Cryptography Health Score Calculator

health score = 25% cipher strength + 20% TLS 1.3 adoption + 20% modern-hash coverage + 15% rotation compliance + 10% certificate hygiene + 10% post-quantum readiness. The six components are weighted by how directly each one causes a breach: exploitable primitives and protocol versions carry the most weight, while post-quantum readiness is forward-looking and weighted lightly for now. The weakest component is surfaced separately, because a good average can hide one exploitable gap.

Crypto findings arrive scattered across scanner reports, certificate inventories and KMS logs; a single weighted score with a named weakest area is what turns them into a prioritised remediation plan an executive will fund.

This calculator takes 7 inputs: Endpoints using AES-GCM or ChaCha20-Poly1305, Traffic negotiating TLS 1.3, Systems still using MD5 or SHA-1, Keys rotated within policy, Expired or untracked certificates, Certificates in the estate, Systems with a post-quantum migration plan. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

MD5 collisions are trivial and SHA-1 chosen-prefix collisions cost a few tens of thousands of dollars. Unlike a merely dated cipher suite, these are attacks available now, so any remaining use is an active finding rather than technical debt.

85 or above, with no single component below 80. An average above 85 that hides a 40% component is worse than a uniform 80, which is why the weakest area is reported alongside the score.