Your files stay on your device

TLS cipher suite analyzer

Grade a TLS handshake you ran yourself: paste openssl output and get forward-secrecy, AEAD, deprecated-version, and key-strength verdicts.

Paste a handshake transcript to grade it

Run one of the s_client commands below against your server, paste what it prints, and the grading runs here in the tab.

Commands to run

openssl s_client -connect example.com:443 -tls1_3 </dev/null
openssl s_client -connect example.com:443 -tls1_2 </dev/null
openssl s_client -connect example.com:443 -tls1_1 </dev/null 2>&1 | head -40
openssl s_client -connect example.com:443 -cipher 'AES128-SHA' -tls1_2 </dev/null 2>&1 | head -40

The first two lines show what the server picks when it is allowed its best. The -tls1_1 line and the forced -cipher line answer the harder question: what else the server still accepts. A handshake that fails with "no peer certificate available" or an alert means the server refused that version or suite, which is the result you want.

This page cannot open TLS handshakes: browsers give a page no socket API that can pin protocol versions or cipher lists, so nothing is probed from here. You run openssl on your own machine, the page grades the transcript. Grading follows the Mozilla Server Side TLS thresholds and the RFC 8996 deprecations: TLS 1.0 and 1.1 are deprecated, SSL is a critical finding, static RSA key exchange forfeits forward secrecy, and SHA-1 or MD5 certificate signatures are treated as critical. A grade covers one handshake, not the whole server: a server that still accepts TLS 1.0 on a second port will not show it in a 1.2-plus transcript.

All network tools

Was this tool useful?

TLS cipher suite analyzer

More network tools