Is JPMorgan Chase quantum-safe?
Partly. 48 of 63 public servers under chase.com use post-quantum key exchange, the protection against traffic recorded today being decrypted once a large quantum computer exists. Grade B. Scanned October 18, 2026.
Fix first
Production login, API, VPN, payment and developer servers that still rely on key exchange scheduled for retirement.
- account.chase.com
- accounts.chase.com
- developer.chase.com
- partners.chase.com
11 other servers without post-quantum key exchange
- chase.com
- click.auto.chase.com
- cloud.auto.chase.com
- creditcards.chase.com
- events.chase.com
- jobs.chase.com
- media.chase.com
- metrics.chase.com
- view.auto.chase.com
- viewer.chase.com
- www.creditcards.chase.com
48 servers already protected
- ais-jpmc-gateway.chase.com
- analytics.chase.com
- apps.chase.com
- astonmartinfinancial.chase.com
- beta-creditcards.chase.com
- beta.chase.com
- capture.chase.com
- chaseloyalty.chase.com
- fiskerfinance.chase.com
- fps-checks.chase.com
- go.paymentsolutions.chase.com
- gwmconnectportal.chase.com
- gwmportal.chase.com
- gwmuiportal.chase.com
- image.mcbb-preprod.chase.com
- image.mcbb.chase.com
- istc2-secure01ea.chase.com
- istc2-secure25ea.chase.com
- istc5-secure01ea.chase.com
- jaguarfinancialgroup.chase.com
- landroverfinancialgroup.chase.com
- m.chase.com
- maseraticapitalusa.chase.com
- mclarenfinancialservices.chase.com
- mfasa-qa2.chase.com
- pages.paymentsolutions.chase.com
- payments.chase.com
- pbcreditmortgage.chase.com
- pbrelation.chase.com
- prod-amfs.chase.com
- prod-ff.chase.com
- prod-jfg.chase.com
- prod-lrfg.chase.com
- prod-mcusa.chase.com
- prod-mfs.chase.com
- prod-rfs.chase.com
- prod-smf.chase.com
- rewardshield.chase.com
- rivianfinancialservices.chase.com
- secure.chase.com
- share.chase.com
- smwsq2.chase.com
- smwsq7.chase.com
- static.chase.com
- subarumotorsfinance.chase.com
- ultimaterewardspoints.chase.com
- www-perf.chase.com
- www.chase.com
What this means
NIST has scheduled the key exchange most servers still use for retirement: deprecated after 2030, disallowed after 2035 (NIST IR 8547). Traffic recorded today can be decrypted once a large quantum computer exists. A server that offers hybrid ML-KEM key exchange closes that today; a server that does not is still open to harvest now, decrypt later.
Hostnames come from public certificate logs plus common service names, kept where the name resolves to a public address, and each is tested from the outside with post-quantum-only TLS 1.3 handshakes. A hostname shows what a server is called, not what traffic it carries; internal systems are out of scope. Method.
Work at JPMorgan Chase?
Fleet Watch gives you this scan privately every week, with your suppliers and a report your auditor can verify. The first scan is free.
Scan your own domainBadge
Shows the current grade and updates itself. Anyone may embed it.
<a href="https://latticescan.com/readiness/chase.com"><img src="https://latticescan.com/badge/readiness/chase.com" alt="quantum readiness"></a>