Crypto Agility
for Every Connection

Change your cryptography without changing your code. TLS Lane performs two independent TLS negotiations on one connection — upgrading legacy crypto to post-quantum in real time.

NIST PQC · CNSA 2.0 · ML-KEM-768

Live demo

See It In Action

A PQC-only server rejects every browser today. TLS Lane splices the handshake to make it work.

Without TLS Lane
$ curl https://pqc.tlslane.com

curl: (35) error:0A000410:
  SSL routines::ssl/tls alert
  handshake failure

Server requires pure ML-KEM-768.
Browser only speaks hybrid.
Enable splice
$ tlslane splice pqc.tlslane.com

Splice handshake active
Traffic to pqc.tlslane.com:
  client ← hybrid → TLS Lane
  TLS Lane ← pure PQC → server
Connection spliced
$ curl -v https://pqc.tlslane.com

* issuer: TLS Lane Root CA
* SSL connection using TLS 1.3
  / ML-KEM-768 / AES-256-GCM

HTTP/2 200
Why this matters

The Problem TLS Lane Solves

The problem

  • Browsers speak hybrid PQC, but servers demanding pure PQC reject them
  • Legacy apps stuck on TLS 1.2 have zero PQC path
  • Microservices, curl, IoT, custom clients don't auto-update like Chrome
  • "Harvest now, decrypt later" attacks are already happening

TLS Lane

  • Splice handshake: independent TLS negotiation on each side
  • Upgrades TLS 1.2 to TLS 1.3 without touching the server
  • Splices hybrid to pure PQC and vice versa
  • One binary, no code changes, no dependencies
Protocol transformation

What Gets Upgraded

Each side of the connection negotiates independently. The server doesn't change. The client doesn't know.

legacy.internal:443
              Server      TLS Lane      Client

  Protocol    TLS 1.2            TLS 1.3
  Key Exch    RSA                ML-KEM-768
  Cipher      AES-CBC            AES-256-GCM
  Status      Unchanged          Upgraded
Capabilities

Two Modes, One Binary

Monitor

See every TLS handshake on the wire. SNI, cipher suite, key exchange, certificate chain. Safe, read-only.

$ tlslane

Splice

Splice the handshake for a domain or all traffic. TLS Lane intercepts transparently and negotiates each side independently.

$ tlslane splice example.com

Policy

Define rules for which domains get spliced, passed through, or blocked. Local policy.yaml or push from the management dashboard.

# policy.yaml in config directory

Linux Native

eBPF/TC inline interception preserves the original TCP connection. Proxy mode as universal fallback. macOS and Windows coming soon.

Zero Friction

No proxy settings. No code changes. Monitor mode works instantly. Splice mode requires a one-time CA trust setup.

PQC Ready

Pure ML-KEM-768, hybrid X25519MLKEM768, classical fallback. You choose the policy, TLS Lane enforces it.

Quick start

Get Started in 30 Seconds

01

Register

Create a free account. Get your agent token and install command.

02

Install & Run

One command installs. Starts in monitor mode — see your crypto inventory instantly.

03

Splice

Enable splice to upgrade connections to PQC. Track progress on your dashboard.