OneTaskBy Tim King · Updated
TLS Cipher Suite List
Hex Codes, Key Exchange and Recommended Status for Every IANA TLS Suite
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the TLS Cipher Suites works
This TLS cipher suite list holds every suite IANA has assigned, from the NULL placeholders of the 1990s to the handful of TLS 1.3 suites in use today. Search by the two-byte hex code you see in a packet capture or server log, or by any part of the name, and each row shows the key exchange, cipher, hash and IANA's current verdict on it.
Reading a TLS cipher suite list
A TLS 1.2 suite name spells out four choices. In TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, ECDHE is the key exchange, RSA is the certificate signature, AES 128 GCM is the bulk cipher and SHA256 is the hash used for the handshake and, in older modes, the message check. The table splits the name at _WITH_ so you can filter on any part. TLS 1.3 suites are shorter, such as TLS_AES_128_GCM_SHA256, because 1.3 negotiates key exchange and signatures separately; those rows show "Any (TLS 1.3)" as the key exchange.
The hex code
Every suite has a two-byte code that the client lists in its ClientHello and the server echoes back. Wireshark, OpenSSL error messages and many load balancers log the code rather than the name, so 0xC02F is how you will often meet TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Type the code with or without the 0x.
What the IANA status means
Recommended means the suite has been through IETF review and is advised for general use. Discouraged means an RFC now says not to use it, usually because the cipher (RC4, 3DES, export grades) or the key exchange (static RSA) is broken or lacks forward secrecy. Not recommended simply means no IETF consensus either way — many national or niche suites sit here, and it is not a verdict that the suite is unsafe.
What the table leaves out
Reserved ranges, unassigned codes and signalling values such as the renegotiation SCSV are dropped, because they are not suites a server can pick. Library names differ too: OpenSSL calls the suite above ECDHE-RSA-AES128-GCM-SHA256, so search for the parts rather than the exact string if you are copying from an OpenSSL config.
FAQ
Which TLS cipher suites should a server enable?
For TLS 1.3, enable the AES GCM and ChaCha20 suites, which every modern library already does by default. For TLS 1.2, keep ECDHE key exchange with AES GCM or ChaCha20-Poly1305 and drop anything marked Discouraged, which removes RC4, 3DES, CBC-with-SHA1 and static RSA.
How do I find a cipher suite from its hex code?
Type the code into the search box, for example 0xC030 or just C030. The table matches the code with or without the prefix and shows the full name, its parts and its status, which is handy when a packet capture or a TLS error only gives the number.
Why are there so few TLS 1.3 cipher suites?
TLS 1.3 removed every cipher without authenticated encryption and moved key exchange and signatures into their own negotiation. That left only AEAD ciphers paired with a hash — AES GCM, AES CCM, ChaCha20-Poly1305 and the newer AEGIS — and the first three codes, 0x1301 to 0x1303, carry nearly all real traffic.
See also: all Tech Data tools, Everyday Data.
Related tools
SSL Certificate Inspector
Decode a PEM certificate and check its dates, names and fingerprints.
HTTP Header Inspector
Parse pasted HTTP headers, explain each one and audit security.
HMAC-SHA256 Generator
Sign a message with HMAC-SHA256 and verify signatures.
IP Address Info
Classify any IPv4 or IPv6 address and see its every form.
Certificate Expiry Calculator
See days left and the renewal date for any PEM certificate.