Forward Secrecy Checker

Check Perfect Forward Secrecy support

ECDHE

DHE

Cipher Suite

About Forward Secrecy Checker

Perfect Forward Secrecy (PFS) ensures that a compromised private key cannot be used to decrypt past sessions. Our Forward Secrecy Checker tests whether a server supports ephemeral key exchange mechanisms like ECDHE and DHE, which generate unique session keys for each connection. Servers without PFS are vulnerable to retroactive decryption if their private key is ever exposed.

How to Use

1Enter the domain name you want to test for PFS support.
2Click "Check" to connect and analyze the server's cipher suite configuration.
3Review the ECDHE and DHE support indicators and the negotiated cipher suite.

Use Cases

•Verify PFS is enabled on production web servers and APIs
•Audit third-party services and CDN providers for PFS compliance
•Ensure compliance with security standards requiring PFS support
•Compare cipher suite preferences across different server configurations

Frequently Asked Questions

PFS generates a unique session key for each connection using ephemeral key exchange. If the server's private key is later compromised, past sessions cannot be decrypted because the session key is not derived from the private key.

ECDHE uses elliptic curve cryptography for key exchange, which is faster and more secure than DHE (Diffie-Hellman Ephemeral). ECDHE is preferred and widely supported in modern TLS configurations.

Prioritize ECDHE and DHE cipher suites in your TLS configuration. On Nginx use `ssl_ciphers ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM;` and ensure you have strong Diffie-Hellman parameters configured.

Tips & Best Practices

•Enable forward secrecy with ECDHE or DHE key exchange
•Prioritize forward secrecy cipher suites in server configuration
•Test forward secrecy support from different client configurations
•Monitor forward secrecy status across your infrastructure

Technical Details

Protocol: Forward Secrecy (Perfect Forward Secrecy) support
Key Exchange: ECDHE and DHE key exchange analysis
Security: Forward secrecy security benefits and implementation
Output: Forward secrecy support status with recommendations