ronutz

Cipher Suite Decoder

Enter a TLS cipher suite, as an IANA name, an OpenSSL or GnuTLS name, or a hex code point, to break it into its key exchange, authentication, cipher, mode, and MAC, with a plain-language security read-out and the official IANA recommendation. Runs entirely in your browser against a bundled copy of the IANA registry.

Documentation (Markdown)

TLS & transport
Documentation

Decoding runs locally against a bundled copy of the IANA TLS Cipher Suite registry. Nothing is sent anywhere.

Key-exchange groups

TLS negotiates the actual key-agreement group separately from the cipher suite, in the supported_groups extension. As "harvest now, decrypt later" drives the move to post-quantum key agreement, the hybrid groups below pair a classical curve with ML-KEM.

  • X25519MLKEM7680x11EC
    PQ hybridHybrid PQRecommended

    Combines X25519 with ML-KEM-768

  • SecP256r1MLKEM7680x11EB
    PQ hybridHybrid PQ

    Combines secp256r1 (P-256) with ML-KEM-768

  • SecP384r1MLKEM10240x11ED
    PQ hybridHybrid PQ

    Combines secp384r1 (P-384) with ML-KEM-1024

  • curveSM2MLKEM7680x11EE
    PQ hybridHybrid PQ

    Combines SM2 with ML-KEM-768

  • X25519Kyber768Draft000x6399
    PQ hybridHybrid PQObsolete

    Combines X25519 with Kyber768 (draft)

  • SecP256r1Kyber768Draft000x639A
    PQ hybridHybrid PQObsolete

    Combines secp256r1 (P-256) with Kyber768 (draft)

  • x255190x001D
    ECDHE curveClassicalRecommended
  • x4480x001E
    ECDHE curveClassicalRecommended
  • secp256r10x0017
    ECDHE curveClassicalRecommended
  • secp384r10x0018
    ECDHE curveClassicalRecommended
  • secp521r10x0019
    ECDHE curveClassical
  • secp224r10x0015
    ECDHE curveClassicalLegacy
  • secp192r10x0013
    ECDHE curveClassicalLegacy
  • ffdhe20480x0100
    Finite-field DHClassical
  • ffdhe30720x0101
    Finite-field DHClassical
  • ffdhe40960x0102
    Finite-field DHClassical
  • ffdhe61440x0103
    Finite-field DHClassical
  • ffdhe81920x0104
    Finite-field DHClassical

X25519MLKEM768 is the hybrid most browsers now send by default.

API endpointGEThttps://ronutz.com/api/v1/cipherDocumented, not served. Opens the specification.