Skip to content
ENExplore Calculators

Perfect Forward Secrecy Calculator

Score your forward-secrecy posture from the key exchange, ticket lifetime and ticket-key rotation, and size the exposure window.

About Perfect Forward Secrecy Calculator

Ephemeral key exchange means the session secret is never written down, so a later private-key theft cannot recover past traffic. Session tickets reintroduce a long-lived secret: whoever holds the ticket-encryption key can recover the resumption secret for every ticket it ever issued, so the real exposure window is the rotation interval plus the ticket lifetime. Forward secrecy is the only defence against harvest-now-decrypt-later, and it is routinely defeated in practice by TLS terminators that never rotate their session-ticket keys.

Formula

Perfect Forward Secrecy

exposure window = ticket-key rotation interval + ticket lifetime when the key exchange is ephemeral; without PFS it is the whole life of the certificate key.

ECDHE
Ephemeral Diffie-Hellman — a fresh key pair per session
ticket key
The symmetric key that encrypts session tickets — a shared secret across sessions
exposure window
How much recorded traffic one key compromise unlocks

Worked example

With the default values below, Perfect Forward Secrecy Calculator returns Forward Secrecy Score of 100. Change any input above and every figure here is recalculated in your browser.

Inputs used

Key exchangeone of ECDHE (ephemeral elliptic curve), DHE (ephemeral finite field), Static RSA key transport, Static ECDH
ECDHE (ephemeral elliptic curve)
Session-ticket key rotation intervalaccepts 0.25–8,760 hours
24 hours
Session-ticket lifetime offered to clientsaccepts 0.25–168 hours
8 hours
Sessions established per hourminimum 1 sessions
1,000,000 sessions
Assume an adversary is recording all traffic
Yes

Results

Forward Secrecy Score
100 /100
Rating
A — Excellent
Exposure Window on Key Compromise
32.00 hours
Sessions Decryptable per Compromise
32,000,000
Assessment
Strong forward secrecy — exposure limited to 32 hours

Step by step

  1. 1Values used
  2. 2Perfect Forward Secrecy
  3. 3Forward Secrecy Score= 100 /100
  4. 4Rating= A — Excellent
  5. 5Exposure Window on Key Compromise= 32.00 hours
  6. 6Sessions Decryptable per Compromise= 32,000,000
  7. 7Assessment= Strong forward secrecy — exposure limited to 32 hours

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Perfect Forward Secrecy calculated?

exposure window = ticket-key rotation interval + ticket lifetime when the key exchange is ephemeral; without PFS it is the whole life of the certificate key. Ephemeral key exchange means the session secret is never written down, so a later private-key theft cannot recover past traffic. Session tickets reintroduce a long-lived secret: whoever holds the ticket-encryption key can recover the resumption secret for every ticket it ever issued, so the real exposure window is the rotation interval plus the ticket lifetime.

Why does Perfect Forward Secrecy matter?

Forward secrecy is the only defence against harvest-now-decrypt-later, and it is routinely defeated in practice by TLS terminators that never rotate their session-ticket keys.

What values do I need to enter?

This calculator takes 5 inputs: Key exchange, Session-ticket key rotation interval, Session-ticket lifetime offered to clients, Sessions established per hour, Assume an adversary is recording all traffic. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Does TLS 1.3 give forward secrecy automatically?

The handshake does — every TLS 1.3 cipher suite uses ephemeral key exchange. Resumption does not: a PSK derived from a ticket encrypted under a static ticket key is only as forward-secret as that key's rotation schedule.

How often should ticket keys rotate?

Every few hours to a day, with old keys retained only long enough to decrypt outstanding tickets. Rotating on restart alone leaves keys live for the entire uptime of the process.

Related Calculators

Perfect Forward Secrecy Calculator | Calcrivo