Forward secrecy, also called perfect forward secrecy (PFS), is a property of a key exchange in which every session derives its encryption keys from short-lived values that are discarded afterward. Compromising the server's long-term private key later does not let an attacker decrypt recorded traffic.
Why it matters
Without it, an attacker who records encrypted traffic today and steals your private key next year can read everything. This "harvest now, decrypt later" scenario was the main reason the industry moved to ephemeral Diffie-Hellman (DHE and ECDHE) key exchange. In TLS 1.3 forward secrecy is mandatory, because static RSA key exchange was removed.
In TLS 1.2 it depends on the cipher suite you allow. Suites whose names begin with ECDHE- or DHE- provide it, while plain AES128-GCM-SHA256 style RSA key exchange does not.
Example
Check what a server negotiates:
openssl s_client -connect example.com:443 -tls1_2 </dev/null 2>/dev/null | grep -E "Cipher|Server Temp Key"A line such as Server Temp Key: X25519 or ECDH, P-256 shows an ephemeral exchange.
Common mistakes
- Leaving legacy RSA key exchange suites enabled for old clients.
- Leaving session tickets on with a long-lived ticket key, which can undermine the benefit.
- Assuming HTTPS alone means forward secrecy.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.