Most developers assume post-quantum cryptography (PQC) is a problem for the future. It isn't.

The challenge isn't just replacing vulnerable algorithms like RSA or ECDSA—it's first discovering where they're hiding across millions of lines of code, dependencies, binaries, certificates, and infrastructure.

That's the problem we set out to solve with PQCScanner.

Quantum computers will break today's encryption

The modern internet relies heavily on cryptographic algorithms such as RSA, ECDSA, and Diffie-Hellman. Their security depends on mathematical problems that are computationally infeasible for classical computers.

Quantum computers change that equation.

Using Shor's algorithm, a sufficiently powerful quantum computer could factor large integers and solve discrete logarithm problems efficiently, rendering many widely deployed public-key cryptographic systems insecure. TLS handshakes, SSH keys, JWT signing, code signing, and encrypted communications would all be affected.

This is no longer theoretical planning.

In August 2024, NIST finalized its first set of post-quantum cryptography standards:

• ML-KEM (Kyber) for key encapsulation
• ML-DSA (Dilithium) for digital signatures
• SLH-DSA (SPHINCS+) for stateless hash-based signatures

Governments and enterprises worldwide are already planning migrations toward standardized post-quantum cryptography.

For many organizations, the practical first step is hybrid cryptography, combining classical and post-quantum algorithms while software ecosystems continue to mature.

The "Harvest Now, Decrypt Later" threat is already here

Attackers don't need quantum computers today to benefit from them tomorrow.

Sensitive encrypted traffic can be intercepted and archived now with the expectation that future quantum computers will decrypt it later. This strategy is commonly known as Harvest Now, Decrypt Later (HNDL).

If your organization protects information that must remain confidential for many years—financial data, healthcare records, intellectual property, or government communications—the migration timeline matters today.

Unlike Y2K, this isn't a switch you can flip overnight.

The biggest challenge isn't migration—it's discovery

Migrating from RSA to a post-quantum alternative is often straightforward once you've identified where cryptography is used.

The difficult question is:

Where exactly is cryptography being used across all of our repositories and infrastructure?

Cryptographic assets appear in many places:

• Source code (hashlib.md5(), crypto/rsa, Cipher.getInstance("DES"))
• Third-party dependencies and packages
• YAML configuration files and TLS settings
• SSH keys and X.509 certificates
• PKCS#12 keystores and GPG keyrings
• JAR files, Python wheels, Docker images, and native binaries

Manual reviews don't scale.

Simple grep searches generate noise.

Without visibility, planning a migration is nearly impossible.

Introducing PQCScanner

We built PQCScanner as a free, self-hosted platform for discovering cryptographic assets and tracking post-quantum migration readiness.

Instead of manually auditing repositories, teams can scan projects in minutes and build an inventory of cryptographic exposure across their software supply chain.

What PQCScanner scans

Multi-language source code

PQCScanner supports more than 15 programming languages and detects over 26 cryptographic patterns, including:

• Weak hashing algorithms such as MD5 and SHA-1
• Legacy ciphers including DES, RC4, and Blowfish
• Quantum-vulnerable public-key algorithms such as RSA, ECDSA, ECDH, and X25519

Each finding is classified by severity and migration relevance.

Dependencies and binary artifacts

Cryptography isn't limited to source code.

PQCScanner also analyzes:

• requirements.txt
• package.json
• go.mod
• pom.xml
• JAR files
• Python wheels
• Docker images
• ELF, PE, and Mach-O binaries
• RPM, DEB, and APK packages

Secrets and certificates

Repositories frequently contain cryptographic assets that are overlooked during migration planning.

PQCScanner detects:

• Embedded private keys
• TLS certificates
• SSH keys
• PKCS#12 keystores
• GPG keyrings

Example finding

# Source file: auth/password.py

hashlib.md5(password.encode()).hexdigest()

# Finding
Algorithm: MD5
Severity: HIGH
Quantum Status: Vulnerable
Recommendation: Replace with SHA-256 or SHA-3

Generate a Cryptographic Bill of Materials (CBOM)

Every finding contributes to a CycloneDX 1.5-compliant Cryptographic Bill of Materials (CBOM).

Organizations can export reports in JSON or CSV format for compliance reporting, governance, audits, or integration with existing security workflows.

Reducing false positives intelligently

Static pattern matching alone creates excessive noise.

PQCScanner combines multiple techniques to improve accuracy:

• Path-based exclusion for test fixtures, vendor code, and examples
• Call-graph reachability analysis to determine whether vulnerable code is actually reachable
• Local AI-assisted validation using an LLM running entirely inside your environment

Because AI validation is performed locally, sensitive source code never leaves your infrastructure.

Measuring crypto agility

Beyond detection, PQCScanner evaluates how prepared a repository is for migration.

Each project receives a maturity score ranging from Level 1 (minimal PQC readiness) to Level 5 (high crypto agility), based on factors such as abstraction layers, algorithm diversity, and test coverage.

CI/CD integration

PQCScanner integrates directly into development pipelines.

Teams can configure quality gates that prevent pull requests from introducing new quantum-vulnerable cryptography and enforce organization-specific security policies.

Runtime monitoring

Static analysis only tells part of the story.

An optional eBPF-based runtime agent monitors live cryptographic operations and can detect dynamically loaded cryptographic usage that source scanning may miss.

Network scanning

PQCScanner can also inspect TLS endpoints to inventory:

• Certificate algorithms
• Supported protocol versions
• Cipher suites

This helps organizations understand cryptographic exposure beyond application code.

What PQCScanner does not do

PQCScanner discovers cryptographic assets and identifies migration risks.

It does not automatically rewrite applications or replace algorithms. Engineering teams should evaluate migration strategies—including hybrid deployments and PQC-only approaches—based on their own operational and compliance requirements.

A practical roadmap to PQC migration

Successful migrations typically follow these steps:

1. Discover cryptographic assets.
2. Build an inventory of algorithms, keys, and certificates.
3. Prioritize high-risk systems.
4. Improve crypto agility through abstraction.
5. Pilot hybrid post-quantum deployments.
6. Replace vulnerable algorithms using standardized alternatives.
7. Continuously monitor for regressions through CI/CD and runtime analysis.

PQCScanner accelerates the discovery, inventory, and prioritization phases while helping teams measure ongoing progress.

Getting started

git clone https://github.com/VipinPS/PQCScanner.git
cd PQCScanner
docker-compose up -d

Then open http://localhost:5173, add a repository, and launch your first scan.

The complete platform—including the FastAPI backend, React frontend, PostgreSQL, Redis, and local AI validation through Ollama—runs entirely with Docker Compose.

The migration window is closing

Post-quantum migration starts with visibility.

You can't replace what you can't find.

By discovering cryptographic assets today, organizations can build realistic migration plans, reduce long-term risk, and prepare for the quantum era before it arrives.

PQCScanner is open source and licensed under Apache 2.0. Contributions, bug reports, documentation improvements, and new detection patterns are always welcome.

GitHub: https://github.com/VipinPS/PQCScanner

Documentation: https://VipinPS.github.io/PQCScanner

Start scanning today. Understand your cryptographic exposure. Be ready before Q-Day.