What is TLS Cipher Analyzer?
TLS Cipher Analyzer decodes and explains TLS cipher suite names. Paste a cipher suite string (like TLS_AES_128_GCM_SHA256 or ECDHE-RSA-AES256-GCM-SHA384) and get a breakdown of each component: key exchange algorithm, authentication mechanism, bulk cipher, key size, mode of operation, and MAC/hash function. Shows whether the cipher provides forward secrecy, its security level, and browser/server support.
TLS (Transport Layer Security) cipher suites define the cryptographic algorithms used for a connection. A cipher suite name encodes: Key Exchange (how the session key is negotiated): RSA, DHE (Diffie-Hellman Ephemeral), ECDHE (Elliptic Curve DHE). Authentication (how the server proves its identity): RSA, ECDSA, DSS. Bulk cipher (symmetric encryption of data): AES-128, AES-256, ChaCha20. Mode: GCM (Galois/Counter Mode -- AEAD), CBC (Cipher Block Chaining -- older). MAC (Message Authentication Code): SHA256, SHA384, POLY1305.
TLS 1.3 (RFC 8446, 2018) simplified cipher suites -- they only specify the symmetric cipher and hash (key exchange is always ECDHE): TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256. TLS 1.2 suites have longer names: ECDHE-RSA-AES256-GCM-SHA384. Prefer: TLS 1.3 ciphers (all provide forward secrecy and AEAD). For TLS 1.2: ciphers with ECDHE (forward secrecy) and GCM (authenticated encryption). Avoid: RC4 (broken), 3DES (SWEET32 attack), CBC mode with SHA1, export-grade ciphers, RSA key exchange (no forward secrecy), NULL ciphers.
How to Use
- Paste a cipher suite name (OpenSSL format like ECDHE-RSA-AES256-GCM-SHA384 or IANA format like TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384).
- Click Analyze to see each component broken down: key exchange, auth, cipher, mode, MAC.
- See the security assessment: forward secrecy, AEAD, recommended/deprecated/weak status.
- Use the cipher list to compare multiple cipher suites and sort by security level.
- Copy the IANA name or OpenSSL name for use in server configuration (nginx, Apache, HAProxy).
Examples
TLS 1.3 cipher (IANA name)
Result: TLS_AES_256_GCM_SHA384: Cipher=AES-256-GCM (AEAD), Hash=SHA-384, Key Exchange=ECDHE (always in TLS 1.3). Rating: Recommended
TLS 1.2 cipher with forward secrecy
Result: ECDHE-RSA-AES128-GCM-SHA256: KEx=ECDHE, Auth=RSA, Cipher=AES-128-GCM, MAC=SHA-256. Rating: Good
Deprecated cipher
Result: DES-CBC3-SHA: Cipher=3DES, Mode=CBC, MAC=SHA1. Rating: WEAK -- vulnerable to SWEET32 attack, disable immediately
Frequently Asked Questions
What is forward secrecy and why does it matter?
Forward secrecy (or Perfect Forward Secrecy, PFS) means that if a server's long-term private key is compromised in the future, past recorded encrypted sessions cannot be decrypted. Without FS (RSA key exchange): the client encrypts the session key with the server's RSA public key -- if that RSA private key is ever stolen, all past traffic can be decrypted retroactively. With FS (ECDHE/DHE): a fresh ephemeral key pair is generated for each session and discarded after. Even if the server key is stolen, past sessions remain secret. Forward secrecy is provided by key exchanges that generate ephemeral keys: DHE, ECDHE. In TLS 1.3, all key exchanges are ephemeral (forward secrecy is mandatory). Look for ECDHE in TLS 1.2 cipher names.
What is the difference between CBC and GCM modes in TLS?
CBC (Cipher Block Chaining): older mode, still in TLS 1.2. Encrypts each block using the previous ciphertext block. Vulnerabilities: timing side-channel attacks (Lucky Thirteen, BEAST, POODLE). Requires separate MAC for integrity (HMAC). Padding required (CBC operates on fixed block sizes). GCM (Galois/Counter Mode): modern authenticated encryption (AEAD -- Authenticated Encryption with Associated Data). Provides both encryption and integrity in one pass. No timing oracles. No padding needed. Much faster, especially with AES-NI hardware support. ChaCha20-Poly1305: alternative AEAD cipher (stream cipher + MAC), very fast in software (no AES hardware needed -- good for mobile/IoT). All TLS 1.3 ciphers are AEAD. For TLS 1.2, prefer GCM ciphers.
What TLS ciphers should I enable on my server?
Recommended TLS 1.3 cipher suites (enable all three): TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256. Recommended TLS 1.2 cipher suites: ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-GCM-SHA256. Disable: RC4, 3DES, DES, NULL, EXPORT, MD5, SHA1 (in authentication), RSA key exchange, anonymous ciphers. Reference: Mozilla SSL Configuration Generator (ssl-config.mozilla.org) provides ready-to-use nginx/Apache/HAProxy configs for Modern, Intermediate, and Old compatibility levels.
What is the SWEET32 attack and which ciphers are vulnerable?
SWEET32 (Birthday attack on 64-bit block ciphers, 2016) exploits a weakness in block ciphers with 64-bit block size (3DES/Triple-DES and Blowfish). The attack: after 2^32 blocks (~32GB of traffic with 3DES), block collisions become likely, allowing partial plaintext recovery via a birthday paradox attack. Vulnerable ciphers: all 3DES (Triple-DES) ciphers: DES-CBC3-SHA, ECDHE-RSA-DES-CBC3-SHA, etc. Fix: disable all 3DES cipher suites on your server. AES is not vulnerable (128-bit block size). SWEET32 affected many servers using 3DES as a fallback for old clients -- removing 3DES support is the correct mitigation.
How do I check what TLS ciphers my server supports?
Online: SSL Labs Server Test (ssllabs.com/ssltest) -- comprehensive analysis, scores ciphers, protocol versions, certificate chain, HSTS, and more. Command line: nmap --script ssl-enum-ciphers -p 443 example.com. OpenSSL: openssl s_client -connect example.com:443 (shows negotiated cipher). testssl.sh: bash script for comprehensive TLS testing: ./testssl.sh example.com -- shows all supported ciphers, protocols, vulnerabilities. Check cipher order: the server should have cipher order preference enabled (SSLHonorCipherOrder on in Apache, ssl_prefer_server_ciphers on in nginx). In TLS 1.3, cipher order is defined by the client.
Related Tools