QuantumReadyFind cryptographic risks. Plan your quantum-safe migration.
QuantumReady reads your code as well as matching it, across repositories, containers, cloud and endpoints, works out what a quantum computer would break, and turns it into a migration plan you can defend.
No agent required · No signup for public scans · Runs inside your environment
Check a domain, or scan a public repository
The endpoint check performs a real TLS handshake and reports what the server negotiates. The repository scan returns a cryptographic bill of materials with the evidence behind every finding.
Three minutes on what is hiding in your estate
Where cryptography hides, how the engine reads it, and what the report gives you back.
Discover, assess, plan, prove
One platform across four steps, each one feeding the next.
Discover
Find cryptography across repositories, built artifacts, container images, cloud configuration and public endpoints.
Assess
Classify every finding against the standard quantum model, and place each one on an evidence ladder rather than guessing.
Plan
Prioritise by exposure and by what actually ships, then sequence the work into migration waves with owners.
Prove
Export an evidence pack with stated coverage limits, for a customer, an auditor or a procurement team.
Across the whole estate, not just the source tree
The OpenSSL that breaks your compliance story is rarely in a repository. It arrives through a base image, and a source-only scan never sees it.
Also read: cloud key and certificate configuration, and public endpoints, by performing the TLS handshake rather than trusting a header.
One engine. Run it here, or inside your own network.
The engine is what finds cryptography: the rules, the syntax reading, the ownership and action model, and the score. A scanner is where the engine runs. There are two, they share detection rules, and a test on every release fails the build if they ever drift apart.
| Hosted scan | Offline scanner | |
|---|---|---|
| Where it runs | On our Cloudflare deployment. Nothing to install. | On your machine, from one download. Nothing is uploaded unless you say so. |
| What it reaches | Public repositories, and private ones through a linked account. Public endpoints. | Anything you can reach from inside: private forks, build artifacts, container images, cloud and server configuration, and hosts behind Cloudflare. |
| Reading the code | Yes. Eleven language families are parsed, not only matched, on the plans that cover it. The other eleven of the twenty-two are matched by pattern. | Yes, the same twenty-two families: the eleven parsed ones, plus every file rather than the candidates a hosted scan can afford. |
| What leaves your side | The repository is read by us while the scan runs. The report is stored for your retention period. | Reports only, when you choose to upload. Reports include file paths and source excerpts; review them before sharing. |
| Both give you | A cryptographic inventory, who owns each fix, prioritised actions, a CycloneDX CBOM, and the limits of the scan in writing. | The same report format and risk model. Findings and scores depend on plan capabilities, scan limits and the files each scan reaches. |
The two run the same rules and, since this release, the same syntax reading. Release tests compare shared fixtures. Hosted scans have smaller budgets and plan-dependent parsing, so a full repository can produce different findings offline. How the engine works.
From thousands of findings to the twenty that matter
A scan of a real Java library returned 1,668 findings across 47 algorithms. What a team needs is the short list, in the right order.
Findings
Every match, with the file and line behind it.
Algorithms
Distinct primitives, classified against the quantum model.
Actions
Prioritised, each carrying the reason for its position.
Every finding is explainable
The same shape for all of them: where it is, why it matters, what replaces it, and the evidence.
- Found in
payments/src/crypto/SigningService.java:218- Why it matters
- RSA rests on factoring. Shor's algorithm breaks it outright, at every key size.
- Recommended migration
- ML-DSA or SLH-DSA for signatures, ML-KEM for key transport, hybrid while the ecosystem catches up.
- Evidence
- Likely used in production code, and used in 22 places across 9 files
Built for Singapore's quantum-safe transition
Source: the CSA Quantum-Safe Handbook V1, published 16 July 2026, and directed at Critical Information Infrastructure owners and government agencies. If you supply them, the same questions reach you through procurement.
Separately, MAS circular MAS/TCRS/2024/01 of 20 February 2024 expects financial institutions to hold a cryptographic inventory and build crypto-agility. Full timeline with sources.
Measured accuracy, published continuously
Every scanner claims coverage. We publish precision and recall against a fixed corpus with hand written answers, measured on every release, plus live totals from real scans.
Precision
Loading the last measurement...
Start free, pay when you need your own code
Public endpoint and public repository scans are free and need no account. Private repositories, longer retention, shareable links and the applications rollup need a plan.
Prefer it done for you?
Some organisations want the findings reviewed by a person before they go anywhere near a customer or an auditor. That is available separately from the plans.
Readiness assessment
A limited-scope assessment across a small number of applications, with human review of every material finding and a migration roadmap.
Comprehensive discovery
Full discovery across repositories, built artifacts, container images and infrastructure inputs, with a cryptographic bill of materials and an evidence pack.
Continuous monitoring
Scheduled rescans, change history, and refreshed evidence for management, auditors and procurement.
Pilot pricing for the plans and the services, to be tested with prospective customers. Not a market benchmark.
See what is hiding in your cryptography estate
Two minutes on a public repository or a public domain, and you will know what the report looks like on your own code.