Scan a domain. No signup.

Every TLS endpoint found via Certificate Transparency and passive DNS, its cipher suites and key-exchange groups, certificate health, hybrid-PQC support, and a Mosca countdown of the confidentiality you're losing today.

The scanner backend (queued job + shareable report at /scan/[reportId]) is env-gated. Without QDAY_SCANNER_ENABLED keys it renders an illustrative result and a waitlist, a missing key is never a build failure.