TLS Cipher Suites: TLS 1.3 and TLS 1.2 List with Client Support
A cipher suite names the algorithms a TLS connection uses. The client offers a list in its ClientHello, in order of preference, and the server picks one.
TLS 1.3 changed what a suite means. Its five suites, such as TLS_AES_128_GCM_SHA256, name only the record encryption and the hash for key derivation; key exchange and certificate signatures are negotiated separately through the supported_groups, key_share and signature_algorithms extensions. TLS 1.2 suites, such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, spell out everything: key exchange, certificate type, cipher and hash.
Modern clients offer both kinds: the TLS 1.3 suites first, then TLS 1.2 suites for older servers, often ending with legacy static RSA and CBC suites for maximum compatibility. Which suites a client offers, and in what order, depends on its TLS library rather than on the application, which makes the list one of the strongest fingerprinting signals. JA3 hashes the list in the order sent; JA4 sorts it first and counts it in its prefix.
The tables below show the suites we have documented so far, with how many of the clients we measured send each one. Open a suite to see the full per-client breakdown.
TLS 1.3 cipher suites
| Name | Code | What it does | Status | Sent by measured clients |
|---|---|---|---|---|
| TLS_AES_128_GCM_SHA256 | 4865 | The default TLS 1.3 cipher suite: AES-128 in GCM mode for encryption and SHA-256 for key derivation, offered by every modern client. | recommended | 12 of 12 |
| TLS_AES_256_GCM_SHA384 | 4866 | A TLS 1.3 cipher suite with AES-256 in GCM mode and SHA-384 for key derivation, offered by every measured client. | recommended | 12 of 12 |
| TLS_CHACHA20_POLY1305_SHA256 | 4867 | A TLS 1.3 cipher suite built on ChaCha20-Poly1305, fast on devices without AES hardware. Every measured client offers it. | recommended | 12 of 12 |
TLS 1.2 cipher suites
| Name | Code | What it does | Status | Sent by measured clients |
|---|---|---|---|---|
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | 158 | A TLS 1.2 cipher suite with finite-field Diffie-Hellman key exchange and AES-128-GCM. Libraries offer it, browsers do not. | legacy | 7 of 12 |
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | 159 | A TLS 1.2 cipher suite with DHE key exchange, an RSA certificate and AES-256-GCM. OpenSSL clients still offer it early. | legacy | 7 of 12 |
| TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | 52394 | A TLS 1.2 cipher suite with DHE key exchange and ChaCha20-Poly1305. Only curl, Guzzle and Node.js offer it in our data. | legacy | 4 of 12 |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA | 49161 | A legacy TLS cipher suite for ECDSA certificates with AES-128-CBC and SHA-1. Chrome does not send it; most libraries do. | legacy | 6 of 12 |
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | 49195 | A TLS 1.2 cipher suite for ECDSA certificates: ECDHE key exchange with forward secrecy and AES-128-GCM encryption. | recommended | 12 of 12 |
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | 49196 | A TLS 1.2 cipher suite for ECDSA certificates with ECDHE key exchange, AES-256-GCM encryption and SHA-384. | recommended | 12 of 12 |
| TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 | 52393 | A TLS 1.2 cipher suite for ECDSA certificates using ChaCha20-Poly1305, fast on devices without AES hardware. | recommended | 12 of 12 |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | 49171 | A legacy TLS cipher suite with ECDHE key exchange and AES-128 in CBC mode with SHA-1, kept by Chrome for old servers. | legacy | 9 of 12 |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | 49191 | A TLS 1.2 cipher suite with ECDHE, AES-128-CBC and HMAC-SHA256. OpenSSL clients offer it, browsers do not. | legacy | 7 of 12 |
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | 49199 | A widely used TLS 1.2 cipher suite: ECDHE key exchange with forward secrecy, an RSA certificate and AES-128-GCM. | recommended | 12 of 12 |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | 49172 | A legacy TLS cipher suite with ECDHE key exchange and AES-256 in CBC mode with SHA-1, offered by browsers as a fallback. | legacy | 9 of 12 |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | 49192 | A TLS 1.2 cipher suite with ECDHE, AES-256-CBC and HMAC-SHA384. Common in OpenSSL defaults, absent from browsers. | legacy | 7 of 12 |
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | 49200 | A TLS 1.2 cipher suite with ECDHE key exchange, an RSA certificate, AES-256-GCM encryption and SHA-384. | recommended | 12 of 12 |
| TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | 52392 | A TLS 1.2 cipher suite for RSA certificates using ECDHE key exchange and ChaCha20-Poly1305 encryption. | recommended | 12 of 12 |
| TLS_EMPTY_RENEGOTIATION_INFO_SCSV | 255 | Not a real cipher: a signaling value in the cipher list that announces secure renegotiation support. Only curl sends it in our data. | — | 2 of 12 |
| TLS_RSA_WITH_3DES_EDE_CBC_SHA | 10 | TLS_RSA_WITH_3DES_EDE_CBC_SHA uses Triple DES, a 64-bit block cipher broken in practice by Sweet32. Only macOS curl still sends it. | insecure | 1 of 12 |
| TLS_RSA_WITH_AES_128_CBC_SHA | 47 | An old TLS cipher suite with static RSA key exchange, AES-128 in CBC mode and SHA-1, still sent by Chrome as a fallback. | legacy | 8 of 12 |
| TLS_RSA_WITH_AES_128_GCM_SHA256 | 156 | A legacy TLS 1.2 cipher suite with static RSA key exchange and no forward secrecy, kept by browsers for old servers. | legacy | 8 of 12 |
| TLS_RSA_WITH_AES_256_CBC_SHA | 53 | An old TLS cipher suite with static RSA key exchange, AES-256 in CBC mode and SHA-1. It is the last suite in Chrome's list. | legacy | 8 of 12 |
| TLS_RSA_WITH_AES_256_GCM_SHA384 | 157 | A legacy TLS 1.2 cipher suite: static RSA key exchange without forward secrecy, with AES-256-GCM encryption. | legacy | 8 of 12 |