TLS Overhead
Calculate the latency and bandwidth overhead introduced by TLS handshakes and encryption.
Inputs
Record header + MAC/AEAD tag, typically 20-40 bytes
Data Overhead
0.177%
Handshake Latency Added
50.00ms
Extra Round-Trips for Handshake
1
Total Bytes on Wire (per record)
16,413bytes
Step by step
Values used
Application Data Size (per record) = 16,384 bytes; TLS Version = TLS 1.3 (1-RTT handshake); TLS Record Overhead = 29 bytes; Round-Trip Time = 50 ms
Data overhead percentage
data_overhead% = record_overhead / payload_size × 100
Handshake latency
latency_overhead = extra_RTTs × RTT
Data Overhead
= 0.177
Handshake Latency Added
= 50.00 ms
Extra Round-Trips for Handshake
= 1
Total Bytes on Wire (per record)
= 16,413 bytes
How it works
TLS introduces two distinct kinds of overhead: a one-time handshake latency (extra round-trips before application data can flow) and a per-record bandwidth overhead (extra bytes added to every encrypted record for headers and authentication tags). TLS 1.3 reduced the handshake from two round-trips (TLS 1.2) to one by combining the key exchange and cipher negotiation into a single round-trip, cutting connection setup latency roughly in half on high-latency links. The per-record data overhead is small and fixed (20-40 bytes) but matters more for streams of small records.
Formulas
Data overhead percentage
data_overhead% = record_overhead / payload_size × 100
- h
- TLS record header + MAC/tag overhead in bytes
- p
- Application data size in bytes
Handshake latency
latency_overhead = extra_RTTs × RTT
- n_{RTT}
- 1 for TLS 1.3, 2 for TLS 1.2
Frequently Asked Questions
Why is TLS 1.3's handshake faster than TLS 1.2's?
TLS 1.2 negotiates the cipher suite and exchanges keys across two round-trips. TLS 1.3 restructured the handshake so the client can send its key share in the very first message, letting the server respond with everything needed to finish in a single round-trip.
Does TLS overhead matter for large file transfers?
The one-time handshake latency becomes negligible relative to total transfer time for large files, but the fixed record-level overhead is proportionally tiny too — bandwidth overhead from TLS is much more noticeable for many small requests (e.g. API calls) than for bulk data transfer.
What is TLS 0-RTT and does this calculator account for it?
TLS 1.3 also supports an optional 0-RTT mode for resumed connections, where the client can send data immediately using a previously established session ticket. This calculator models the standard 1-RTT full handshake, not the 0-RTT resumption case, which carries some replay-attack tradeoffs.
How does TLS record overhead compare to VPN overhead?
They're conceptually similar — both add fixed per-packet/per-record bytes for encryption and authentication — but TLS operates per data record within an already-established TCP connection, while a VPN encapsulates entire IP packets, typically with somewhat larger overhead. See the VPN Overhead calculator for that comparison.