Browser TLS & HTTP/3 Test
Does your browser use TLS 1.3, HTTP/3, Encrypted Client Hello and post-quantum keys?
Your connection to this site
Testing your connection…
What the network between you and this site can see
Visible
Hidden
About the Browser TLS & HTTP/3 Test
Every HTTPS page you open is protected by a TLS handshake, but how well depends on your browser, your system and the network in between. This test looks at the real connection your browser made to this site and reads four things from it: the TLS version, the HTTP version (HTTP/3 runs over QUIC), whether the site name was hidden with Encrypted Client Hello (ECH), and whether the keys were agreed with a post-quantum key exchange such as X25519MLKEM768.
This site offers all four, so anything missing comes from your side: an older browser, a setting or company policy, a network that blocks QUIC, or security software or a proxy that inspects HTTPS. Each result says which, with the steps for your browser.
How to use it
- Open the page: the test runs at once and takes a second or two.
- Read the summary, then the four results: green is up to date, amber could be better.
- Follow the steps under any amber result, then press Test again. HTTP/3 often appears on the second test, after the browser has learnt that the site offers it.
- Use Copy report to send the result to whoever manages your device or network.
Examples
Current Chrome, Edge or Firefox on an ordinary home connection
TLS 1.3, HTTP/3, Encrypted Client Hello on, key exchange X25519MLKEM768.
The same browser on a work network with an HTTPS-inspecting proxy
Often TLS 1.2 or a classical key exchange (X25519, P-256), ECH off and HTTP/2: the proxy makes its own connection to the site.
Some public Wi-Fi networks and VPNs block UDP port 443
HTTP/2 instead of HTTP/3, also after Test again; the other three results are not affected.
Common uses
- Checking that a browser update or a new device turned on post-quantum key exchange and ECH.
- Finding out whether a company proxy, antivirus or VPN is handling your HTTPS connections.
- Seeing whether your network lets HTTP/3 (QUIC) through.
- Giving an IT team a precise report of what a device’s connections use.
What the four results mean
- TLS version: TLS 1.3 (RFC 9846) is current. TLS 1.2 is acceptable with good settings; TLS 1.0 and 1.1 are deprecated (RFC 8996).
- HTTP version: HTTP/3 (RFC 9114) runs over QUIC on UDP (RFC 9000); HTTP/2 (RFC 9113) runs over TCP. Both are fast; HTTP/3 copes better with lost packets.
- Encrypted Client Hello (RFC 9849): the browser encrypts the name of the site in the handshake, with a key the site publishes in its HTTPS DNS record (RFC 9848). Without it, the name travels readable.
- Key exchange: X25519MLKEM768 combines the classical X25519 with ML-KEM-768, a post-quantum algorithm (RFC 10024), so traffic recorded today cannot be decrypted later by a quantum computer. X25519Kyber768Draft00 is its pre-standard forerunner, which browsers have replaced.
Where browsers stand
- Chrome: ECH on by default from version 117 (Chrome Platform Status); ML-KEM key exchange from 131, Kyber before that. On managed devices, the policies
EncryptedClientHelloEnabled,PostQuantumKeyAgreementEnabledandQuicAllowedcan turn these off (Chrome Enterprise policies). - Microsoft Edge: the same three policies (Edge policy documentation).
- Firefox: ECH from version 119 (release notes); mlkem768x25519 from 132 (release notes), over HTTP/3 from 135.
- Apple: iOS 26, iPadOS 26, macOS Tahoe 26 and visionOS 26 offer X25519MLKEM768 in TLS 1.3 (Apple support). On iPhone and iPad, every browser uses Apple’s networking.
What the network can still see
TLS hides the pages you open, what you type and your cookies. The network between you and a site still sees the site’s IP address and how much data you exchange. ECH also hides the site name from the TLS handshake; your DNS lookups can still show it unless your browser or system uses encrypted DNS (DNS over HTTPS or over TLS).
How the test works
The page asks this site for the report its servers write about the connection they received (the TLS version, HTTP version, whether the name came encrypted, and the key exchange), and asks a public DNS-over-HTTPS resolver for the site’s HTTPS record, to know what the site offers. Your browser’s own timing data adds the HTTP version it used. Nothing is installed and nothing is stored.
Limitations
- The result is for the connection to this site. Sites that do not offer HTTP/3, ECH or post-quantum key exchange connect without them, whatever your browser supports.
- Behind a proxy or inspecting security software, the result describes the proxy’s connection to the site, not your browser’s.
- Browsers keep connections open: after changing a setting, restart the browser before testing again.
Privacy
Sends data to online services
Your browser asks this site for its own report on the connection it received, and a public DNS-over-HTTPS resolver for this site’s HTTPS record. No other site is contacted.
Frequently asked questions
Why does it say HTTP/2 when my browser supports HTTP/3?
A browser learns that a site has HTTP/3 during its first connection and uses it from a later one, so press Test again. If it still says HTTP/2, your network probably blocks UDP port 443 (some company and public networks and VPNs do), or QUIC is turned off by a setting or policy.
Is my connection unsafe if ECH or post-quantum key exchange is off?
No: with TLS 1.2 or 1.3 the content stays encrypted. ECH only hides which site you opened from the network, and post-quantum key exchange protects against a future quantum computer decrypting traffic recorded today. Both add protection on top; neither is needed for the content to be encrypted.
Why is ECH off although I use a current browser?
The browser needs the site’s HTTPS DNS record to encrypt the name. Some networks’ DNS resolvers and filters do not pass those records on; turning on secure DNS (DNS over HTTPS) in the browser can fix that. A VPN, proxy or security software that inspects HTTPS also removes ECH.
Does the test send my data anywhere?
Your browser connects to this site, as for any page, and asks a public DNS resolver for this site’s HTTPS record. The report is shown on the page only; nothing about it is stored.