Free Cipher Suite Analysis

Free Cipher Suite Analysis

Free tool

Check your TLS cipher suites for weak algorithms, missing Perfect Forward Secrecy, and outdated TLS versions. Includes ready-to-paste Nginx, Apache, and Node configs.

  • Cipher suite strength analysis
  • Perfect Forward Secrecy validation
  • Weak cipher detection
  • TLS version compatibility check
No credit card requiredProduction-safe (100% passive)No setup or code required
Trusted by 3,500+ security & engineering teams
Oracle logoShopify logoGoDaddy logoChubb logoToshiba logoMAPFRE logoBelfius logoGBG logoWEKA logoShift Technology logo

What you get for free

18 core security checks via this tool, passive scans, step-by-step remediation, security score on every result.

What Essential adds at $39/mo

+17 advanced checks, continuous monitoring, daily security score history, email alerts, GitHub SAST, board-ready PDFs, SOC 2 / ISO 27001 / PCI reports.

What are Cipher Suites?

Cipher suites are combinations of cryptographic algorithms used to establish secure connections. They determine encryption strength, key exchange methods, and message authentication. Modern cipher suites use AEAD (Authenticated Encryption with Associated Data) for optimal security and performance.

Perfect Forward Secrecy (PFS)

PFS ensures that past communications remain secure even if long-term private keys are compromised. Look for ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) or DHE (Diffie-Hellman Ephemeral) in your cipher suite names to ensure PFS is enabled.

Cipher Suite Optimization

  • Prioritize AEAD ciphers (AES-GCM, ChaCha20-Poly1305)
  • Enable ECDHE for Perfect Forward Secrecy
  • Disable weak ciphers (RC4, 3DES, CBC without proper padding)
  • Use strong key exchange algorithms (ECDHE, DHE)
  • Configure cipher suite order by strength

Modern Security Standards

  • Preferred: TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256
  • Acceptable: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  • Avoid: RC4, 3DES, CBC mode without proper padding
  • Deprecated: MD5, SHA-1 (except for HMAC in TLS 1.2)

What this analysis covers

  • Supported cipher suites and their strength
  • Perfect Forward Secrecy (PFS) validation
  • Weak or deprecated cipher detection
  • TLS version compatibility and preferences
  • Key exchange algorithm analysis
  • Encryption algorithm strength assessment

Implementation examples

Once you've identified the gap, applying the fix is straightforward. Here are the three configurations developers reach for most often.

Nginx

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256";
ssl_ecdh_curve X25519:secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;

Apache

SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLHonorCipherOrder     on
SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
SSLOpenSSLConfCmd       Curves X25519:secp384r1
SSLSessionTickets       off

Node.js (Express + Helmet)

import https from "node:https"
import fs from "node:fs"
import express from "express"
import helmet from "helmet"

const app = express()
app.use(helmet({ hsts: { maxAge: 31536000, includeSubDomains: true, preload: true } }))

https
  .createServer(
    {
      key: fs.readFileSync("server.key"),
      cert: fs.readFileSync("server.crt"),
      minVersion: "TLSv1.2",
      ciphers: [
        "TLS_AES_256_GCM_SHA384",
        "TLS_CHACHA20_POLY1305_SHA256",
        "TLS_AES_128_GCM_SHA256",
        "ECDHE-ECDSA-AES256-GCM-SHA384",
        "ECDHE-RSA-AES256-GCM-SHA384",
        "ECDHE-ECDSA-CHACHA20-POLY1305",
        "ECDHE-RSA-CHACHA20-POLY1305",
      ].join(":"),
      honorCipherOrder: true,
      ecdhCurve: "X25519:secp384r1",
    },
    app,
  )
  .listen(443)

Tool-specific questions

What's the difference between AES-128 and AES-256?

AES-256 provides stronger encryption than AES-128, but both are considered secure. AES-128 is often preferred for performance, while AES-256 is used for maximum security requirements.

Should I disable all CBC ciphers?

Not necessarily. While CBC ciphers can be vulnerable to padding oracle attacks if not properly implemented, they're acceptable when used with proper padding and in the right context.

What are AEAD ciphers?

AEAD (Authenticated Encryption with Associated Data) ciphers provide both encryption and authentication in a single operation, making them more secure and efficient than traditional ciphers.

How often should I review cipher suite configuration?

Regular reviews are recommended, especially after security updates or when new vulnerabilities are discovered. Use Barrion's continuous monitoring to track cipher suite changes over time.

Can I use different cipher suites for different TLS versions?

Yes, you can configure different cipher suites for different TLS versions. TLS 1.3 has a simplified cipher suite list, while TLS 1.2 offers more options but requires careful configuration.
Why Barrion

Built for the engineers who already have enough to fix.

Speed

Real-time results

Instant analysis with a detailed report. You see findings as the scan runs, not after.
Coverage

Comprehensive checks

35+ checks per scan covering TLS, headers, CORS, cookies, DNS, email auth, and more, in a single pass.
Action

Step-by-step fixes

Every finding ships with the exact remediation step for your framework. Hand it to the engineer who owns the surface.
Other tools

More free checks, for the rest of your surface.

Complete Security Scan

Complete website security analysis with comprehensive vulnerability detection

Pre-Pentest Security Scan

Passive scan that catches the misconfigurations a pentester finds first. Use it before a manual engagement to clear the easy issues.

Security Compliance Checker

Check compliance with PCI DSS, HIPAA, SOC 2, ISO 27001, and GDPR. Get compliance readiness reports.

WAF Checker

Detect Web Application Firewall presence through passive header analysis. Identify WAF/CDN providers.

Security Headers Test

Check your website's HTTP security headers configuration

TLS/SSL Security Checker

Validate your SSL/TLS configuration and certificate setup
Browse all security tools →
FAQ

Frequently asked.

What is Barrion and how does it enhance website security?
Barrion is a security testing and monitoring platform for engineering teams, covering three products: passive DAST that continuously watches your live web apps and APIs, SAST via GitHub that scans your codebase for secrets, insecure patterns and vulnerable dependencies, and AI pentesting that runs active, agent-driven attacks with proof-of-exploit. Findings come with step-by-step fixes you can ship immediately.
How safe is Barrion to use for security testing?
Every default Barrion scan is 100% passive and read-only. We never submit forms, brute-force endpoints or interact with state-changing routes, so it's safe to run against production.
What types of security issues does Barrion identify?
Barrion is a security testing and monitoring platform, so coverage spans three surfaces. Passive DAST flags misconfigurations across TLS/HTTPS, security headers, cookie flags, CORS policy, DNS records, email authentication (SPF/DKIM/DMARC), network exposure and common web hygiene issues. SAST via GitHub finds secrets in code, insecure patterns and vulnerable dependencies. AI pentesting adds exploitable findings like SQL injection, XSS and broken access control with proof-of-exploit.
What specific security checks does Barrion perform?
Barrion checks TLS/HTTPS configuration, HTTP security headers, cookie flags, CORS policy, DNS and email authentication records, network exposure and common web hygiene issues, then prioritises them by severity with clear remediation.
What is Barrion's smart crawling?
Smart crawling automatically discovers the pages and endpoints of your app so scans cover the surface that matters, without you manually listing every URL.
How often does Barrion perform security scans?
Manual scans on demand. Continuous monitoring runs automatically on Essential (weekly+) and Business (daily), and alerts you the moment a new issue appears.
Is Barrion suitable for security testing of all business sizes?
Yes. Barrion is a security testing and monitoring platform, with passive DAST, SAST via GitHub and AI pentesting available to solo developers, startups, scale-ups and enterprise security teams alike, without adding headcount.
How does Barrion handle data security and privacy during security testing?
Scans are passive and read-only by default, and we never store or expose sensitive data from your application. Pentests are rate-limited and non-destructive, designed to confirm exploitability without altering data or affecting availability.
What if I'm not satisfied with Barrion's security testing service?
Paid plans start with a free trial, and you can cancel anytime. If something isn't right, contact us and we'll make it work for your team.
How does Barrion help with SOC 2, ISO 27001, NIS2, and other compliance frameworks?
Barrion produces audit-ready PDF and CSV reports suitable for SOC 2, ISO 27001, PCI DSS and NIS2, ready to share with auditors, customers and your board.

Anything else? Email contact@barrion.io.

Run a full report on your site.

Free first scan covers every check, no signup needed. Sign up to save the report and turn on continuous monitoring.

Get free reportSee pricing