mTLS Performance Calculator

Estimate the latency and CPU cost added by enabling mutual TLS between services.

About mTLS Performance Calculator

mTLS cost has two components: a one-time handshake cost paid only by new connections, and a small per-request encryption cost paid on every request regardless of connection age: avg_latency = handshake_overhead_ms × (1 − reuse_rate) + per_request_encryption_us ÷ 1000. Connection reuse is the dominant lever for amortizing handshake cost — at a 95% reuse rate, only 1 in 20 requests pays the full handshake penalty, while all requests pay the much smaller steady-state encryption cost.

Formula

handshake_overhead_ms = handshakes_per_sec × handshake_duration_ms / connections_reused

handshakes_per_sec: New TLS handshakes per second
handshake_duration_ms: Duration of one TLS handshake (ms)
connections_reused: Connection reuse factor

Worked example

With the default values below, mTLS Performance Calculator returns Avg mTLS Latency per Request of 0.2300. Change any input above and every figure here is recalculated in your browser.

Inputs used

Handshake Overheadaccepts 0–10,000 ms: 3 ms
Connection Reuse Rateaccepts 0–100 %: 95 %
Per-Request Encryption Costaccepts 0–1,000,000 µs: 80 µs
Request Rateaccepts 0–10,000,000 requests/sec: 2,000 requests/sec

Results

Avg mTLS Latency per Request: 0.2300 ms
Total mTLS CPU Cost: 0.460 cores
Amortized Handshake Cost: 0.1500 ms/request
Per-Request Encryption Cost: 0.080 ms
New Connections per Second: 100.0 connections/sec

Step by step

1Avg handshake overhead/request: handshake × new-connection rate= 0.1500ms
2Avg total latency/request: handshake share + encryption= 0.2300ms
3Total CPU cost: (new conns × handshake) + (requests × encryption)= 460.0 CPU-ms/sec (0.460 cores)

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax or compounding frequency into account.
Figures are rounded for display to 4 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why does connection reuse rate matter so much for mTLS overhead?

The TLS handshake (asymmetric crypto, certificate exchange) is orders of magnitude more expensive than the symmetric encryption used once a session is established — amortizing that one-time cost across many requests on a reused connection is the single biggest mTLS performance lever.

How much CPU does per-request encryption really cost?

Modern CPUs with AES-NI hardware acceleration can encrypt/decrypt payloads with very low overhead — often tens of microseconds per request for typical payload sizes — making steady-state encryption cost much smaller than handshake cost per new connection.

What causes a low connection reuse rate?

Short-lived connections (e.g. from serverless functions, connection pool churn, or aggressive idle timeouts), high pod churn from frequent scaling/redeployment, and clients that don't implement HTTP keep-alive all reduce reuse rate and increase average mTLS overhead.

Does session resumption help beyond connection pooling?

Yes — TLS session resumption (session tickets/IDs) lets a new connection skip the full handshake even without reusing the underlying TCP connection, which is especially valuable for short-lived but frequent connections between the same peers.