Post-quantum cryptography is becoming a practical technology-management task. Small businesses and government contractors need to find the cryptography they depend on, understand vendor migration paths, and show what has changed. Free tools can help teams begin that work before committing to a large project.
Our top five free PQC tools are Vista Core, CBOMkit, Anvil Secure's pqcutils, OpenSSL, and Open Quantum Safe's liboqs. Vista Core is our first recommendation for organizing an ongoing readiness program. The other tools address specific needs in software analysis, network discovery, implementation, and experimentation.
Editorial disclosure: Vista Security is one of our properties. This is Astrenic's editorial selection for small organizations, based on published capabilities and documentation, rather than an independent benchmark. Vista Core is free and source-available; the other four projects are open source. Product information was checked on October 13, 2026.
What should a free PQC tool help you do?
Post-quantum cryptography uses algorithms designed to resist attacks from conventional and quantum computers. NIST has published standards for key establishment and digital signatures, so organizations can begin evaluating supported implementations and planning migration. NIST's PQC overview is a useful introduction.
The tools in this guide serve different parts of that process. An inventory platform helps organize the estate. A scanner gathers evidence about particular services or software. A cryptographic library helps developers implement or test new capabilities.
We selected these five for their relevance to practical readiness work, their publicly documented capabilities, and the availability of a free edition or open-source code. Their positions reflect where we would start an SMB program. They are not interchangeable products, and the ranking does not imply that one library has stronger cryptography than another.
Free software also needs time, hosting, maintenance, and someone who understands the results. Choose the tool that answers your next question, then connect its output to a decision.
1. Vista Core — our top pick for managing PQC readiness
Best fit: teams that need an asset inventory, cryptographic context, and evidence they can revisit.
Vista Core is a self-hosted platform that brings supported network, host, cloud, and imported observations into a unified inventory. Its maps and recorded relationships help connect cryptographic findings to the systems that use them. That makes it easier to move from “we found a configuration” to “this service has an owner and needs a plan.” Explore Vista's asset inventory.
Core includes discovery, cryptographic assessment, PQC exposure, audit logging, and cryptographic bill of materials generation with CycloneDX export. Vista lists no asset, sensor, seat, or time caps for Core. Its FSL-1.1-ALv2 license is source-available, with each release converting to Apache 2.0 after two years. Review the free Core edition and license details.
We place Vista first because a small organization needs continuity between discovery, prioritization, and reporting. A useful starting exercise is to define one scope, connect authorized sources, review the inventory, and identify the systems that need further investigation.
Vista's findings and asset context inform remediation planning; the IT team and vendors implement the changes. Fresh observations and scoped CBOM exports then support review. Collection coverage still matters: an unobserved or unassessed system is a gap, not evidence of readiness. See Vista's PQC migration approach.
Know the boundary: Core provides a substantial foundation. Enterprise adds capabilities including custom policies and CBOM signing and attestation. Select an edition around the evidence and operating requirements you actually have.
Start here: Get Vista Core free.
2. CBOMkit — for application cryptography and policy checks
Best fit: software teams working with cryptographic bills of materials.
A CBOM describes cryptographic components within a defined scope. CBOMkit provides tools to generate CBOMs from supported source repositories, visualize them, store them, and evaluate them against policies. Its main project uses the Apache 2.0 license. Explore the official CBOMkit repository.
This is useful when your organization develops software and needs a repeatable way to review cryptographic dependencies. It can also help teams inspect an existing CBOM and turn the findings into questions for the application's owner.
Know the boundary: The project describes its built-in quantum-safe check as foundational. Its documentation also notes that missing policy matches can produce an overall quantum-safe result, so reviewers must examine policy coverage and unknowns. Source-scanning completeness has limitations as well. A passing label should be reviewed alongside the underlying components, policy configuration, and scan coverage.
Start here: CBOMkit documentation and deployment options. Start with one application and a known baseline before adding automated policy checks to release decisions.
3. Anvil Secure pqcutils — for SSH and TLS discovery
Best fit: administrators investigating PQC support on network services.
Anvil Secure's pqcutils project includes two utilities. pqcscan actively queries SSH and TLS servers for advertised PQC support. pqcdump analyzes existing packet captures for observed hosts, sessions, and PQC use or support in handshakes. The project is open source under the BSD 2-Clause license. Read the official pqcutils documentation.
These utilities offer a focused way to investigate known endpoints or captured traffic. For example, a team could examine selected remote-access or web-service connections before and after a vendor-supported change, retaining the reports with its change records.
Know the boundary: Advertised support and observed use answer different questions. A service advertising an algorithm does not establish that every client connection uses it. A packet capture only covers the traffic and time represented in that capture.
Start here: pqcutils on GitHub. Choose the active scanner or passive capture analyzer for the evidence you need, and limit collection to authorized systems and traffic.
4. OpenSSL — for implementation and interoperability testing
Best fit: developers and technical teams using standard cryptographic interfaces.
OpenSSL is a widely used TLS and cryptographic library with command-line utilities. Current OpenSSL releases use the Apache 2.0 license. See the OpenSSL project.
OpenSSL 3.5 introduced support for ML-KEM, ML-DSA, and SLH-DSA, including post-quantum and hybrid TLS key exchange. That gives teams a concrete way to evaluate standardized capabilities within a familiar software ecosystem. Read the OpenSSL 3.5 migration guide.
For an application team, this illustrates how PQC can arrive through a supported dependency upgrade. Test the application's actual runtime, configuration, and peers. Updating a development workstation does not update a separately bundled library inside a deployed container.
Know the boundary: OpenSSL is an implementation and testing building block. Your deployment still needs compatibility testing, appropriate configuration, and verification of the behavior you intend to use. Library availability alone does not establish completion across an application or network.
Start here: OpenSSL documentation. Follow your product or distribution's supported upgrade path and confirm which library the running application actually loads.
5. Open Quantum Safe liboqs — for research and prototyping
Best fit: engineering teams learning about PQC or experimenting in a lab.
Open Quantum Safe's liboqs is a C library for prototyping and experimenting with quantum-resistant cryptography. It provides a common interface to multiple algorithms and supports experimentation with key establishment and signatures. The project uses the MIT license, with some included components carrying other licenses. Explore the official liboqs repository.
A development team can use it to learn how algorithms behave and investigate integration questions before choosing a supported production path. It is particularly relevant when the organization has people responsible for cryptographic engineering or advanced testing.
Know the boundary: The maintainers explicitly advise against relying on liboqs in production or to protect sensitive data. Treat it as a research and prototyping resource. Small organizations that mainly purchase business software will usually get more immediate value from inventory and vendor engagement.
Start here: Open Quantum Safe and the liboqs usage guidance.
How should an SMB combine these tools?
Begin with a question the business needs answered. For example: “Which systems in our remote-access environment need a vendor update, and how will we verify the result?”
Use an inventory and ownership record as the backbone. Add targeted network observations where you need detail about services. If you develop software, examine its cryptographic components and test supported library changes in a staging environment. Keep lab experiments separate from production decisions.
You do not need all five tools to begin. A company that mostly uses hosted software may start with Vista, its existing asset records, and vendor questionnaires. A software contractor may add CBOM analysis and interoperability testing. The useful combination depends on what the organization operates and what it can verify.
Avoid assuming that every output imports automatically into another product. Check supported formats, versions, and integrations before designing a combined workflow. Even when evidence stays in separate systems, record its source, date, scope, and the asset or application it describes.
Can these tools prove PQC compliance?
They can contribute evidence. The applicable requirements, coverage, policies, and operational results still need review.
For a small government contractor, first establish what the customer, contract, and system require. Then retain the inventory boundary, vendor guidance, deployment record, verification results, and unresolved exceptions. A scanner report or CBOM is one part of that package.
In particular, distinguish three states: a product supports PQC; a configuration enables it; and the relevant connections or operations actually use it. Each needs evidence appropriate to the claim. Record gaps instead of letting an empty result stand in for a successful assessment.
This is why we recommend beginning with an ongoing management approach. Individual tools help answer technical questions; ownership and a repeatable review process turn those answers into progress.
Get a practical PQC roadmap
Astrenic's PQC Services help small businesses and government contractors turn the topic into a manageable plan. Both offerings use the Vista platform:
- PQC Executive Overview — 2 hours: a leadership-focused session covering business implications, priorities, and a guided Vista walkthrough.
- PQC Readiness Assessment — 4–8 hours: interviews with selected people and a review of relevant processes and available evidence, resulting in a prioritized remediation roadmap.
If you prefer to start independently, get Vista Core free and define your first inventory scope. If you want help establishing priorities and the evidence you will need, talk to Astrenic about PQC readiness.