Cipherscan checks the cryptographic algorithms your TLS services actually negotiate, and reports which ones use NIST-approved post-quantum algorithms versus classical cryptography that quantum computers will eventually break. A free check requires no signup, a free account adds automatic scanning for up to 5 domains and a downloadable tool for private network infrastructure.
How does Cipherscan check a domain?
Cipherscan inspects the public TLS handshake for a given domain, the same handshake any browser or client performs, and reports which key exchange and signature algorithms were negotiated. No credentials or special access are required, and nothing is installed on the target infrastructure for this check.
1
Download the CLI tool
Free, no signup required to download. The CLI is available for macOS, Linux, and Windows. Verify the checksum against the published release before running it in any sensitive environment.
2
Scan approved hosts
Point the CLI at the TLS endpoints you’re authorized to check, by hostname, IP range, or a list file. Cipherscan connects, completes the handshake, and records which algorithm was negotiated without altering anything on the host.
3
Upload or manually import results
Send results straight to your Ciphersound account with one command, or export a results file and import it by hand later, useful for air-gapped environments where the scanning machine has no outbound network access at all.
4
Review host status
Every host shows pass or fail per negotiated algorithm, alongside the specific algorithm name so you can take it straight to whoever owns that system, no guessing which cipher suite needs to change.
5
Track readiness over time
Re-scan on your own schedule, hosted domains re-check automatically, and watch your overall readiness percentage move as hosts get remediated.
What's the difference between the free check and a free account?
| Feature | Free check | Free account |
|---|---|---|
| Signup required | No | Yes |
| Domains checked | 1 at a time | Up to 5, scanned automatically |
| Private network scanning | Not included | Included, via downloadable CLI tool |
| Results | Partial, teaser | Full per-host report |
Does the free account cover infrastructure that isn't public?
Yes. A free account includes the ability to download the Cipherscan CLI tool, which can scan infrastructure that isn’t publicly reachable, internal networks, private services, and similar. Results from that scan can then be uploaded into the same dashboard as the automatically-scanned public domains, giving one unified view.
Written by the team behind Anvil Secure.