X25519MLKEM768
X25519MLKEM768 is a hybrid post-quantum key exchange: classic X25519 plus ML-KEM-768. Chrome and many libraries offer it first.
What it is
X25519MLKEM768 (group 4588, 0x11EC) is a hybrid key exchange for TLS 1.3, defined in the IETF draft draft-ietf-tls-ecdhe-mlkem. It runs two key exchanges at once: classic elliptic curve X25519 and ML-KEM-768, the post-quantum key encapsulation mechanism standardized by NIST as FIPS 203. The session key is derived from both secrets.
The point is protection against "harvest now, decrypt later": an attacker who records traffic today and gets a large quantum computer later could break X25519 alone, but not ML-KEM. Because X25519 is still part of the mix, the connection stays at least as secure as before even if ML-KEM were found to be weak.
The cost is size. The client's key share is about 1.2 KB, so the ClientHello no longer fits in a single small packet, which exposed bugs in some middleboxes during the rollout.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 8 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
In our measurements it comes first in the supported groups list for Chrome 153, curl_cffi, Python requests, httpx, Go net/http, Node.js fetch and PHP Guzzle. Recent OpenSSL and Go releases enable it by default, so it no longer separates browsers from libraries on its own.
curl on macOS and Debian 12 and the older curl-impersonate builds do not offer it, and that does date them. Its presence and position feed into JA3 through the groups list.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for X25519MLKEM768 in the TLS details.
Run the TLS fingerprint test