TLS Cipher Suite Checker
Check TLS protocol version compatibility and cipher suite strength ratings against current best practices. Supports IANA and OpenSSL cipher names — rates each suite as Strong, Weak, or Deprecated and explains why.
How to Use TLS Cipher Suite Checker
How to Use the TLS Cipher Suite Checker
Step 1: Enter Cipher Suite Names
Paste one cipher suite name per line into the input box. The tool accepts both IANA standard names and OpenSSL shorthand names:
- IANA format:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - OpenSSL format:
ECDHE-RSA-AES256-GCM-SHA384
You can also click one of the example presets (Best Practices, Legacy Server, Broken Config) to see typical configurations.
Step 2: Review the Overall Rating
The tool grades your full cipher list:
| Grade | Meaning |
|---|---|
| Excellent | All suites are strong — AEAD with forward secrecy |
| Good | Mix of strong and weak suites |
| Fair | Only weak suites, or unknown ciphers present |
| Critical | One or more deprecated/broken ciphers detected |
Step 3: Check Per-Cipher Details
Each cipher suite shows:
- Rating — Strong / Weak / Deprecated / Unknown
- TLS 1.2 / TLS 1.3 support flags
- Forward Secrecy — whether past sessions are protected if the server key is compromised
- Key Exchange, Encryption, and MAC algorithm breakdown
- Known issues — specific attacks or weaknesses (e.g., SWEET32, FREAK, BEAST)
- Recommendation — what to do
Step 4: Copy the Report
Click Copy Report to get a plain-text summary of all ratings — useful for security audit documentation.
Rating Criteria
Strong
- TLS 1.3 ciphers (AES-GCM, ChaCha20-Poly1305)
- TLS 1.2 with ECDHE/DHE + AEAD (GCM or ChaCha20) — provides both forward secrecy and authenticated encryption
Weak
- TLS 1.2 with CBC mode — vulnerable to BEAST and Lucky13 without server-side mitigations
- TLS 1.2 with RSA key exchange — no forward secrecy; server private key compromise exposes all recorded sessions
- SHA-1 MAC — deprecated for HMAC in TLS contexts
Deprecated
- RC4 — banned by RFC 7465; Bar-Mitzvah and NOMORE attacks make it cryptographically broken
- 3DES — SWEET32 attack (CVE-2016-2183) exploits the 64-bit block size
- DES — 56-bit key is bruteforceable within hours
- NULL — no encryption; transmits data in plaintext
- EXPORT — deliberately weakened key sizes, targeted by FREAK and Logjam
- Anonymous (anon/ADH/AECDH) — no server authentication; trivially MITM-able
- MD5 — broken for cryptographic integrity purposes
Tips
- Always enable TLS 1.3 alongside TLS 1.2 for compatibility
- Prioritize ECDHE over DHE — ECDHE is faster and equally secure
- Remove any cipher that shows as Deprecated before your next deployment
- Verify your live server with
testssl.shor SSL Labs for a full handshake audit
Frequently Asked Questions
Most Viewed Tools
TOTP Code Generator
Generate time-based one-time passwords from a TOTP secret key. Enter your base32 secret, choose a period and digit length, and get the current and next codes with a live countdown timer. Useful for testing and debugging 2FA integrations.
Use Tool →Secret and Credential Scanner
Scan pasted text, code, or config files for accidentally exposed API keys, tokens, passwords, and private keys. Detects 50+ secret types across AWS, GitHub, Stripe, OpenAI, and more — all client-side, nothing leaves your browser.
Use Tool →Password Entropy Calculator
Calculate the information-theoretic bit entropy of any password or API key. Detects character set pools automatically, shows the total number of possible combinations, and estimates crack time across five attack scenarios from rate-limited web logins to GPU cracking clusters.
Use Tool →Content Security Policy Generator
Build Content Security Policy headers interactively. Toggle directives like script-src, style-src, and img-src, select allowed source tokens, and add custom origins. Instantly outputs your CSP as an HTTP header, meta tag, Nginx directive, or Apache header.
Use Tool →Screen Size Converter
Calculate screen width and height from diagonal size and aspect ratio. Convert between inches and centimeters for displays, TVs, and monitors with instant dimension calculations.
Use Tool →API Key Hasher
Hash API keys using SHA-256, SHA-512, or PBKDF2 before storing them in your database. Generates a Node.js verification snippet and shows the recommended storage format — all 100% client-side using the Web Crypto API.
Use Tool →SSH Key Generator
Generate Ed25519 and RSA 4096-bit SSH key pairs entirely in your browser. Keys are never sent to any server — 100% client-side using the Web Crypto API.
Use Tool →IP Allowlist Rule Generator
Generate ready-to-paste IP allowlist and blocklist rules for nginx, Apache, iptables, UFW, and AWS Security Groups. Enter IP addresses or CIDR ranges, select your target platform, and get production-ready firewall config instantly.
Use Tool →Related Privacy & Security Tools
API Key Hasher
Hash API keys using SHA-256, SHA-512, or PBKDF2 before storing them in your database. Generates a Node.js verification snippet and shows the recommended storage format — all 100% client-side using the Web Crypto API.
Use Tool →PGP Key Generator
Generate PGP public and private key pairs for email encryption and code signing. Supports ECC (Curve25519) and RSA up to 4096-bit. Entirely browser-side — keys never leave your device.
Use Tool →TOTP Code Generator
Generate time-based one-time passwords from a TOTP secret key. Enter your base32 secret, choose a period and digit length, and get the current and next codes with a live countdown timer. Useful for testing and debugging 2FA integrations.
Use Tool →OAuth 2.0 Scope Builder
Build and decode OAuth 2.0 scope strings for Google, GitHub, Stripe, and custom providers. Toggle permissions with risk indicators, generate ready-to-use scope strings, and decode existing scope strings to understand what access they grant.
Use Tool →IP Allowlist Rule Generator
Generate ready-to-paste IP allowlist and blocklist rules for nginx, Apache, iptables, UFW, and AWS Security Groups. Enter IP addresses or CIDR ranges, select your target platform, and get production-ready firewall config instantly.
Use Tool →Password Entropy Calculator
Calculate the information-theoretic bit entropy of any password or API key. Detects character set pools automatically, shows the total number of possible combinations, and estimates crack time across five attack scenarios from rate-limited web logins to GPU cracking clusters.
Use Tool →Content Security Policy Generator
Build Content Security Policy headers interactively. Toggle directives like script-src, style-src, and img-src, select allowed source tokens, and add custom origins. Instantly outputs your CSP as an HTTP header, meta tag, Nginx directive, or Apache header.
Use Tool →SSH Key Generator
Generate Ed25519 and RSA 4096-bit SSH key pairs entirely in your browser. Keys are never sent to any server — 100% client-side using the Web Crypto API.
Use Tool →Share Your Feedback
Help us improve this tool by sharing your experience