TLS ClientHello Inspector
Decode captured ClientHello record bytes without making a TLS connection.
Loading tool…
How to use TLS ClientHello Inspector
Decode captured ClientHello record bytes without making a TLS connection. A bounded wire reader checks record/handshake/vector lengths, lists cipher suites, and decodes supported SNI, ALPN and version extensions. Unknown extensions remain hex data rather than guessed structures.
- Provide one tls record as hexadecimal.
- Choose the supported mode and run the tool. Review its assumptions and any reported errors.
- Copy the result or download a separate output; reset to clear the current form.
Good to know
- One complete unfragmented TLS handshake record, at most64KiB and100 extensions. Encrypted/fragmented handshakes are unsupported.
- Captured declarations do not prove a negotiated cipher, certificate identity, connection safety or successful handshake. No network traffic is sent.
- Inputs are processed on this device and are not automatically saved or uploaded.
Common questions
Is SNI a verified server identity?
No. It is a name advertised in the captured ClientHello. This offline parser neither connects to that name nor authenticates a certificate.
Does this change my original input?
No. The tool returns a separate result. Review that output before using it in another application.
Keep going with related tools
All developer →Binary Hex Viewer
Display a bounded byte slice with hexadecimal offsets, hex values and an escaped ASCII view.
DeveloperHTTP Message Framing Inspector
Inspect one supplied HTTP1 message and decode strictly bounded chunked content offline.
DeveloperIP Subnet Workbench
Calculate exact IPv4/IPv6 CIDR bounds, address count and membership.