Skip to content
pqdoctor

Introduction

pqdoctor checks whether a server negotiates post-quantum TLS. If it doesn’t, pqdoctor works out why and prints the fix for that server’s software. Flarebox is a desktop app for Cloudflare (Windows and Linux) that runs pqdoctor against every origin behind your zones, keeps the history, and manages local Workers projects and your Cloudflare account.

v0.2.1 Windows · macOS · Linux MIT

The problem

Section titled “The problem”

Browsers already speak post-quantum key exchange to Cloudflare: about 70% of browser-generated traffic does (Cloudflare, 2026-09-29). The origin servers behind it mostly don’t. Cloudflare says “just about 15%” of the origins it connects to use hybrid ML-KEM, on the same date.

Knowing that a server isn’t post-quantum doesn’t tell its owner what to change. The reasons are specific: a TLS library that predates ML-KEM, a hand-written curve list, TLS 1.2 only, or a load balancer that drops large ClientHellos. Each has a different fix. pqdoctor finds which one applies.

What’s in the box

Section titled “What’s in the box”
What it is Runs on
pqdoctor CLI Checks one host, a list of thousands, a mail server over STARTTLS, or an SSH server. Prints a verdict, a cause code and the fix. JSON output for scripts Windows, macOS 11+, Linux (x86_64 and arm64)
Flarebox Desktop app: local Workers projects, deploys, your Cloudflare zones through the API, and pqdoctor on every origin with history, fix reports, a CBOM and deadlines Windows 10/11 x64, Linux x86_64
GitHub Action Fails a build when a host you list isn’t post-quantum GitHub Actions (not published yet)
pqdoctor on Workers The same engine compiled to WebAssembly, on Cloudflare Workers Cloudflare Workers (not deployed yet)

All four use the same Rust engine, so they give the same verdict, cause and fix for the same server.

Start here

Section titled “Start here”
Check a server in 2 minutesDownload the pqdoctor CLI, run it, read the result.
Install FlareboxThe Windows app: install it, add your projects, connect Cloudflare, check your origins.
Post-quantum TLS in 5 minutesKey exchange vs authentication, ML-KEM, ML-DSA, and why large hellos break things.
DownloadsFlarebox and the pqdoctor CLI, their checksums, and how to verify them.

How these docs are organized

Section titled “How these docs are organized”
  • Get started: install, first run, and the background you need.
  • pqdoctor: how the check works, how to read a report, task guides (scanning, mail, SSH, ML-DSA, CI, scripting), every cause with its fix, and the reference (CLI, JSON schema, probes).
  • Flarebox: installing, then a guide per area of the app (local development, deploys, your Cloudflare account, post-quantum), the security model, and reference pages for settings, files and permissions.
  • The study: a measured sample of 4,616 origin servers, how it was built, and how accurate pqdoctor is.
  • Resources: FAQ, glossary, privacy, the changelog, and sources.

Status

Section titled “Status”

Version 0.2.1 was released on 2026-10-16. What’s been verified against real servers and a real Cloudflare account, and what has only run against a fake API, is on What’s proven.