2,244 bank websites. 44% negotiate post-quantum.

The gap is between countries

Outside the United States and Germany, which together make up more than half the sample, 55% of banks (524 of 957) already negotiate hybrid post-quantum key exchange on their public website. In the United States the figure is 63% (424 of 675). In Germany it is 7% (45 of 612).

The German number is not a sampling accident. For Germany the sample is close to a census: 688 of the 701 German banks listed on Wikidata with a website. Of the 612 that answered clearly, 557 support TLS 1.3 and still chose classical key exchange. Many German savings and cooperative banks run their websites through a small number of shared IT providers, so this may be a handful of configuration decisions rather than hundreds. We have not tested that explanation; we only measured the result.

Hybrid on the website is the easy part. It can arrive with a CDN or cloud load balancer without the bank changing anything. It says nothing about online banking, APIs, mobile apps, card links or internal systems — which is where the data with a long secrecy requirement actually travels.

Results by country

Countries with at least ten clear results, sorted by share. "Classical" means the server supports TLS 1.3 but chose a classical group although the hybrid group was on offer.

Country	Clear result	Hybrid PQ	Classical, TLS 1.3	TLS 1.2 or older	Share hybrid
Netherlands	25	23	2	0	92%
Chile	13	11	2	0	85%
United Kingdom	16	13	3	0	81%
Brazil	31	24	5	2	77%
Mexico	13	10	2	1	77%
Colombia	11	8	2	1	73%
Peru	17	12	4	1	71%
Sweden	27	19	7	1	70%
Spain	55	36	18	1	65%
Finland	17	11	4	2	65%
United States	675	424	213	38	63%
Denmark	36	22	14	0	61%
South Africa	15	9	2	4	60%
Philippines	17	10	5	2	59%
Switzerland	107	60	37	10	56%
France	11	6	4	1	55%
Poland	28	15	8	5	54%
Portugal	13	7	5	1	54%
Italy	58	30	24	4	52%
Argentina	21	11	7	3	52%
India	26	13	10	3	50%
Ghana	24	12	9	3	50%
Belgium	16	8	7	1	50%
Kenya	14	7	7	0	50%
Slovakia	12	6	6	0	50%
Nigeria	70	34	33	3	49%
Austria	44	21	16	7	48%
Indonesia	35	15	10	10	43%
Norway	79	26	52	1	33%
Germany	612	45	557	10	7%
Türkiye	34	1	17	16	3%
18 other countries (fewer than 10 each)	72	44	20	8	61%
All 50 countries	2,244	993	1,112	139	44%

Not counted: 203 websites did not complete a handshake from our vantage point, 66 were measured only once, returned no readable group, or failed in one of the two runs, and 3 gave different answers in two runs on the same day (next section).

Same website, different answer

3 banks answered hybrid in one run and classical in the next, between a few seconds and 25 minutes apart. Outside this sample, on websites we re-measured five to twelve times in the same week, the answer kept alternating. The pattern fits a load balancer where some front-end servers have the hybrid group enabled and some do not, for example while a cloud provider rolls the feature out gradually.

That matters for anyone reporting post-quantum readiness to a regulator or a board: the state of the website can change without anyone in the bank changing a setting, and it can change back. A single scan is a sample, not a status.

Method

Each website was contacted on port 443 with a TLS 1.3 ClientHello that offers the hybrid group X25519MLKEM768 (IANA 0x11EC) alongside classical groups, at least twice. The server chooses; we recorded what it chose. A result counts as clear only when two runs on the same day agree.

Hybrid PQ — the server selected X25519MLKEM768 in both runs.
Classical, TLS 1.3 — TLS 1.3 but a classical group in both runs, usually X25519, sometimes finite-field Diffie-Hellman or another elliptic curve.
TLS 1.2 or older — the server refused TLS 1.3 when offered. TLS 1.2 cannot carry hybrid key exchange at all.

Reproduce it

Our probe is stock OpenSSL 3.5, whose default ClientHello already offers the hybrid group first. The same command shows the result for one host:

echo | openssl s_client -connect example.com:443 -servername example.com 2>&1 | grep -E 'Negotiated TLS1.3 group|^ *Protocol'

Every run starts with a control: if cloudflare.com does not come back as X25519MLKEM768, the batch stops.

How the sample was chosen

Banks were taken from two public registers: Wikidata (entities that are a bank, with an official website, not dissolved), and for the United States also the FDIC list of insured institutions. A bank is in the sample if we measured its listed website. That is not a random sample: we measured countries in the order we were working through them, and in some countries only banks with a published contact address. Treat each country row as a description of the banks we measured, not of the national banking system.

No bank is named in this report. A minority of the banks in the sample, those with a published contact address, have received a short individual note from us with their own result. The full list of 2,516 websites and their results is kept unchanged; its SHA-256 is 9c8395cf6b37178d80d3686a81ae8361c1e2496aa689927a52feb9644c7c5446, so a later correction can be checked against what we measured here. Every figure on this page can be recomputed from the published rows (one per bank: country, result, date, number of runs; hostname removed).

Correction, 24 October 2026. Two websites (Denmark, United States) were listed as giving different answers in two runs on the same day. In each, one run returned no readable key-exchange group, which our tool had recorded as classical. They are now counted with the websites that returned no readable group. The headline figures do not change. SHA-256 of the list before this correction: 853f34d8ecd6ac2b51902e4b17f9c9d17deb34446080dd42c6e0a90a698d56d5.

Limitations — stated, not buried

One front door per bank. A public website is not an estate. A bank can serve classical key exchange on its marketing site and hybrid everywhere that carries real data — or the reverse.

One vantage point. We measured from Vietnam. A content delivery network can answer differently in another region, and 203 websites did not answer us at all, which may be geo-blocking rather than an outage.

The sample is uneven. 57% of the clear results are from two countries. Rows with a few dozen banks describe those banks only.

This report is vendor-authored. We sell cryptographic inventories that produce numbers like these. That is why the method and the command are above: so the number can be argued with rather than believed.

If you think we are wrong

Run the command on your own bank's website. If the answer differs from ours, write to us and we will publish the correction next to this page, as we did for Vol.1.