow Emmanuel on LinkedIn
Questions this post answers
What share of websites support post-quantum encryption?
In CrawlCheck’s measurement of 3 November 2026, 772 of 1,295 websites (59.6%) completed a TLS 1.3 handshake using only the post-quantum hybrid group X25519MLKEM768; among sites that accept TLS 1.3 it was 64.7%.
Does Cloudflare support post-quantum key exchange?
Yes. 349 of 350 sites behind Cloudflare in the measurement supported X25519MLKEM768, and Cloudflare’s documentation says every site it serves over TLS 1.3 has supported post-quantum hybrid key agreement since October 2022.
How do I check if my website supports post-quantum TLS?
With OpenSSL 3.5 or newer, run openssl s_client -connect yoursite.com:443 -tls1_3 -groups X25519MLKEM768. If the handshake completes, the site supports it.
Related findings
The main product
Found this on your own site? We fix it for $100.
Scan free to see where you stand. The fix is one site, every finding implemented and re-measured, with a sealed before and after.
Free browser extension
Check this on any site you open, without leaving the page.
CrawlCheck for Chrome grades every site you visit A–F and shows, from your own browser, what search engines and AI assistants are actually served. Free, no account.
Write for the library
Measured something yourself? Submit an article.
Send your finding, the data and the method. A person reads every submission and replies by email; accepted articles are published under your name with a link to your study. Free to submit, and placement is never for sale.
How it works · a reply within about a week
Spotted a mistake or a bug on this page? Report an error. Confirmed errors are fixed and logged on the corrections page.
Comments
Comments are read before they appear. Nothing is published automatically, and no account is needed. An AI agent with a published signing key can post without the queue: it signs the request and the signature is checked against its own domain (how). Those appear at once, marked verified.
Writing about this? Facts, live figures and marks — every number on that page is dated and traceable to a scan.