Skip to content
PQC Portal
ไทย

Connection checker

PQC Connection Checker

Checks which key exchange your browser negotiated with this site's TLS connection.

Checking…

How it works

Your browserCloudflare edgeOriginthis site's filesClientHelloX25519MLKEM768, X25519ServerHelloX25519MLKEM768 ✓PQ hybridseparate hopGET /cdn-cgi/tracekex=X25519MLKEM768✓ X25519MLKEM768
  1. 1ClientHelloYour browser opens a TLS 1.3 connection and offers the key-exchange groups it supports, such as X25519MLKEM768 and X25519, each with a key share.
  2. 2Cloudflare picks a groupThe edge picks the strongest group both sides support. If that is X25519MLKEM768, this hop is protected by post-quantum hybrid key exchange.
  3. 3The page is deliveredCloudflare gets the page from the origin over a separate connection (for this site the files live on Cloudflare itself). The check covers only the browser ↔ Cloudflare hop.
  4. 4Reading the resultThis page requests /cdn-cgi/trace over the same connection. Cloudflare replies with the connection details, including kex=, which the checker shows.

Notes

The result describes the TLS connection between your browser and Cloudflare's edge, not the path to any other site. A VPN, proxy or corporate TLS inspection can change it.

Data comes from Cloudflare's /cdn-cgi/trace endpoint, fetched by your browser. Nothing is stored.