Defaults.Exposed › October 2026 census › v10 registry › Cipher strength
Cipher strength
Methodology v10 · canonical ID cipher-strength · TLS (Transport Layer Security) & Certificates · scored
Strong encryption protecting data in transit.
Cipher strength: definition
| Canonical ID | cipher-strength |
|---|---|
| Category | TLS & Certificates |
| Grade impact | Scored, counts toward the grade |
| Pass | The negotiated cipher suite is a modern AEAD (Authenticated Encryption with Associated Data) suite (e.g. AES-GCM or ChaCha20-Poly1305). |
| Fail | A weak or deprecated cipher (RC4, 3DES, export-grade, CBC-only legacy suites) is negotiated. |
| Example (passing) | Cipher: TLS_AES_128_GCM_SHA256 |
Cipher strength across the census
The public census rollup does not publish a per-check figure for cipher-strength (as of October 12, 2026).
Whole-census aggregates live on the census data page; no number is shown here rather than an estimated one.
Census denominator: 332,492,319 graded domains. Aggregates only: never an individual domain's result.
How this check is scored
Cipher strength is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
Why no figure is shown
In the October 2026 census this check did not fail on any completed handshake. The census scanner offers only modern cipher suites, so a server limited to weak suites cannot complete the handshake at all and never reaches this check. A pass share of 100% would describe the limits of the scanner, so none is published. The check stays on the v10 registry because it is scored: a live scan still grades a domain against the pass and fail rules above.
Further reading: The TLS version check: pass and fail rules
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix Modern encryption
Cite this check
Defaults.Exposed, "Cipher strength (cipher-strength)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/cipher-strength
Permalink: https://defaults.exposed/methodology/cipher-strength ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data