TLS Cipher Suite Lookup
Look up TLS cipher suites by IANA or OpenSSL name or hex ID, and see key exchange, cipher, forward secrecy and a security rating.
Runs in your browser Your input never leaves your device.
Report a problem with this tool
About this tool
Type a cipher suite name in the IANA form (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) or the OpenSSL form (ECDHE-RSA-AES128-GCM-SHA256), a hex code (C02F or 0xC0,0x2F) or a keyword such as CHACHA, 3DES or PSK. For each match the tool shows both names, the hex code, whether IANA marks it as recommended, the key exchange, the authentication, the cipher and integrity algorithms, whether it gives forward secrecy, and a rating: strong, acceptable, weak or insecure. The table of 356 suites comes from the IANA TLS registry, joined with the names that OpenSSL uses. The ratings are worked out from the names by simple rules: no encryption, export grades, anonymous key exchange, RC4, DES, 3DES and MD5 are insecure; RSA key exchange, CBC mode and SHA-1 are weak; forward secrecy with an AEAD cipher is strong. We compared the key exchange type, forward secrecy, cipher and integrity algorithm of all 158 suites that OpenSSL lists with its own description and found no difference. A rating is a rough guide and not a security audit: use the SSL checker to see which suites a real server accepts. Everything is processed in your browser and nothing is uploaded.
How to use it
- Type a suite name, a hex code or a keyword.
- Or choose a filter such as recommended or TLS 1.3.
- Read the parts of the suite and the rating.
Common problems
- The OpenSSL name is missing
- Only suites that the OpenSSL build used for the table supports have an OpenSSL name. Others are known by their IANA name only.
- A suite I use is marked weak
- CBC mode, SHA-1 and plain RSA key exchange are discouraged today. They may still be needed for old clients; prefer the strong suites where you can.
- I need to know what my server supports
- This tool describes suites. Use the SSL checker to test a real server.