Part of the QRAMM toolkit by CSNP: CryptoScan, CryptoDeps, TLS Analyzer. Framework: qramm.org.
CryptoScan is a command-line scanner that finds the cryptography in your source code and configuration files, sorts each finding by its quantum risk, maps the results to QRAMM Dimension 1 (Cryptographic Visibility and Inventory), and writes them as text, JSON, CSV, SARIF or a CycloneDX CBOM.
It reads the files in the working tree, not Git history. It does not detect DSA, as cryptoscan scan --help states.
Install it with Go (the binary goes into $(go env GOPATH)/bin), then scan the sample files that come with this repository:
go install github.com/csnp/cryptoscan/cmd/cryptoscan@latest
git clone https://github.com/csnp/cryptoscan.git && cd cryptoscan
cryptoscan scan crypto-samplesWhat cryptoscan scan crypto-samples prints, trimmed (full output):
Scanning... (findings appear as discovered)
[INFO] #1 ML-KEM Key Encapsul... ...scan/crypto-samples/pqc_algorithms.py:5
[INFO] #2 Post-Quantum Crypto... ...scan/crypto-samples/pqc_algorithms.py:7
[INFO] #3 Post-Quantum Crypto... ...oscan/crypto-samples/hybrid_crypto.js:5
...
Scan complete: 110 findings in 6 files (15ms)
The list above has 121 matches.
11 repeat a match of the same kind on the same line and are counted with it.
╔═══════════════════════════════════════════════════════════════╗
║ CRYPTOGRAPHIC SCAN RESULTS ║
║ QRAMM CryptoScan ║
╚═══════════════════════════════════════════════════════════════╝
┌─ QUANTUM MIGRATION READINESS ──────────────────────────────────┐
│ Score: █████████░░░░░░░░░░░░░░░░ 37.5% [CRITICAL]│
│ Method: (safe 32 + 0.8 x hybrid 3 + 0.3 x partial 23) │
│ / 110 findings, as a percentage. Every finding counts │
│ once; test and example files count the same as │
│ production code. │
│─────────────────────────────────────────────────────────────────│
│ INVENTORY (findings by migration status) │
│ ✓ Safe (PQC): 32 ✗ Vulnerable: 39 │
│ ◐ Hybrid: 3 [!] Critical: 13 │
│ ◑ Partial: 23 Total: 110 │
│─────────────────────────────────────────────────────────────────│
│ QRAMM DIMENSION 1: Cryptographic Visibility & Inventory (CVI) │
│ Practice 1.1 Discovery: Level 3/5 ●●●○○ │
│ Practice 1.2 Assessment: Level 3/5 ●●●○○ │
│ Practice 1.3 Mapping: Level 3/5 ●●●○○ │
│─────────────────────────────────────────────────────────────────│
│ TOP PRIORITY FILES │
│ 1. ...scan/crypto-samples/crypto_samples.go (29 findings) │
│ 2. ...scan/crypto-samples/crypto_samples.py (21 findings) │
│ 3. ...can/crypto-samples/CryptoSamples.java (8 findings) │
│─────────────────────────────────────────────────────────────────│
│ RECOMMENDATIONS │
│ • CRITICAL: Remove broken algorithms (MD5, SHA-1, DES, RC4)...│
│ • Plan migration from quantum-vulnerable algorithms to PQC ...│
└─────────────────────────────────────────────────────────────────┘
┌─ Scan Information ─────────────────────────────────────────────┐
│ Target: crypto-samples │
...
│ Duration: 15ms │
│ Scanned: 6 files • 873 lines • 26.3 KB │
│ Speed: 393 files/sec • 1.7 MB/sec │
└─────────────────────────────────────────────────────────────────┘
Common jobs:
- Scan a project folder:
cryptoscan scan .(command reference) - Scan a remote repository:
cryptoscan scan https://github.com/your-org/your-repo.git(command reference) - Send findings to GitHub code scanning:
cryptoscan scan . --format sarif --output results.sarif(GitHub Actions with SARIF) - Write a Cryptographic Bill of Materials:
cryptoscan scan . --format cbom --output crypto-bom.json(CBOM output) - Fail a CI build on serious findings:
cryptoscan scan . --fail-on high(exit code control) - Report only findings that are new since a baseline:
cryptoscan scan . --baseline baseline.json(baseline workflow) - See what CryptoScan detects before you scan:
cryptoscan patterns list, orcryptoscan patterns search md5for one algorithm (command reference)
The scan exits with code 1 when it finds a CRITICAL issue or hits an error, and 0 otherwise; --fail-on changes the threshold (see Exit codes).
CryptoScan identifies cryptographic usage across your technology stack:
| Category | What We Detect |
|---|---|
| Post-Quantum Cryptography | ML-KEM (Kyber), ML-DSA (Dilithium), SLH-DSA (SPHINCS+), FN-DSA (Falcon), XMSS, LMS |
| Hybrid Cryptography | X25519+ML-KEM, ECDSA+ML-DSA composite signatures, hybrid TLS key exchange |
| Asymmetric Encryption | RSA (all key sizes), ECDSA, DH, ECDH, Ed25519, X25519 |
| Symmetric Encryption | AES (CBC, GCM, ECB, CTR), ChaCha20-Poly1305, DES, 3DES, RC4, Blowfish |
| Hash Functions | SHA-2, SHA-3, SHAKE128/256, BLAKE2, BLAKE3, MD5, SHA-1 |
| Certificates | X.509, CSR, PKCS#12/PFX, certificate chains, mTLS, validation bypass, expiration, JWK |
| TLS/SSL | Protocol versions, cipher suites, weak configurations, certificate pinning |
| Key Material | Private keys (RSA, EC, SSH, PGP, PKCS#8), JWT secrets, HMAC keys |
| Dependencies | Crypto libraries listed in package.json, requirements.txt, pyproject.toml, go.mod, pom.xml, Cargo.toml and Gemfile |
DSA is not detected, and detection matches whole words only, so a compound identifier such as RSAPrivateKey is not matched. MACs, key derivation, cloud KMS and configuration patterns are in the full detection table in How CryptoScan works. cryptoscan patterns list prints every pattern the scanner runs, with its ID, severity, quantum risk, category and name, and PATTERNS.md explains how detection, confidence scoring and the risk levels work.
Every finding is classified by quantum computing threat level:
| Risk Level | Meaning | Threat | Recommended Action |
|---|---|---|---|
| VULNERABLE | Broken by quantum computers | Shor's algorithm | Migrate to PQC now |
| PARTIAL | Security reduced by quantum | Grover's algorithm | Increase key sizes |
| HYBRID | Combined classical + PQC | Defense in depth | Good transition approach |
| SAFE | Quantum-resistant | N/A | No action needed |
| UNKNOWN | Cannot determine | Unknown | Manual review required |
CryptoScan calculates a Migration Readiness Score that tells you at a glance how prepared your codebase is for the post-quantum transition.
The score formula: (Safe + Hybrid×0.8 + Partial×0.3) / Total × 100. Every finding counts once; test and example files count the same as production code.
The report labels the score CRITICAL when any finding is CRITICAL or the score is below 25%, HIGH below 50%, MEDIUM below 75%, and LOW from 75% up. A sample of the score panel is in How CryptoScan works.
CryptoScan maps findings to the Quantum Readiness Assurance Maturity Model (QRAMM) Dimension 1: Cryptographic Visibility & Inventory (CVI). The report shows a maturity level out of 5 for Practice 1.1 (Discovery), Practice 1.2 (Assessment) and Practice 1.3 (Mapping), so you can see where you stand in your quantum readiness work.
CryptoScan goes beyond simple pattern matching:
- Source code context: See 3 lines before and after each finding, or the number set with
--context - Confidence scoring: Findings in comments, logs, or docs are marked low confidence
- File type awareness: Different severity for code vs. test vs. documentation
- Language detection: 15+ programming languages recognized
- Noise reduction: Automatically filters minified files, lock files, and build artifacts. The scan summary counts the minified files it left out and names up to ten; JSON output lists them under
skippedFiles
Algorithm names that appear only in prose, logs or comments are held back from the default report, and the scan summary says how many. How CryptoScan works explains the rule.
--format takes text (the default), json, csv, sarif or cbom, and --output writes the report to a file. Output formats shows the command for each and what each one contains.
The first example on this page installs with go install. You can also build from source or download a binary.
Requires Go at the version named in go.mod or newer (install Go). Always use the latest patch version for security fixes.
On macOS 26, the block below run with Go 1.21 or 1.22 builds a binary that stops at launch with missing LC_UUID load command (seen on Apple silicon with 1.21.13, 1.22.0 and 1.22.12, and not with 1.23.0, 1.24.0, 1.25.0 or 1.26.5). Build with Go 1.23 or later, or put CGO_ENABLED=0 in front of go build, which is how the release binaries are built.
Copy and paste this entire block. It moves the binary into /usr/local/bin, so sudo asks for your password:
git clone https://github.com/csnp/cryptoscan.git
cd cryptoscan
go build -o cryptoscan ./cmd/cryptoscan
sudo mv cryptoscan /usr/local/bin/
cd ..
cryptoscan versionDownload pre-built binaries from GitHub Releases.
- Command reference: every command and flag, exit codes, common workflows, and what each output format contains
- CI/CD integration: GitHub Actions, GitLab CI, a pre-commit hook, and failing only on new findings with a baseline
- Configuration: the
.cryptoscan.yamlfile and inline suppression comments - How CryptoScan works: what is reported, detection coverage, scoring, architecture, and the maintainers' comparison with other approaches
- Roadmap: what is done and what is planned
- CryptoScan guide on qramm.org: tutorials and examples
- CHANGELOG.md: what changed in each release, and its known limitations
- CONTRIBUTING.md: how to contribute
We welcome contributions from the community! See CONTRIBUTING.md for guidelines.
# Clone the repository
git clone https://github.com/csnp/cryptoscan.git
cd cryptoscan
# Install dependencies
go mod download
# Run tests
go test -race ./...
# Build
go build -o cryptoscan ./cmd/cryptoscan
# Run linter
golangci-lint runNew detection patterns are added in pkg/patterns/matcher.go. Each pattern includes:
- Unique ID and descriptive name
- Category classification
- Compiled regex
- Severity and quantum risk levels
- Description and remediation guidance
- References to standards or documentation
See CONTRIBUTING.md for detailed instructions.
CryptoScan is developed by the CyberSecurity NonProfit (CSNP), a 501(c)(3) organization dedicated to making cybersecurity knowledge accessible to everyone through education, community, and practical resources.
We believe that:
- Accessibility: Cybersecurity knowledge should be available to everyone, regardless of background or resources
- Community: Supportive communities help people learn, share knowledge, and grow together
- Education: Practical, actionable learning resources empower people to implement better security
- Integrity: The highest ethical standards in all operations and educational content
CryptoScan is part of the Quantum Readiness Assurance Maturity Model (QRAMM) toolkit, a suite of open-source tools designed to help organizations prepare for the post-quantum era:
- CryptoScan: Cryptographic discovery scanner (this project)
- CryptoDeps: Quantum-safe dependency analysis for your software supply chain
- QRAMM Assessment: Quantum readiness maturity assessment
- TLS Analyzer: TLS/SSL configuration analysis with CNSA 2.0 compliance tracking
Learn more at qramm.org and csnp.org.
Apache License 2.0. See LICENSE for details.
Copyright 2025 CyberSecurity NonProfit (CSNP)
Built with purpose by CSNP. Advancing cybersecurity for everyone