The State of Cryptography

Overstated: weakExposed, modernOnly, pqcReady.

A dependency was counted however it is declared, including optional, development, build and platform-specific ones. Re-read on 2026-10-05 at each crate's newest version as of the scan date: of the 259 crates counted as post-quantum, 157 require the library unconditionally, 84 optionally, 12 for development only and 1 for one platform only; 5 could not be re-read.

Counting only unconditional dependencies in the re-read of 2026-10-05, weak 4,460 becomes 3,740 and modern-only 24,485 becomes 20,935; 285 of the 29,204 crates could not be re-read and are in none of these figures.

Under the corrected weak classes, the weak count of 4,460 becomes 4,266. This correction and the one for unconditional dependencies have not been combined.

Corrections are planned and not yet built. Corrected figures can only come from a new scan, published as a new dated dataset. No date is set.

Overstated: scanned. Not established: weakExposed, modernOnly, pqcReady.

The modules scanned are the first part of the registry's list, oldest first, not a sample of the registry.

Each module was read at its first indexed version. The published entries that a reconstruction made on 2026-10-05 could locate (13,141 of 13,343) were first indexed between 2019-04-10 and 2020-07-30, so this row describes manifests of that period.

Names were matched by path prefix: 937 entries are counted only through two cloud SDK entries.

Requirements marked // indirect were counted as direct: of the 13,045 published entries the reconstruction could re-read, 4,720 required the matched library only as // indirect.

113,638 of the 200,895 go.mod files the reconstruction read hold only a module line and were counted as using no cryptography.

76 of the 200,117 modules counted as scanned were not read, so scanned overstates the modules read.

Under the corrected weak classes, the weak count of 3,244 becomes 3,227.

Corrections are planned and not yet built. Corrected figures can only come from a new scan, published as a new dated dataset. No date is set.

Overstated: scanned. Understated: modernOnly, pqcReady. Not established: weakExposed.

The packages scanned are the first part of the registry's list in key order, not a sample of the registry. In that order scoped names come before names that begin with a letter: 10,102 of the 10,249 matched packages are scoped.

5,374 of the 1,000,000 packages counted as scanned were not read (fetchErrors in the dataset's npm file) and were counted as using no cryptography, so scanned overstates the packages read and the modern-only and post-quantum counts are floors.

Under the corrected weak classes, the 3,146 packages counted as depending on a weak library become 2,655; the unread packages would raise that count by an unmeasured amount, so its direction is not established.

3 packages are counted only through a catalogue entry that is being taken out of the count.

Corrections to the scanner and to the catalogue are planned and not yet built. Corrected figures can only come from a new scan, published as a new dated dataset. No date is set.

Overstated: scanned. Not established: weakExposed, modernOnly, pqcReady.

Requirements behind an extra or an environment marker were counted as dependencies. Of the 5,019 published entries, 3,768 have had no upload since the scan; read on 2026-10-05, 380 of those match a catalogued library only behind an extra or a marker, and their post-quantum count falls from 13 to 4.

4,084 of the 150,000 packages counted as scanned could not be read (fetchErrors in the dataset's PyPI file) and were counted as using no cryptography, so scanned overstates the packages read.

Under the corrected weak classes, the 201 packages counted as depending on a weak library become 173, or 174 if one library whose status is not verified is weak. Across the issues in this note, the effects run in both directions; their net has not been measured.

Corrections are planned and not yet built. Corrected figures can only come from a new scan, published as a new dated dataset. No date is set.

Overstated: scanned. Not established: weakExposed, modernOnly, pqcReady.

The artifacts scanned are the first part of the registry's list, newest first, not a sample of the registry.

The scanner that produced this row read the first <dependencies> element in each POM wherever it sat, which is not always the project's own dependency list. On a hand-assembled set of 393 POMs from Maven Central (not a random sample), an XML parser finds a catalogued library in 23; the scanner flagged 26, of which 9 declare none, and missed 6.

1,000 of the 1,957 entries counted here match only commons-codec, OkHttp or ESAPI, which are being taken out of the count.

Under the corrected weak classes, the weak count of 895 becomes 152.

The catalogue's two post-quantum entries for Maven name artifacts Maven Central does not have, so the post-quantum zero is not a measurement.

26 of the 103,400 artifacts counted as scanned were not read, so scanned overstates the artifacts read.

scripts/scan-maven.mjs was corrected on 2026-10-05 to read project-level dependencies only; no scan has been published with it. The catalogue corrections are planned and not yet built. Corrected figures can only come from a new scan, published as a new dated dataset. No date is set.

Overstated: scanned. Understated: pqcReady. Not established: weakExposed, modernOnly.

The packages scanned are the first part of the registry's list, newest first, not a sample of the registry.

6,855 of the 100,000 packages counted as scanned were counted as using no cryptography although the metadata request for them failed (fetchErrors in the dataset's NuGet file), so scanned overstates the packages read and the three match counts miss those packages; the cause has not been verified.

The scanner counted a library that a package declares for only some of its target frameworks: re-read on 2026-10-05 at current versions, that is 57 of the 200 re-read packages still weak-classed under the corrected classes (42 of the 57 from one family of packages) and 36 of the 1,702 re-read packages counted as modern-classed only. 6 matched packages could not be re-read: 1 of the 204 counted as weak and 5 of the 1,707 counted as modern-classed only.

The scanner counted packages that have no listed version: of the packages re-read on 2026-10-05, 99 have none, 81 of them since before the scan, so against packages with a listed version the weak and modern-only counts are together too high by between 81 and 99. Another 38 were read at an unlisted version although an earlier version is listed; the effect of that is not established.

Under the corrected weak classes, the weak count of 204 becomes 201. Across the issues in this note, the effects on the weak and modern-only counts run in both directions; their net has not been measured.

Corrections to the scanner and to the catalogue are planned and not yet built. Corrected figures can only come from a new scan, published as a new dated dataset. No date is set.

Overstated: weakExposed. Understated: modernOnly.

The gems scanned are the first 100,000 the registry's search returned, letter by letter from a, not a sample of the registry.

Under the corrected weak classes, between 4 and 37 of the 83 gems counted as depending on a weak library remain. The others are counted as weak only through libraries those classes do not class as weak, and would be counted as modern-classed only. The range is 33 gems counted as weak only through three libraries for which no end-of-life statement was found either way, so their status is not verified.

The scanner counted every failed request as an unread gem and reported none.

Corrections to the scanner and to the catalogue are planned and not yet built. Corrected figures can only come from a new scan, published as a new dated dataset. No date is set.

Overstated: scanned. Understated: modernOnly, pqcReady. Not established: weakExposed.

20,826 of the 100,000 packages counted as scanned were never read (fetchErrors in the dataset's Packagist file) and were counted as using no cryptography, so scanned overstates the packages read and the modern-only and post-quantum counts are floors.

Under the corrected weak classes, the 177 packages counted as depending on a weak library become between 61 and 86: 78 of the 177 are counted only through catalogue entries that are being taken out of the count, and 25 are counted as weak only through two libraries whose status is not verified. The unread packages would raise the weak count by an unmeasured amount, so its direction is not established.

Corrections to the scanner and to the catalogue are planned and not yet built. Corrected figures can only come from a new scan, published as a new dated dataset. No date is set.

Not established: weakExposed, modernOnly, pqcReady.

The packages scanned are the first part of the registry's list, in alphabetical order, not a sample of the registry.

Under the corrected weak classes, the weak count of 0 does not change.

The scanner counted every failed request as an unread package and reported none. Whether any answer came without a pubspec, which it counted as scanned and not as a failure, has not been verified.

The packages of this row have not been re-read from the registry, so whether its three match counts are off, and which way, is not established.

Corrections are planned and not yet built. Corrected figures can only come from a new scan, published as a new dated dataset. No date is set.

Overstated: scanned, weakExposed. Understated: modernOnly. Not established: pqcReady.

The catalogue's one post-quantum entry for CocoaPods names a pod the registry does not have, so no pod could be counted as post-quantum and the zero is not a measurement.

Under the corrected weak classes, 7 or 8 of the 52 pods counted as depending on a weak library remain, depending on one library whose status is not verified; the others would be counted as modern-classed only.

The scanner counted a library that a pod declares only in a subspec outside its default subspecs, which is not installed unless asked for: re-read on 2026-10-05, 5 of the 357 matched pods match only that way, 2 of them weak-classed.

1 of the 50,000 pods counted as scanned was not read, so scanned overstates the pods read.

Corrections to the scanner and to the catalogue are planned and not yet built. Corrected figures can only come from a new scan, published as a new dated dataset. No date is set.

Not established: weakExposed, modernOnly, pqcReady.

The packages scanned are the first part of the registry's list, most downloaded first, not a sample of the registry.

Under the corrected weak classes, the weak count of 3 does not change.

The scanner counted a package as scanned only once it had read it, and reported none it could not read.

The packages of this row have not been re-read from the registry, so whether its three match counts are off, and which way, is not established.

Corrections are planned and not yet built. Corrected figures can only come from a new scan, published as a new dated dataset. No date is set.