---
title: "Is your domain using post-quantum encryption? Now you can see for yourself"
description: "Cloudflare introduced new post-quantum cryptography visibility tools in its Application Security and Logs products, including Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard, to help customers monitor encryption adoption. These tools surface the key exchange algorithm negotiated on every incoming request, enabling customers to audit their post-quantum posture, assess compliance, and identify cryptographic gaps across their domains. The primary post-quantum algorithm in TLS 1.3 is X25519MLKEM768, a hybrid of classical ECDHE over curve X25519 and the post-quantum ML-KEM, which provides belt-and-suspenders security against harvest-now-decrypt-later attacks. Cloudflare Radar data shows about 70% of browser-generated traffic uses post-quantum encryption on the visitor-to-Cloudflare connection, but only 15% of origin connections to Cloudflare use hybrid ML-KEM. For legacy origin servers that cannot support modern post-quantum cryptography, Cloudflare Tunnel can tunnel traffic over TLS 1.3 with X25519MLKEM768 without requiring any upgrade to the origin server itself."
---

# Is your domain using post-quantum encryption? Now you can see for yourself

[Cloudflare](https://yomu.fyi/company/cloudflare) · Sharon Goldberg · Sep 29, 2026

**Type:** Announcement

## Summary

Cloudflare introduced new post-quantum cryptography visibility tools in its Application Security and Logs products, including Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard, to help customers monitor encryption adoption. These tools surface the key exchange algorithm negotiated on every incoming request, enabling customers to audit their post-quantum posture, assess compliance, and identify cryptographic gaps across their domains. The primary post-quantum algorithm in TLS 1.3 is X25519MLKEM768, a hybrid of classical ECDHE over curve X25519 and the post-quantum ML-KEM, which provides belt-and-suspenders security against harvest-now-decrypt-later attacks. Cloudflare Radar data shows about 70% of browser-generated traffic uses post-quantum encryption on the visitor-to-Cloudflare connection, but only 15% of origin connections to Cloudflare use hybrid ML-KEM. For legacy origin servers that cannot support modern post-quantum cryptography, Cloudflare Tunnel can tunnel traffic over TLS 1.3 with X25519MLKEM768 without requiring any upgrade to the origin server itself.

## Context

Customers need domain-level visibility into post-quantum encryption adoption to comply with regulatory deadlines around 2030 and protect against harvest-now-decrypt-later attacks. Previously, only aggregate statistics were available via Cloudflare Radar, but per-domain data was missing.

## Approach / What changed

Cloudflare added a TLS Key Exchange card to the HTTP Traffic Analytics dashboard and exposed the key exchange algorithm field in Logpush and Log Explorer, enabling customers to see the percentage of traffic using post-quantum X25519MLKEM768 per domain. For legacy origins, Cloudflare Tunnel provides a path to use post-quantum encryption without upgrading the server.

## Takeaways

- Cloudflare’s new visibility tools expose the TLS key exchange algorithm per request in Logpush, Log Explorer, and HTTP Traffic Analytics, enabling domain-level post-quantum encryption auditing.
- Approximately 70% of browser traffic to Cloudflare uses post-quantum X25519MLKEM768, but only 15% of origin connections do, highlighting a gap in end-to-end protection.
- Legacy origin servers can be placed behind Cloudflare Tunnel to use TLS 1.3 with X25519MLKEM768 without upgrading the server itself.

## FAQ

### How can I check if my domain uses post-quantum encryption?

Go to the Cloudflare Dashboard, navigate to HTTP Traffic under Analytics, and find the TLS Key Exchange card showing the percentage of traffic using X25519MLKEM768. You can also use Logpush or Log Explorer to see the key exchange algorithm per request.

### What is the recommended post-quantum algorithm in TLS 1.3?

The recommended algorithm is X25519MLKEM768, a hybrid of ECDHE over curve X25519 and ML-KEM. It provides belt-and-suspenders security by combining classical and post-quantum key exchanges.

### What should I do if my origin server doesn't support post-quantum encryption?

Place the origin server behind Cloudflare Tunnel, which tunnels traffic over TLS 1.3 with X25519MLKEM768 without requiring any upgrade to the legacy origin server.

**Tags:** [Analytics](https://yomu.fyi/topic/analytics), [Cloudflare](https://yomu.fyi/topic/cloudflare), [Encryption](https://yomu.fyi/topic/encryption), [Post-Quantum Cryptography](https://yomu.fyi/topic/post-quantum), [TLS](https://yomu.fyi/topic/tls)

- Source: [Cloudflare](https://blog.cloudflare.com/post-quantum-visibility)
- Source URL: https://blog.cloudflare.com/post-quantum-visibility
- Ingested by Yomu: 2026-09-29T15:00:11.126Z

[Read original post](https://blog.cloudflare.com/post-quantum-visibility)