Monthly report · · 2026-W46
State of post-quantum TLS: November 2026
Key findings
- 61.2% of the 1,000 most visited websites negotiate hybrid post-quantum key exchange (X25519MLKEM768), up 1.9 points from the previous week.
- Across the top 10,000 the share is 60.6% (4,393 of 7,254 measured sites).
- 23 of 84 European banks and central banks outside Germany, Austria and Switzerland still use classical key exchange only (27.4%).
- In the DACH region, 5 of 17 measured banks and central banks are classical-only.
- Hosting decides more than size: on Amazon's EC2 network (AS14618) only 6.5% of sites are post-quantum ready, against 60.4% on AS16509, where CloudFront and AWS load balancers live.
- 21 sites switched to post-quantum key exchange this week, including inmobi.com, cnbc.com, airbnb.com, latimes.com; 2 switched back.
Charts
By group
| Group | Measured | Post-quantum |
|---|---|---|
| Top 1,000 websites (Tranco) | 689 | 61.2% |
| Top 10,000 websites (Tranco) | 7254 | 60.6% |
| Government (Germany, Austria, Switzerland) | 9 | 88.9% |
| Banks and central banks (DACH) | 17 | 70.6% |
| Large companies (DACH) | 20 | 90.0% |
| Banks and central banks (Europe, outside DACH) | 84 | 72.6% |
Government (Germany, Austria, Switzerland): 1 classical-only hosts
Banks and central banks (DACH): 5 classical-only hosts
www.bawag.at · www.comdirect.de · www.commerzbank.de · www.raiffeisen.at · www.zkb.ch
Large companies (DACH): 2 classical-only hosts
Banks and central banks (Europe, outside DACH): 23 classical-only hosts
www.abnamro.nl · www.bancaditalia.it · www.bancobpm.it · www.bcl.lu · www.bde.es · www.belfius.be · www.boursobank.com · www.bper.it · www.cnb.cz · www.credit-agricole.fr · www.creditmutuel.fr · www.csas.cz · www.kb.cz · www.millenniumbcp.pt · www.mnb.hu · www.mps.it · www.op.fi · www.otpbank.hu · www.pekao.com.pl · www.pkobp.pl · www.santander.pl · www.spuerkeess.lu · www.suomenpankki.fi
By hosting network (at least 100 sites)
| Network | Sites | Post-quantum |
|---|---|---|
| Cloudflare, Inc. (AS13335) | 2010 | 97.3% |
| Amazon.com, Inc. (AS16509) | 1464 | 60.4% |
| Fastly, Inc. (AS54113) | 343 | 82.8% |
| Google LLC (AS396982) | 266 | 84.2% |
| Amazon.com, Inc. (AS14618) | 263 | 6.5% |
| Akamai International B.V. (AS20940) | 241 | 98.8% |
| Google LLC (AS15169) | 232 | 98.7% |
| Akamai Technologies, Inc. (AS16625) | 182 | 92.3% |
| Microsoft Corporation (AS8075) | 144 | 41.0% |
| Cloudflare London, LLC (AS209242) | 121 | 100.0% |
This week's movers
21 sites switched to post-quantum key exchange; the ten largest among the top 10,000:
inmobi.com #460 · cnbc.com #483 · airbnb.com #809 · latimes.com #916 · fidelity.com #1999 · administracionelectronica.gob.es #2160 · vervegroupinc.net #3486 · zoho.eu #4109 · mehrnews.com #6050 · kerala.gov.in #6183
Methodology
Every week we connect to port 443 of each site in the Tranco top 10,000 and of each watch-list host (banks, central banks, government sites, large companies), on its first public IPv4 address from a single server. We offer the hybrid group X25519MLKEM768 next to classical groups, as current browsers do, and record which group the server chooses. A site counts as post-quantum when it negotiates X25519MLKEM768. Sites that did not answer, or where a firewall prevented us from seeing the choice, are excluded from the percentages. Pornographic and gambling sites are excluded and not scanned; the next-ranked sites take their place in the weekly sample, so "top 1,000" and "top 10,000" mean the sites in those Tranco ranks without them. This measures key exchange on one public connection only: not certificates, internal links or the origin behind a CDN.
How to cite
Quantum Aether, "State of post-quantum TLS: November 2026", 2026-11-10. https://ather-quantum.com/reports/2026-11 (CC BY 4.0)Report data (JSON) · Full weekly dataset (CSV) · Press and data · Tracker