Free · Open source (MIT) · No signup
Find quantum-vulnerable cryptography in your code
pqc-check scans your codebase for RSA, ECDH, ECDSA and weak TLS. One command, runs locally, uploads nothing.
$ npx pqc-check .The threat
Harvest now, decrypt later
Attackers record your encrypted traffic today and store it. When quantum computers mature, Shor's algorithm breaks RSA and elliptic-curve crypto retroactively, so anything with a long shelf-life (health, financial, legal, IP) is already at risk.
What it finds
Every place your code trusts classical crypto
Graded by real-world risk — harvest-now-decrypt-later first, signature forgery next.
Key exchange & encryption
RSA, ECDH, X25519 and Diffie–Hellman — graded HIGH. Recorded today, decrypted once a quantum computer exists.
Digital signatures
ECDSA, Ed25519 and RSA signing — forgeable by a quantum adversary, so authenticity guarantees break.
Weak TLS configuration
ECDHE-RSA / DHE-RSA cipher suites and RSA/ECDSA certificate references in your server configs.
9 languages + config
Python, JavaScript/TypeScript, Go, Java/Kotlin, Rust, C/C++, Ruby, PHP — plus nginx, Apache and OpenSSL config files.
Runs locally, uploads nothing
A static scanner: it only reads the files you point it at. No account, no API key, no code leaves your machine.
CI-ready
SARIF 2.1.0 output for GitHub code scanning, plus exit codes that gate your pipeline on vulnerable findings.
Run it in seconds
No install, no config
One command scans the whole tree. Pipe SARIF into CI to fail builds on quantum-vulnerable code.
$ npx pqc-check .From finding to fix
Found vulnerabilities? Migrate in minutes
pqc-check shows you what to fix. Qpher gives you the quantum-safe primitives — ML-KEM-768 and ML-DSA-65 — as a simple API, with private keys that never leave Qpher's key service.
- 1
Scan
Run npx pqc-check . and see exactly which lines are quantum-vulnerable.
- 2
Get a free key
Sign up at portal.qpher.ai, no credit card, free tier included.
- 3
Migrate
Replace the flagged calls with qpher.encrypt() / qpher.sign(). Qpher manages the post-quantum keys.
# Before - pqc-check flags this HIGH
ct = public_key.encrypt(data, padding.OAEP(...)) # RSA, quantum-broken
# After - quantum-safe via Qpher (managed keys)
from qpher import Qpher
client = Qpher(api_key="qph_...")
result = client.kem.encrypt(plaintext=data) # ML-KEM-768Prefer to self-host? liboqs / Open Quantum Safe work too. Qpher is the managed option, not the only one.
Your code is one exit; your documents are the other
Migrate the flagged calls with a free Qpher API key, and protect the files your team sends outside with the Organization edition.
Stop shipping crypto a quantum computer can break
Scan free in one command. Migrate with a free Qpher API key.