TLS Cipher Parser

Inspect a TLS ClientHello record or look up four-digit cipher-suite IDs. Paste hexadecimal TLS bytes, not Ethernet/IP/TCP headers or an entire packet capture. Spaces, colons, commas and leading 0x prefixes are accepted; bytes must be complete. Example loads a synthetic record for example.enti.to; Clear removes input and results.

The example offers TLS1.3, eleven suites and eight extensions. Highest offered version means the greatest non-GREASE version in supported_versions, regardless of list order; it is not the version selected by a server. Record and legacy fields are under Record details. Cipher suites preserve the client order. TLS1.3 suites specify AEAD and hash; key exchange and authentication are separate. GREASE placeholders are retained, not treated as real versions.

Extensions decode SNI, supported groups, signatures, ALPN, versions and key shares. Unknown IDs remain visible with their byte length; not being in the limited local registry does not mean an ID is unassigned or insecure. Length fields and decoded vectors must match; malformed data is rejected rather than silently truncated. This is an inspector, not a complete handshake implementation or security scanner.

Only one complete, unfragmented ClientHello in one TLS record is supported: no TCP reassembly, QUIC, DTLS or encrypted handshakes. Limits:16KiB record payload,100000 input characters,512 suites/256 extensions; ID lookup256 entries. Click Inspect or press Ctrl/Command+Enter in the text area; Example loads and inspects a synthetic record. After the first action, edits and mode changes update directly. Clear stops automatic inspection. Large tables scroll locally with keyboard support. Both raw inputs, selected mode and open record details are remembered locally; computed tables and errors are never saved or rebuilt on opening/reload. Switching modes keeps each draft separately. Clear removes only the active draft. Above automatic storage capacity, both drafts stay live within the app; download the raw TXT files before reload, which restores the previous saved inputs. No session JSON files or server analysis.