Visual TLS Handshake
Step-by-step visualisation of TLS 1.2 and TLS 1.3 handshakes. Understand what happens behind the scenes.
The client sends a hello message with supported TLS 1.3 cipher suites, key share for key exchange, and other extensions. SNI is included.
Key fields:
- TLS version: 1.3
- Supported cipher suites
- Key share (client public key)
- SNI: example.com
The server responds with the selected cipher suite, its key share, and encrypted extensions. The server's certificate and CertificateVerify are also sent.
Key fields:
- Selected cipher suite
- Server key share
- Server certificate
- CertificateVerify
The server sends its certificate chain and a signature proving it owns the private key. This is sent along with ServerHello in TLS 1.3.
Key fields:
- Server certificate chain
- Signature proof
The server sends a Finished message encrypted with the handshake keys, confirming the handshake is complete.
Key fields:
- Encrypted verification data
The client sends its own Finished message, also encrypted with the handshake keys.
Key fields:
- Encrypted verification data
After the handshake completes, encrypted application data can be exchanged. TLS 1.3 is faster because it requires fewer round trips.
Key fields:
- Encrypted HTTP traffic
Why TLS 1.3 is faster
TLS 1.3 folds the key exchange into the first messages, so a connection is ready after a single round trip instead of two. It also removes older, weaker options and makes forward secrecy mandatory. Where you can choose, prefer TLS 1.3 and keep TLS 1.2 for compatibility.
Related tools
Compare the versions side by side in the TLS version comparator, or inspect the certificate the server presents during the handshake with the certificate chain visualiser.