Is Your Node.js App Quantum-Safe? Tracing PQC in TLS Connections

Post-Quantum Cryptography (PQC) is no longer a distant concern — it is happening now. Google Chrome, Cloudflare, and major cloud providers have already started deploying hybrid post-quantum key exchange in TLS connections. But how do you actually verify, from code, that your Node.js HTTPS requests are using quantum-safe cryptography? That is exactly what pqc-tracer solves. What Is Post-Quantum Cryptography (PQC)? Classical public-key cryptography — RSA, ECDH, and elliptic curve algorithms like X25519 — relies on mathematical problems (factoring large numbers, discrete logarithm) that are computationally hard for classical computers. A sufficiently powerful quantum computer running Shor's algorithm can solve these problems efficiently, breaking the confidentiality of any TLS session secured by these algorithms. Post-Quantum Cryptography refers to algorithms believed to be resistant even against quantum computers. NIST standardized several PQC algorithms in 2024, most notably: ML-KEM (Mo