⚡ Post-Quantum QUIC & HTTP/3 Analyzer
Full-stack QUIC & HTTP/3 analysis — post-quantum hybrid TLS, QUIC v1/v2, multipath, WebTransport, MASQUE, certificate chain & performance metrics
🚀 Analyze QUIC & HTTP/3 Security, Post-Quantum TLS & Performance
HTTP/3 with QUIC and WebTransport delivers faster page loads and mandatory TLS 1.3 encryption. Our scanner uses native QUIC libraries to extract real peer-advertised metadata, from transport parameters and HTTP/3 SETTINGS to certificate chains and post-quantum key exchange, and grades every site on a 5-tier scale (A++, A+, A, C, F). Curious how a scan actually works on the wire? Read Anatomy of a QUIC Connection, our whitepaper that replays one real scan packet by packet.
Full analysis coverage: every metric the scanner extracts
The scanner extracts detailed metadata including real peer-advertised QUIC transport parameters, HTTP/3 SETTINGS (QPACK, Extended CONNECT, datagrams), server implementation fingerprinting (identifying Cloudflare, Google GFE, Facebook mvfst, Fastly H2O, and more), connection metrics (handshake time, TTFB, RTT, GSO, probe timeouts), certificate chain analysis (OCSP stapling, Certificate Transparency, root CA), and TLS extension analysis. The 5-tier grading requires post-quantum hybrid key exchange for the top tier and produces intelligent per-scan recommendations.
- HTTP/3 and QUIC protocol detection with native noq/h3 QUIC libraries (multipath-capable); QUIC v1/v2 (RFC 9369) and Version Negotiation detection, TLS 1.3
- Post-quantum hybrid key exchange detection (e.g. X25519MLKEM768), required for the A++ grade tier
- Server fingerprinting: Identifies Cloudflare, Google GFE, Facebook mvfst, Fastly H2O, and more
- QUIC transport parameters: real peer-advertised flow control, stream limits, GREASE bit, connection migration, preferred address
- HTTP/3 SETTINGS: QPACK dynamic table, Extended CONNECT, WebTransport, datagrams, RFC 9218 Extensible Priorities (real active PRIORITY_UPDATE test)
- Connection metrics: handshake time, TTFB, RTT (including real minimum), GSO detection, ACK frequency, probe timeout count
- Certificate chain analysis: OCSP stapling, Certificate Transparency/SCT, root CA, delegated credentials, PQC-signed certs
- TLS extension analysis: ALPN protocols, key share groups, ECH support, certificate compression, 0-RTT early data
- WebTransport capability testing: datagram support/size, flow control, stream limits, session-open latency (ports 443, 4433, or custom)
- MASQUE CONNECT-UDP (RFC 9298) detection with real UDP-over-HTTP/3 relay verification
- draft-ietf-quic-multipath capability probe with genuine cryptographic second-path validation
- DNS HTTPS record (RFC 9460 type 65) fully parsed: alpn, port, ECH and IP hints, with the scan following any non-standard UDP port the record steers browsers to
- Cross-protocol content comparison: the same URL fetched over HTTP/1.1, HTTP/2 and HTTP/3 and SHA-256 hashed, with a control fetch and per-request-token normalization (CSP nonces, CSRF tokens, timestamps) so even dynamic sites get a definitive answer on whether content differs by transport path
- Alt-Svc header analysis and 0-RTT replay attack risk assessment
- Intelligent, context-aware recommendations with 3-tier fingerprinting confidence scoring
Analysis target: by default, the exact hostname you enter — the analyzer grades that host's own response and does not follow redirects. If a site redirects (e.g. example.com → www.example.com, or to a different domain), HTTP/3 may live on the target, not the apex. Enable Follow redirects — the checkbox above — to instead analyze the final destination; the result clearly shows which host was actually analyzed.
Try these examples:
?url=pqcrypta.com
/pqcrypta.com
Enter URL above
📊 Scan Results live
🏆 A++ (0)
Ultimate: HTTP/3 + QUIC + 0-RTT disabled + WebTransport enabled. Maximum security & features.
✅ A+ (0)
Excellent: HTTP/3 with QUIC protocol. 0-RTT disabled for maximum security.
⚡ A (0)
Good: HTTP/3 with QUIC protocol. 0-RTT enabled (replay attack risk).
⚠️ C (0)
Misconfigured: HTTP/3 enabled but not accessible. Missing Alt-Svc header.
❌ F (0)
Failed: No HTTP/3 support detected. Using legacy HTTP/2 or HTTP/1.1 protocols only.
What is HTTP/3 and QUIC?
HTTP/3 is the latest version of the Hypertext Transfer Protocol (RFC 9114), standardized by the IETF in June 2022. Unlike HTTP/1.1 and HTTP/2 which run over TCP, HTTP/3 uses QUIC (Quick UDP Internet Connections) as its transport layer. QUIC operates over UDP with mandatory TLS 1.3 encryption built directly into the transport protocol, delivering 30-50% faster page loads, improved mobile performance, and enhanced security compared to traditional TCP-based protocols.
⚡ Performance Benefits
Faster Connections: QUIC combines the cryptographic handshake with connection establishment (1-RTT), compared to TCP+TLS requiring 2-3 round trips. 0-RTT resumption enables instant reconnection for repeat visitors. Zero Head-of-Line Blocking: Independent streams prevent one slow resource from blocking others, critical for modern web applications with hundreds of assets.
🔒 Security & Privacy
Mandatory Encryption: Unlike HTTP/2 where TLS is optional, HTTP/3 requires TLS 1.3, the most secure version with forward secrecy and modern cipher suites. Transport Metadata Protection: QUIC encrypts packet numbers, connection IDs, and other transport metadata that TCP exposes in plaintext, defending against traffic analysis, fingerprinting, and network-level attacks.
📱 Mobile & Reliability
Connection Migration: Unique connection IDs allow seamless handoff when switching networks (Wi-Fi ↔ cellular) without dropped connections or re-authentication. Improved Loss Recovery: Per-stream acknowledgments and more accurate RTT estimation provide better performance on lossy networks (mobile, satellite, public Wi-Fi). WebTransport: Bidirectional streaming over QUIC enables real-time applications like gaming, video conferencing, and collaborative editing.