TLS Overhead
Calculate the latency and bandwidth overhead introduced by TLS handshakes and encryption.
About TLS Overhead
TLS introduces two distinct kinds of overhead: a one-time handshake latency (extra round-trips before application data can flow) and a per-record bandwidth overhead (extra bytes added to every encrypted record for headers and authentication tags). TLS 1.3 reduced the handshake from two round-trips (TLS 1.2) to one by combining the key exchange and cipher negotiation into a single round-trip, cutting connection setup latency roughly in half on high-latency links. The per-record data overhead is small and fixed (20-40 bytes) but matters more for streams of small records.
Formulas
Data overhead percentage
data_overhead% = record_overhead / payload_size × 100
- h
- TLS record header + MAC/tag overhead in bytes
- p
- Application data size in bytes
Handshake latency
latency_overhead = extra_RTTs × RTT
- n_{RTT}
- 1 for TLS 1.3, 2 for TLS 1.2
Worked example
With the default values below, TLS Overhead returns Data Overhead of 0.177%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Application Data Size (per record)minimum 1 bytes
- 16,384 bytes
- TLS Versionone of TLS 1.3 (1-RTT handshake), TLS 1.2 (2-RTT handshake)
- TLS 1.3 (1-RTT handshake)
- TLS Record Overheadaccepts 20–40 bytes
- 29 bytes
- Round-Trip Timeminimum 0 ms
- 50 ms
Results
- Data Overhead
- 0.177%
- Handshake Latency Added
- 50.00 ms
- Extra Round-Trips for Handshake
- 1
- Total Bytes on Wire (per record)
- 16,413 bytes
Step by step
- 1Values used
- 2Data overhead percentage
- 3Handshake latency
- 4Data Overhead= 0.177
- 5Handshake Latency Added= 50.00 ms
- 6Extra Round-Trips for Handshake= 1
- 7Total Bytes on Wire (per record)= 16,413 bytes
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or compounding frequency into account.
- Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Why is TLS 1.3's handshake faster than TLS 1.2's?
TLS 1.2 negotiates the cipher suite and exchanges keys across two round-trips. TLS 1.3 restructured the handshake so the client can send its key share in the very first message, letting the server respond with everything needed to finish in a single round-trip.
Does TLS overhead matter for large file transfers?
The one-time handshake latency becomes negligible relative to total transfer time for large files, but the fixed record-level overhead is proportionally tiny too — bandwidth overhead from TLS is much more noticeable for many small requests (e.g. API calls) than for bulk data transfer.
What is TLS 0-RTT and does this calculator account for it?
TLS 1.3 also supports an optional 0-RTT mode for resumed connections, where the client can send data immediately using a previously established session ticket. This calculator models the standard 1-RTT full handshake, not the 0-RTT resumption case, which carries some replay-attack tradeoffs.
How does TLS record overhead compare to VPN overhead?
They're conceptually similar — both add fixed per-packet/per-record bytes for encryption and authentication — but TLS operates per data record within an already-established TCP connection, while a VPN encapsulates entire IP packets, typically with somewhat larger overhead. See the VPN Overhead calculator for that comparison.