TLS Cipher Suite Lookup

Every HTTPS connection your browser makes begins with a TLS handshake, and at the center of that handshake is a cipher suite. A cipher suite is a named bundle of cryptographic algorithms that determines how the server and client encrypt their communication, exchange keys, and verify each other's identity. There are over 300 registered cipher suites in the IANA registry, but only a small fraction are considered safe to use in 2026. This lookup tool lets you search the full landscape by IANA name, OpenSSL name, hex code, or algorithm, filter by protocol version and security rating, and inspect the technical details of each suite so you can configure TLS with confidence.

The tool searches a static dataset of cipher suites compiled from the IANA TLS Cipher Suites registry, Mozilla's server-side TLS compatibility table, and the ciphersuite.info database. Each entry stores the IANA name (the canonical identifier), the OpenSSL name (used in server configuration directives), the two-byte hex code, protocol version, key exchange algorithm, authentication method, encryption algorithm, key strength, MAC algorithm, forward secrecy status, and a security rating.

Type any search term into the search bar and the tool matches it against every field in the dataset. Use the dropdown filters to narrow results by security rating, protocol version, or forward secrecy. Click any row in the results table to see the full technical breakdown in the detail panel on the right.

A TLS cipher suite name encodes four components in a single string. Take TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 as an example:

1. TLS - the protocol family 2. ECDHE - the key exchange algorithm (Elliptic Curve Diffie-Hellman Ephemeral), which provides forward secrecy 3. RSA - the authentication method (the server proves its identity with an RSA certificate) 4. AES_128_GCM - the encryption algorithm and mode (AES with 128-bit keys in Galois/Counter Mode, which is AEAD) 5. SHA256 - the MAC/hash algorithm used for key derivation and integrity

TLS 1.3 simplified this dramatically. It removed the key exchange and authentication from the cipher suite name entirely, because TLS 1.3 always uses ephemeral Diffie-Hellman and always authenticates via certificates. The five TLS 1.3 suites only specify the encryption algorithm and hash: - TLS_AES_128_GCM_SHA256 (0x13,0x01) - mandatory to implement - TLS_AES_256_GCM_SHA384 (0x13,0x02) - TLS_CHACHA20_POLY1305_SHA256 (0x13,0x03) - preferred on mobile - TLS_AES_128_CCM_SHA256 (0x13,0x04) - constrained devices - TLS_AES_128_CCM_8_SHA256 (0x13,0x05) - 8-byte tag variant

Forward secrecy is the most important property to check. Without it (static RSA key exchange), if the server's private key is ever compromised, an attacker can decrypt every past session recorded from that server. With ECDHE or DHE, each session uses a fresh ephemeral key that is never stored, so compromising the long-term key does not expose past traffic. RFC 9325 (published 2023) mandates that implementations MUST prefer cipher suites that provide forward secrecy.

AEAD vs CBC: Modern suites use AEAD modes (GCM, ChaCha20-Poly1305, CCM) that combine encryption and authentication into a single operation. Older suites use CBC mode with a separate MAC, which is vulnerable to padding oracle attacks like Lucky 13. RFC 9325 recommends AEAD suites and discourages CBC suites.

The security ratings in this tool follow the ciphersuite.info classification and Mozilla's Server Side TLS guidelines: - Recommended: Forward secret, AEAD, 128+ bit security. Safe for production. - Secure: Cryptographically sound but may lack forward secrecy or use less common algorithms. - Weak: Forward secret but CBC mode, or AEAD but no forward secrecy. Should be phased out. - Insecure: NULL encryption, RC4, DES, export-grade, or anonymous key exchange. MUST NOT be used per RFC 9325.

This tool covers the most commonly encountered cipher suites but does not include every entry in the IANA registry (which has over 300 suites, many of which are obscure or never implemented). The dataset focuses on suites that appear in real-world configurations: all TLS 1.3 suites, the Mozilla-recommended TLS 1.2 suites, commonly seen CBC and RSA suites, and notable insecure suites that auditors frequently encounter.

The security ratings follow ciphersuite.info and Mozilla guidelines as of 2026, but individual deployments may have additional constraints. For example, a suite rated 'Recommended' might be inappropriate if your server lacks an ECDSA certificate (required for ECDHE-ECDSA suites) or if your clients do not support ChaCha20-Poly1305.

For the authoritative list of all registered cipher suites, consult the IANA TLS Cipher Suites registry. For deployment recommendations, follow RFC 9325 and the Mozilla Server Side TLS wiki.

Choosing the right cipher suites is one of the most impactful TLS configuration decisions you can make. Enabling weak or insecure suites exposes your users to padding oracle attacks, lack of forward secrecy, and even trivial decryption by anyone who captures the traffic. The Mozilla intermediate profile and RFC 9325 provide clear guidance: use TLS 1.3 with all five suites, use TLS 1.2 only with ECDHE and AEAD, and disable everything else. This lookup tool helps you identify which suites to enable, understand why each suite is rated the way it is, and explain the tradeoffs to stakeholders. For related tools on this site, try the AES encryption tool or the hash calculator. For the complete IANA registry, visit the TLS Parameters page.