# TLS Cipher Suite Lookup: IANA, OpenSSL Names and Hex Codes

> Look up TLS cipher suites by IANA name, OpenSSL name or hex code: key exchange, auth, encryption, MAC, TLS versions and rating.

Source: https://ssl.sh/tools/cipher-suite-lookup/
Last updated: 2026-11-10

Search TLS cipher suites by IANA name, OpenSSL name or hex code and see what each one uses and how secure it is.

Cipher suite lookup translates between the names TLS cipher suites go by and shows what each one is made of. Type an IANA name such as `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`, an OpenSSL name such as `ECDHE-RSA-AES128-GCM-SHA256`, or a hex code such as `0xC0,0x2F`, and the matching suites appear with their key exchange, authentication, cipher, MAC, TLS versions and rating.

## How to use it

1. Type part of a name or a hex code into the search box. Results update as you type.
2. Filter by TLS version or rating if the list is long.
3. Click a suite's IANA name for its detail page.

## Reading a cipher suite name

A TLS 1.2 name lists four parts. `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256` means: ECDHE key exchange ([forward secrecy](https://ssl.sh/glossary/forward-secrecy/)), RSA certificate for authentication, AES-128 in GCM mode for encryption ([AEAD](https://ssl.sh/glossary/aead/)), and SHA-256 for the handshake PRF.

TLS 1.3 names such as `TLS_AES_128_GCM_SHA256` only name the AEAD cipher and hash: key exchange (for example X25519 or the post-quantum hybrid X25519MLKEM768) and the certificate type are negotiated separately.

## What the ratings mean

Suites with forward-secret key exchange and AEAD encryption are the current recommendation (RFC 9325). CBC-mode suites and RSA key exchange are legacy: still found on old servers, not needed by current clients. RC4, 3DES, export and NULL suites are insecure and should be disabled. To build a configuration that enables only good suites, use the [TLS config generator](https://ssl.sh/tools/tls-config-generator/).


## FAQ

**How do I convert an OpenSSL cipher name to the IANA name?**

Search for the OpenSSL name here, or run openssl ciphers -stdname -V on a system with OpenSSL: it lists both names and the hex code for every suite your OpenSSL supports.

**Which cipher suites should I enable?**

For TLS 1.3, the defaults. For TLS 1.2, ECDHE key exchange with AES-GCM or ChaCha20-Poly1305 only, as in the intermediate profile of the TLS config generator. Avoid CBC, RC4, 3DES and static RSA key exchange.

**What does the hex code mean?**

It is the two-byte identifier sent in the ClientHello and ServerHello. Packet captures and some logs show only this code, so the lookup accepts formats such as 0x13,0x01, 0x1301 and 1301.