TLS handshake explained
Before a browser can ask for your page over HTTPS it has to open a connection and agree on encryption keys. Each message crosses the network, so the handshake is counted in round trips — and on a phone far from your server, those add up fast.
Step through the messages
Press "Next message" or "Play" to start the handshake.
| Protocol | Round trips to first byte | At 100 ms RTT |
|---|---|---|
| TLS 1.2 | 4 | 400 ms |
| TLS 1.3 | 3 | 300 ms |
| TLS 1.3 0-RTT | 2 | 200 ms |
| HTTP/3 (QUIC) | 2 | 200 ms |
Excludes DNS lookup and server processing time. Each extra round trip also applies to every new third-party host a page connects to.
Why the handshake matters for speed
On a fibre connection near the server, a round trip might be 10 ms and the handshake is invisible. On mobile or across an ocean, 100–200 ms per round trip is normal, and a new TLS 1.2 connection costs 300–600 ms before the server even sees the request. That's the purple segment you see on the first request to each host in a waterfall chart.
The handshake is a nice example of a cost that is invisible in code but obvious once you watch it happen step by step. If you like learning this way, ahaboo has narrated interactive explainers on how everyday things work, one "aha" at a time.
How to make the handshake cheaper
- Enable TLS 1.3 on your server or CDN — one round trip saved on every new connection.
- Turn on HTTP/3 where your CDN supports it; QUIC folds the transport handshake into TLS.
- Reuse connections: HTTP keep-alive and HTTP/2 let one handshake serve every request to that origin.
- Use fewer origins on the critical path, and
<link rel="preconnect">the ones you can't avoid so the handshake overlaps other work. - Keep certificate chains short and enable OCSP stapling so the browser doesn't have to fetch revocation data.
- Terminate TLS close to users with a CDN, which cuts the round-trip time itself.
See your own numbers: the TTFB test splits DNS, TCP and TLS for any HTTPS URL.
Questions developers ask
What is a TLS handshake?
The exchange at the start of every HTTPS connection in which the browser and server agree on a TLS version and cipher, the server proves its identity with a certificate, and both sides derive shared encryption keys. Only after it completes can the HTTP request be sent.
How many round trips does a TLS handshake take?
A full TLS 1.2 handshake takes two round trips; TLS 1.3 takes one. Both come after the TCP handshake (one more round trip), so a new HTTPS connection costs 2 round trips with TLS 1.3 and 3 with TLS 1.2 before the request goes out — plus DNS if the host is new.
What is TLS 1.3 0-RTT?
When a browser reconnects to a server it has talked to recently, TLS 1.3 can send the HTTP request together with the first handshake message using a pre-shared key, removing the TLS round trip entirely. Because such early data can be replayed, servers should only accept it for safe, idempotent requests like GET.
Is SSL handshake the same as TLS handshake?
People use both names, but SSL is the obsolete predecessor; all SSL versions and TLS 1.0/1.1 are deprecated. Modern browsers negotiate TLS 1.2 or 1.3. "SSL handshake" in tools and articles almost always means the TLS handshake.
How does HTTP/3 change the handshake?
HTTP/3 runs over QUIC, which combines the transport and TLS 1.3 handshakes into a single round trip — there is no separate TCP handshake. Resumed connections can use 0-RTT.
How do I see TLS time for my site?
In a waterfall it is the purple "SSL" or "TLS" segment of the first request to each host. Run the TTFB test on this site to see DNS, connect and TLS for your domain separately.