DEV Community: Aditee Niraula

How to Determine If a Website is Quantum Threat Proof

Aditee Niraula — Sat, 25 Jul 2026 11:09:46 +0000

An easy tutorial to understand basic encryption by analyzing how a quantum computer can break it. Using free tools, this should take less than 20 minutes.

What to Know Before You Begin

In an earlier article, I described how and why quantum computers can break encryption on the internet and the subsequent roll-out of new, post-quantum cryptography, as a defense mechanism. This article is designed to be an active and practical appendage to that article. Here, you will have the opportunity to experience the quantum encryption threat by examining real websites.

You do not have to be a cryptography or security expert to do this. There are no complicated steps and this can be accomplished by anyone with basic computer skills. By the end of this you should be confident your ability to critically analyze a given website and understand where its vulnerabilities to quantum attacks lie, and communicate your findings to the public in a meaningful and simple manner.

What you'll need:

A web browser.
A terminal (Command Prompt or PowerShell on Windows, Terminal on Mac/Linux)
That's all. Everything in this guide is free, and there is no risky software installation.

A 30-second refresher

Secure website connections (the padlock in your browser) use TLS — the protocol behind HTTPS. TLS handles two main parts of secure connections:

For the first part, a server and a browser agree to use a shared secret to encrypt the rest of the session. Generally, this step has many forms of public-key cryptography. RSA and various forms of elliptict-curve cryptography (like ECDH) are most popularly used.
For the second part, a shared secret is used, and the remaining session data is encrypted using a symmetric encryption scheme, like AES.

The important part for our investigation is that the first step of the connection is quantum-vulnerable. When quantum computers are functional, RSA and ECDH will bite the dust, while AES will remain practically unbreakable, and therefore quantum-safe. Because of this, when we look at a website, we are asking “How does this website perform a key exchange, and what will a quantum computer be able to do about it?”

Let's go on!

Method 1 — The easy way (browser, no tools)

Have a look at what you have on hand.

Access any secure webpage, as an example, https://www.wikipedia.org.
Click on the padlock icon located in the address bar.
Look at the section "Connection is secure" → "Certificate details" (the wording is different based on the browser).

In the Public Key field or the Signature Algorithm, you will see something like the following:

RSA 2048 — encryption based on providing large numbers to the key. Quantum vulnerable.
ECDSA / EC (P-256) — vulnerable to the same quantum computing issue as above. Quantum-vulnerable.

What you just learned: the certificate is telling you about the public key algorithm used in the site, and right now it is almost always a quantum vulnerable one used either RSA or EC.

Method 2 — The detailed way (free online scanner)

A browser can give you some info, but a dedicated scanner can show you everything, including the key-exchange method.

Go to SSL Labs' free SSL Server Test (ssllabs.com/ssltest).
Enter a domain (you can use wikipedia.org or even your own page).
Wait for the scan to finish, then go to the "Cipher Suites" section.

Now your entries should look similar to this one:


TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

You can decode this entry, and it contains the following information:

ECDHE → the key exchange is done via Elliptic-Curve Diffie-Hellman. This is the quantum step in the chain of vulnerabilities.
RSA → the server's authentication employs RSA. Also quantum-vulnerable.
AES_256_GCM → the bulk data is encrypted by AES-256. This is considered quantum-safe.
SHA384 → the hashing algorithm. Safe.

You can identify which quantum computer would likely breach this cipher, namely ECDHE and RSA, while which component would remain safe, namely AES-256. This is a useful skill, seeing as most people are unable to even make sense of a cipher suite.

What you just learned: the ability to read a TLS cipher suite and determine which parts are quantum-safe bulk encryption and which parts are quantum-vulnerable key exchange and authentication.

Method 3 - The hands-on way (terminal with OpenSSL)

With this method, you move from “reader” to “inspector.” OpenSSL is a free tool that is pre-installed on most Mac and Linux computers, and is available for Windows.

Find out if you have it: Open your terminal and run openssl version. If it returns a version number, you are all set. If it does not, for Windows the easiest way is to run it in Git Bash that comes with Git for Windows, or install OpenSSL for Windows.

You can now connect directly to a website’s encryption layer and see what it negotiates. Run:

openssl s_client -connect wikipedia.org:443 </dev/null

This will print a wall of text. It may look daunting, but you should only look for a few lines that contain the following.

New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit

And somewhere in the negotiation details, look for:

Negotiated TLS1.3 group: X25519

Here’s how to interpret what you see.

Server public key is 2048 bit with an RSA certificate → is quantum authentication and is therefore vulnerable.
Negotiated group: X25519 → is the key-exchange method which is an elliptic-curve algorithm. This is also the prime quantum target.
TLS_AES_256_GCM → is quantum-safe bulk encryption.

You’ve done a security engineer’s job: you connected to a live server and found out what cryptography it’s using. You can now say, “X25519 is what a quantum computer would break first.”

What you learned: how to access a live server and find out what key-exchange group it’s using, which is the most quantum-relevant piece of information.

What "quantum-ready" would really mean

What would you hope to find as a post-quantum-ready server? A server that is post-quantum-ready does a hybrid key exchange — a combination of a traditional key exchange and a post-quantum key exchange. In a server key exchange group, this would look something like:


X25519MLKEM768

The MLKEM is the post-quantum key exchange algorithm that is combined with the standard key exchange X25519. If you see a group like this, you are looking at a server that is starting to defend against quantum computing.

Try this: run Method 3 against a few of the bigger company’s domains (in this case, a Cloudflare-securing domain). See what you find. Some will only support X25519, while others will support the new hybrid MLKEM. That difference is the entire migration, happening in real time, visible to you in one command.

You now have a simple, repeatable way to determine any website's quantum exposure.
1) Browser padlock. Check the certificate's public key algorithm. RSA / EC = vulnerable.
2) SSL Labs scan. Check cipher suites and find the key exchange method.
3) OpenSSL. Check the group set for key exchange.
4) Look for a hybrid 'MLKEM' group. That's a quantum-ready server.
Try it on your website, your employer's website, and your bank's website. You'll discover the same thing that the security teams are facing. Almost everything is quantum vulnerable, and the post-quantum migration has only just started.

Why this matters and how to apply it

The first step in solving a problem is knowing how to identify it. Running this audit and finding only classical algorithms (which you will almost always find) means you can use the following guidance:

It’s not an emergency, but it’s a deadline. Data protected by these algorithms can be obtained and stored for future use when quantum computers become available (this is referred to as "Harvest Now, Decrypt Later").
Monitor your vendors. Ask if the services you depend on have plans to post-quantum migrate. A number of large providers already have plans in place.
Look for hybrid key exchange in the tools, browsers, and servers you use. This will provide evidence that the upgrades are being implemented.

Overall, quantum computing will not be able to break the internet as it is being adjusted. Now you don't just know it's happening, you're able to prove it on every site in under five minutes!

Why Quantum Computers Could Break the Internet's Encryption and What's Replacing It

Aditee Niraula — Sat, 20 Jun 2026 04:43:23 +0000

The short version

Almost everything private you do online like logging into your bank, sending a message, entering a password, paying for something is protected by encryption. That encryption works because certain math problems are too hard for today's computers to solve in any reasonable amount of time.

Quantum computers change that assumption. A large enough quantum computer could solve some of those "too hard" problems quickly and break a big chunk of the encryption the internet relies on.

That machine doesn't exist yet. But the threat is already here, for a reason we'll explain. And the world's security agencies are already rolling out replacement encryption designed to survive quantum attacks. This article explains, what the threat is, why it matters today, and what's being done about it.

How encryption protects you right now

When you see the padlock in your browser, two different kinds of encryption are working together.
Symmetric encryption uses a single shared secret key to lock and unlock data. It's fast and strong. The catch: both sides need the same key so how do they agree on a secret key over the open internet without anyone seeing it?

Public-key encryption (also called asymmetric encryption) solves that. Everyone has two mathematically linked keys:

A public key they share openly, anyone can use it to lock a message to them.
A private key they keep secret, only it can unlock those messages.

The magic is that knowing the public key doesn't let you figure out the private key. This is what lets two strangers establish a secure connection without ever having met. The most common public-key systems are RSA and ECC (elliptic-curve cryptography), and they protect almost every secure website, VPN, and messaging app today.

Here's the key insight: public-key encryption is secure only because of one assumption that deriving the private key from the public key requires solving a math problem so hard it would take today's computers millions of years. For RSA, that problem is factoring a very large number into its prime components. Easy to multiply two big primes together; effectively impossible to reverse.

That single assumption is what quantum computers threaten.

What a quantum computer actually does differently

A normal computer stores information in bits, each either a 0 or a 1. It checks possibilities one effective path at a time.

A quantum computer uses qubit, which exploit two strange properties of quantum physics:

Superposition — a qubit can represent a blend of 0 and 1 at the same time, so a group of qubits can encode an enormous number of combinations simultaneously.
Entanglement — qubits can be linked so they act as a coordinated system rather than independent parts.

The result isn't "a faster regular computer." It's a fundamentally different machine that can attack certain specific problems by exploring many possibilities in a coordinated way, instead of plodding through them one by one.

Crucially, quantum computers are not better at everything. They're dramatically better at a small set of problems and, unluckily for us, the math behind RSA and ECC is on that list.

The two algorithms that change the game

Two known quantum algorithms are the reason cybersecurity experts are paying attention.

Shor's algorithm — the serious threat.
In 1994, mathematician Peter Shor showed that a sufficiently powerful quantum computer could factor large numbers (and solve the related elliptic-curve problem) efficiently. That's precisely the "impossible" problem RSA and ECC depend on. In plain terms: Shor's algorithm would break the public-key encryption protecting the internet today. Not weaken it but actually break it.

Grover's algorithm — the manageable threat.
Grover's algorithm speeds up brute-force searching, which affects symmetric encryption (like AES). But it only provides a "square-root" speedup roughly, it halves the effective strength. The fix is simple: use bigger keys. AES-256 remains considered safe against quantum attacks. So symmetric encryption survives with minor adjustments; it's public-key encryption that needs replacing.

So, the headline is narrower and more precise than "quantum breaks everything": quantum computers primarily break the public-key encryption used to set up secure connections, while symmetric encryption mostly survives by using larger keys.

Why this is a problem today, not in 20 years

The obvious objection: today's quantum computers are small and error-prone. Experts estimate it may be a decade or more before one is powerful enough to run Shor's algorithm against real keys. So why worry now?

The answer is a strategy called “Harvest Now, Decrypt Later."

An attacker doesn't need a quantum computer today to benefit from one tomorrow. They can record encrypted data now intercepted traffic, stolen encrypted databases, captured communications and simply store it. When a capable quantum computer eventually exists, they decrypt everything they saved.

This matters enormously for any data that must stay secret for years: medical records, state secrets, financial data, intellectual property, and the long-lived encryption keys baked into hardware and infrastructure. Data you send today could be decrypted in ten years. For a lot of sensitive information, that's well within its required secrecy lifetime.

That's why governments and major companies are migrating now, before the threat is live. The migration itself takes years, so waiting for the quantum computer to arrive is already too late.

The fix: post-quantum cryptography

The solution is post-quantum cryptography (PQC) new public-key encryption algorithms built on math problems that both regular and quantum computers find hard. PQC runs on the ordinary computers and phones we already use; it doesn't require any quantum hardware. It simply swaps the underlying math for something Shor's algorithm can't unravel.

Most leading PQC schemes are based on problems involving structured lattices. Think of a vast multidimensional grid where finding the shortest path or nearest point is brutally hard to do in reverse, even for a quantum computer.

In 2024, the U.S. National Institute of Standards and Technology (NIST) finalized the first official PQC standards after an eight-year worldwide competition. The headline algorithms:

ML-KEM (originally called Kyber) — for securely establishing shared keys, the job RSA/ECC do today during connection setup.
ML-DSA (originally Dilithium) and SLH-DSA (SPHINCS+) — for digital signatures, which prove authenticity and integrity.

These are now real, published standards. Major platforms have already started deploying them. For example, modern versions of secure messaging and web browsers have begun using hybrid schemes that combine a traditional algorithm with a post-quantum one, so you're protected even if one of them is later found weak.

What this means for you and your organization

You don't need to panic, and you don't need a quantum physics degree. But if you work in or around technology, here's the practical takeaway:

Awareness is the first step. Quantum is no longer science fiction in security circles, it's an active migration project at every serious institution.
Inventory your cryptography. Organizations are being advised to find out where and how they use public-key encryption, because you can't replace what you can't see. This is the unglamorous but essential first move.
Prioritize long-lived secrets. Data that must remain confidential for many years is most exposed to "Harvest Now, Decrypt Later," so it should migrate first.
Favor "crypto-agility." Build systems so the encryption algorithm can be swapped out without rebuilding everything. The lesson of this whole episode is that no algorithm is forever.
Adopt the standards, don't invent your own. The NIST PQC standards exist precisely so individual teams don't roll their own. Use vetted libraries.

The takeaway

Quantum computing isn't going to break the internet overnight, and the sky is not falling. But it represents a rare event in cybersecurity: a predictable future threat, visible years in advance, against which we can prepare deliberately rather than react in a panic.

The story is genuinely optimistic. We understood the threat (Shor's algorithm) decades before the machine to exploit it exists. We ran a global, open competition to design defenses. And we now have published, standardized, deployable replacements. The remaining work is migration — careful, large-scale, and already underway.

The internet's encryption is being quietly rebuilt to survive the quantum age. Now you have the context to understand the shift and keep your third eye vigilant.