Press and data
Quantum Aether measures every week how many websites, banks and public bodies already protect their HTTPS connections with post-quantum key exchange. Figures, charts and data on this page are free to use with attribution.
Latest figures (November 2026)
- 61.2% of the 1,000 most visited websites negotiate hybrid post-quantum key exchange (X25519MLKEM768), up 1.9 points from the previous week.
- Across the top 10,000 the share is 60.6% (4,393 of 7,254 measured sites).
- 23 of 84 European banks and central banks outside Germany, Austria and Switzerland still use classical key exchange only (27.4%).
- In the DACH region, 5 of 17 measured banks and central banks are classical-only.
- Hosting decides more than size: on Amazon's EC2 network (AS14618) only 6.5% of sites are post-quantum ready, against 60.4% on AS16509, where CloudFront and AWS load balancers live.
- 21 sites switched to post-quantum key exchange this week, including inmobi.com, cnbc.com, airbnb.com, latimes.com; 2 switched back.
Charts and data
- Post-quantum key exchange by group (SVG)
- Post-quantum key exchange by hosting network (SVG)
- Post-quantum key exchange by country-code domain (SVG)
- Report data (JSON)
- Full weekly dataset (CSV)
Why it matters
Encrypted traffic recorded today can be decrypted once large quantum computers exist ("harvest now, decrypt later"). The hybrid key exchange X25519MLKEM768 combines a classical algorithm with ML-KEM, standardised by NIST in FIPS 203 in 2024, and closes that gap for new connections. Chrome and Firefox already offer it; whether a connection is protected depends on the website's server.
Methodology
Every week we connect to port 443 of each site in the Tranco top 10,000 and of each watch-list host (banks, central banks, government sites, large companies), on its first public IPv4 address from a single server. We offer the hybrid group X25519MLKEM768 next to classical groups, as current browsers do, and record which group the server chooses. A site counts as post-quantum when it negotiates X25519MLKEM768. Sites that did not answer, or where a firewall prevented us from seeing the choice, are excluded from the percentages. Pornographic and gambling sites are excluded and not scanned; the next-ranked sites take their place in the weekly sample, so "top 1,000" and "top 10,000" mean the sites in those Tranco ranks without them. This measures key exchange on one public connection only: not certificates, internal links or the origin behind a CDN.
Terms of use
All figures, charts and data are published under CC BY 4.0. Please cite "Quantum Aether" and link to the report. Figures in a published monthly report do not change afterwards; live figures are on the adoption tracker.
Contact
Questions about the data or method: see the contact details in the Impressum