TLS Cipher Suite Reference
Search or browse common TLS cipher suite names to see whether each is considered strong, acceptable, or weak/deprecated.
TLS 1.3 cipher suite — current best practice.
TLS 1.3 cipher suite — current best practice.
TLS 1.3, especially fast on devices without AES hardware acceleration.
TLS 1.2 with forward secrecy and AEAD encryption — widely recommended.
TLS 1.2 with forward secrecy and AEAD encryption — widely recommended.
Forward secrecy, but CBC mode instead of AEAD — acceptable but not preferred.
AEAD encryption, but no forward secrecy (static RSA key exchange).
3DES — deprecated due to the Sweet32 birthday attack.
RC4 has known biases making it cryptographically broken — disabled in all modern browsers.
NULL cipher provides no encryption at all.
A 1990s-era US export-grade cipher, trivially breakable today.
Covers a representative sample, not every cipher suite that exists — check your server or client's actual negotiated suite against current guidance (e.g. Mozilla's TLS configuration recommendations) for a full audit.
How to use this tool
- 1Search for a cipher suite name.
- 2See its security rating and a brief explanation.
Frequently asked questions
Where would I see a cipher suite name to look up?+
In a TLS/SSL scan report (like Qualys SSL Labs), a browser's connection security details, or your web server's TLS configuration file.