Tool

TLS/SSL Cheat Sheet

Compare cipher suites, key sizes, and protocol versions.

Protocol

Status

10 suitesSorted by protocol and strength

Suite	Protocol	Key exchange	Auth	Symmetric	Bits	PFS	Status
TLS_AES_128_GCM_SHA256	TLS 1.3	ECDHE	RSA or ECDSA	AES-GCM	128	Yes	recommended
TLS_AES_256_GCM_SHA384	TLS 1.3	ECDHE	RSA or ECDSA	AES-GCM	256	Yes	recommended
TLS_CHACHA20_POLY1305_SHA256	TLS 1.3	ECDHE	RSA or ECDSA	ChaCha20-Poly1305	256	Yes	recommended
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	TLS 1.2	ECDHE	RSA	AES-GCM	128	Yes	recommended
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	TLS 1.2	ECDHE	RSA	AES-GCM	256	Yes	recommended
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256	TLS 1.2	ECDHE	ECDSA	AES-GCM	128	Yes	recommended
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384	TLS 1.2	ECDHE	ECDSA	AES-GCM	256	Yes	recommended
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	TLS 1.2	ECDHE	RSA	ChaCha20-Poly1305	256	Yes	ok
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256	TLS 1.2	ECDHE	ECDSA	ChaCha20-Poly1305	256	Yes	ok
TLS_RSA_WITH_AES_128_GCM_SHA256	TLS 1.2	RSA	RSA	AES-GCM	128	No	legacy

RSA keys:2048-bit minimum, 3072-bit recommended for long-lived certs.

ECDSA keys:P-256 gives ~128-bit security; P-384 gives ~192-bit.

Ed25519:Fast, modern option with ~128-bit security.

AES-128:Balanced performance and security for most workloads.

AES-256:Higher security margin, slower on some CPUs.