🔓 Open source · Apache 2.0 · pip install pqc-sandbox

See exactly what breaks
before you migrate to PQC

Point it at your real endpoint. It replays the TLS handshake with ML-KEM / ML-DSA sizes and shows you exactly which components will fail in production — with the fix for each one.

$ pqc-sandbox simulate api.mybank.com

Probing api.mybank.com:443 … TLSv1.3 · X25519 · ECDSA-P256 · MTU 1500

✗ BLOCKED — 3 breaks found · estimated fix: 6 days

BREAK 1 TLS certificate chain too large for proxies

ML-DSA-44 cert chain: 2,121B → 8,332B ⚠ exceeds 8KB nginx limit

Fix: ssl_stapling on + large_client_header_buffers 8 32k

BREAK 2 DNSSEC signatures exceed UDP limit (2,420B vs 1,232B cap)

BREAK 3 HSM firmware may not support ML-KEM-768 / ML-DSA-44

Each break: component · mechanism · evidence · blast radius · copy-paste fix

pip install pqc-sandbox → ⭐ Star on GitHub

🔒 Zero cloud. Zero telemetry. Runs entirely on your machine.

How it works

Four steps from zero to RBI-ready

No agents. No cloud. No code changes. Just point it at your systems.

Point it at your systems

TLS endpoints, CBOM output from your security scanner, or SARIF from Semgrep/CodeQL. We integrate, not rebuild.

Simulate migration impact

Side-by-side benchmark of your current algorithm vs the NIST PQC replacement. Real numbers, not estimates.

Find what breaks

MTU limits, TLS 1.2 constraints, embedded device RAM, DNSSEC UDP limits, JWT header overflow — all checked.

Get a report your CISO can sign

Auto-generated RBI / SEBI / NIST / DORA compliance reports, plus a copy-paste config diff for your engineers.

What you get

Every output your team needs

Engineers get benchmarks and diffs. CISOs get risk memos. Auditors get compliance reports.

📊
Performance benchmark

ECDSA signature72 B

ML-DSA-44 signature2,420 B (+33×)

Sign latency delta+0.15 ms

Verify latency delta+0.09 ms

Verdict⚠ CAUTION

🛡️
Compatibility oracle

TLS version✓ TLS 1.3 ready

MTU (1500B)⚠ ClientHello too large

Device RAM✓ Sufficient

DNSSEC UDP✗ Exceeds 1232B limit

HSM support⚠ Vendor check needed

📝
Config diff (copy-paste)

# OpenSSL 3.3+ (hybrid, drop-in)
Groups = P256_mlkem768:P256:X25519

# nginx
ssl_ecdh_curve X25519MLKEM768:X25519;

# Go TLS (no code change)
GODEBUG=tlsmlkem=1 ./your-binary

🏛️
RBI compliance report

Crypto asset inventoryPartially Compliant

Quantum-safe KEXNon-Compliant

TLS version policyCompliant

HNDL threat responsePartially Compliant

Ready to submit to RBI IT auditor. Maps to RBI-CS-2016, IT Master Direction 2023, CERT-In.

Who it's for

One tool, three audiences

👩‍💻

Security Engineer

Run it on your endpoints today. Get benchmark numbers, compat issues, and config diffs — in one command.

🏦

CISO / CTO

Forward the executive risk memo to your board. It reads like a risk document, not a dev tool output.

📋

Compliance Officer

Generate RBI / SEBI / NIST reports pre-mapped to control IDs. Ready to hand to your auditor.

🏗️

Platform / Infra Team

Drop into CI/CD. JSON output, exit codes (0=GO, 1=CAUTION, 2=BLOCKED). Catch new vulnerable crypto in PRs.

Regulatory coverage

8 jurisdictions, one platform

Every major financial regulator is asking about PQC. QuantumShift maps your results to their requirements.

Jurisdiction	Framework	Type	Deadline	Who's covered
🇮🇳 India	RBI Cybersecurity Framework 2016 + IT Master Direction 2023	Mandatory	FY2026-27	Banks, NBFCs, Payment Banks
🇮🇳 India	SEBI CSCRF 2024	Mandatory	FY2025-26	Brokers, Exchanges, Depositories
🇮🇳 India	CERT-In Directions 2022	Mandatory	Ongoing	All IT organisations in India
🇮🇳 India	DPDP Act 2023	Emerging	Rules 2025	All data fiduciaries
🇺🇸 United States	NSA CNSA 2.0 / OMB M-23-02	Mandatory	2030	Federal agencies, NSS, critical infra
🇪🇺 European Union	DORA + ENISA PQC Guidelines	Mandatory	In force Jan 2025	EU financial entities, MIIs
🇬🇧 United Kingdom	NCSC PQC Guidance + FCA	Advisory	2028	UK organisations, systemically important firms
🇸🇬 Singapore	MAS TRM Guidelines	Advisory	2025 review	MAS-regulated financial institutions
🇩🇪 Germany	BSI TR-02102	Advisory	Updated 2024	Federal IT, KRITIS operators
🇦🇺 Australia	ASD/ACSC + APRA CPS 234	Advisory	2025	Government agencies, APRA entities

Pricing

Free for engineers. Team platform coming soon.

Open Source CLI

Free_forever

Everything you need to simulate your own migration.

✓ pqc-sandbox simulate <endpoint>
✓ Breakage proof + fix for each issue
✓ Config diffs (nginx, OpenSSL, Go, Python)
✓ PR gate — blocks vulnerable crypto in CI
✓ Zero telemetry · runs on your machine
✓ Apache 2.0 — audit everything

⭐ View on GitHub →

Team Platform

Coming soon

For security teams managing org-wide PQC migration.

○ All endpoints monitored continuously
○ Remediation tracking + owner assignment
○ Org-wide PR gate across all repos
○ Auto-discovery (CT logs, AWS ACM, DNS)
○ Compliance export (RBI, DORA, NIST)
○ SSO + team management

Get notified →

See exactly what breaksbefore you migrate to PQC