Witnessory

Run a probe

Help measure how far the internet has moved to post-quantum cryptography, from your own network. Your probe checks which key exchange public servers choose, sends back signed results, and adds your network to a view of the transition that no single vantage point can give. It gets its own public page and a place on the probe map, with its network and country (never its address).

Install

Linux · Raspberry Pi

curl -fsSL https://witnessory.org/install.sh | sudo sh

A system user, its own Python environment, a sandboxed service that starts at boot.

Windows

irm https://witnessory.org/install.ps1 -OutFile install.ps1
powershell -ExecutionPolicy Bypass -File install.ps1

For your user, no administrator rights; runs every hour without a window. Needs Python 3.10+.

Docker

docker run -d --restart unless-stopped \
  --stop-timeout 120 -v witnessory-probe:/data \
  ghcr.io/witnessory/probe

The volume keeps your probe's keys and results.

Python

pipx install https://github.com/witnessory/probe/releases/download/v0.4.2/witnessory_probe-0.4.2-py3-none-any.whl
witnessory-probe start

Or try it first, with nothing stored: witnessory-probe check example.org

Read the installers before running them: install/. To remove it: curl -fsSL https://witnessory.org/install.sh | sudo sh -s -- --uninstall (or --purge, which also deletes the probe's keys and results); on Windows, run the installer with -Uninstall or -Purge.

What it does on your network

Only published measurements: a TLS key-exchange check on port 443 and an SSH key-exchange check on port 22. A task chooses which public sites to measure, never what to run.
Public servers only. It never connects to private, local or reserved addresses, or to its own IPv6 subnet.
Nothing about you. It reads how servers are configured, never your traffic or devices.
Light, and yours to control. At most 600 sites an hour by default; pause, limits, opt-outs and a log of every task.
Tamper-evident. Every result is signed by your probe (Ed25519 and ML-DSA-65) and chained to the one before.

The full rules: the protocol. What Witnessory receives and how results are used: hosting a probe.

Your probe

witnessory-probe me shows your probe's results and credits, and its public page, which shows its results and credits and never where it runs. Credits record what your probe has contributed; they are meant to become usable for Witnessory's services, such as checking your own sites from probes on many networks.