Build a cryptographic inventory
PCI DSS 12.3.3 has required a documented inventory of your cryptography since 31 March 2025, and ISO 27001 A.8.24 auditors ask for the same artifact. This is how to produce one without a six-figure enterprise tool.
How it works
- Sign in with your email (no password, just a magic link) and scan each surface where crypto lives: Code, Deps, Config, Certs, Keystore, SBOM, JWKS, TLS and SSH — nine tabs, one folder or file or hostname at a time.
- Each finding is classified: broken / deprecated, quantum-vulnerable, quantum-weakened, or PQC-ready — with algorithm, key size and location.
- Every scan you sync builds one living Inventory (Pro) that merges all sources and exports as Excel, CSV, HTML, PDF or a CycloneDX 1.6 CBOM.
- Hand the export to your QSA or auditor — or start from the free blank template and fill it in by hand.
What regulators actually ask for
PCI DSS v4.0 requirement 12.3.3 asks for a documented inventory of the cryptographic cipher suites and protocols in use, reviewed at least every 12 months. ISO 27001:2022 control A.8.24 asks for rules on the effective use of cryptography — which an auditor tests by asking what you actually run. Both come down to the same table: algorithm, key size, where it is used, and whether it is still acceptable. The deadline map lists every dated requirement with its primary source.
Why grep is not an inventory
Searching your code for “AES” misses the crypto your dependencies ship, the suites your nginx config declares, the RSA-2048 in your TLS certificate, and the host keys your SSH fleet presents. PQLens looks at nine surfaces — the crypto you call, ship, declare and serve — because an inventory is only as good as the places it looks.
Your code never leaves your browser tab
Scanning runs entirely client-side, in WebAssembly, inside the tab you have open — your code, configs, certificates and keystore passwords are never uploaded anywhere. Only the findings you choose to sync (algorithm names, statuses, locations) go to your account, so your inventory follows you between sessions. The two exceptions are the TLS and SSH probes, which connect from PQLens’s edge — a browser cannot open a raw TCP socket to a remote host itself.
Frequently asked questions
Is a cryptographic inventory actually mandatory?
For PCI DSS v4.0 scope, yes — requirement 12.3.3 became mandatory on 31 March 2025 and a QSA can ask for the documented inventory today. ISO 27001 A.8.24 and the EU PQC roadmap ask for essentially the same artifact.
What columns should the inventory have?
At minimum: the algorithm or cipher suite, key size, protocol version where relevant, where it is used, who owns it, and its status. PQLens classifies status as broken/deprecated, quantum-vulnerable, quantum-weakened, or PQC-ready.
Do I need a paid tier to get started?
No. All nine discovery surfaces are free to scan in your browser. Free-tier results are view-only (no export or copy) and keep only your latest scan per surface; Pro adds full history, drift detection and export to Excel/PDF/CSV/CBOM.
Does any of my code get uploaded?
No. Scanning runs entirely in your browser tab and code, configs, certificates and keystore passwords never leave it. Only the findings you sync to your account (algorithm names, statuses, locations) are ever transmitted.