Skip to content
pqdoctor

Try it

Type a hostname, with a port if it isn’t 443 (mail.example.com:993). pqdoctor sends its seven hand-made TLS ClientHellos and reads only the server’s first reply. You get the verdict, the cause and the fix, the same report the pqdoctor CLI and Flarebox give.

Port 443 unless you add one · STARTTLS ports need the CLI · 2 to 20 seconds · handshake probes only · 10 checks a minute

What happens

Section titled “What happens”
  • It runs on Cloudflare’s network. The check is pqdoctor’s Rust engine compiled to WebAssembly, running in a Cloudflare Worker. It connects to your server the way Cloudflare’s edge reaches an origin.
  • Handshake only. Each probe stops at the server’s first reply, and no handshake completes. Two more connections read the certificate chain for ML-DSA, and one HEAD / reads the Server header.
  • Names on Cloudflare. Cloudflare’s edge already negotiates X25519MLKEM768 with browsers, so a name served by Cloudflare is reported as such. What’s left is the origin behind it: check the origin’s own hostname, or let Flarebox check every origin behind a zone.
  • Ports. 443 unless you add one. Any port that speaks TLS from the first byte works (465, 993, 995, 853, 636, 8443, 2053, …). Ports that start in plaintext and upgrade with STARTTLS are refused, because a Worker can’t hold that conversation before the hello: 21, 25, 110, 143, 389, 587, 3306, 3389, 5222 and 5432. Check those from your machine with pqdoctor host:port.
  • Limits. Public hostnames only, 10 checks a minute from one address. Results are kept for 10 minutes per host and port, so a repeat check is instant.

The grade, the report page and the badge

Section titled “The grade, the report page and the badge”

After a check on port 443, Try it also grades the whole domain: example.com and www.example.com, one letter from A+ to F, the same rules as pqdoctor grade. Full report → opens the domain’s report page.

  • Report page: pqdoctor.com/report/example.com/ shows the letter, why, the result for each endpoint with its fixes, and what wasn’t checked from here with the command that checks it. It also says which Cloudflare data centre ran the check and when. The first visit grades the domain. Check again makes a new grade, which counts as one check toward the limit.

  • What it covers: the web side only. A Worker can’t reach port 25, so mail isn’t checked and a grade from here is A at most. Run pqdoctor grade example.com from a server to include mail and reach A+. www is skipped when it doesn’t resolve, or when it has exactly the domain’s addresses (the same servers). A name served by Cloudflare counts as post-quantum, since the edge negotiates X25519MLKEM768. The origin behind it is listed as not checked.

  • Badge: put this in a README to show the grade:

    [![post-quantum grade](https://pqdoctor.com/badge/example.com.svg)](https://pqdoctor.com/report/example.com/)

    The badge only shows a grade that was already made, and viewing it never starts a check. When there’s no grade yet it says check, and the link opens the report page, which makes one. Grades are kept for 6 hours, the same everywhere.

Next

Section titled “Next”
pqdoctor CLIAny port, lists of thousands, SSH, QUIC and mail, the fix applied safely, and runs pushed to a fleet.
FlareboxEvery origin behind your Cloudflare zones checked daily, your organization's fleet, and fixes as reviewed changes.