Tests
HTTPS test
The Novabench HTTPS test measures how long it takes to open a real HTTPS connection to a target, broken down into each phase of the connection. It reports the negotiated TLS and certificate details, so you can see what a browser or app actually negotiates when it connects.
The HTTPS test is useful for diagnosing slow-to-load sites and checking whether DNS, TCP, or the TLS handshake is the bottleneck. It also confirms a server's certificate and protocol configuration and compares connection performance across targets. It runs on Windows, macOS, and Linux and needs no elevated permissions.
What the HTTPS test measures
Novabench times each connection in four phases:
Phase | What it measures |
|---|---|
DNS | Time for the operating system resolver to look up the target host. Novabench does not bypass the OS cache, so this reflects what your applications actually experience. |
TCP connect | Time to open the TCP socket to the resolved IP address. |
TLS handshake | Time to complete the TLS handshake and establish the encrypted session. |
Time to first byte | Time from the minimal request until the first response byte arrives. |
Together these phases account for the full cost of starting an HTTPS request before any page content transfers.
Cold and warm samples
The test runs two sets of samples against each target: cold samples with TLS session resumption disabled, then warm samples with resumption allowed. A warm connection can reuse keys from an earlier session and skip part of the handshake. Comparing the two sets shows how much time resumption saves on repeat connections.
For each target, Novabench runs 5 cold samples followed by 5 warm samples, one at a time, with a short randomized delay between samples. An uncounted priming connection seeds the warm set, so the first measured warm sample can resume. Each target has a time budget of about 60 seconds, and each phase has a 10 second timeout.
Reading your results
The HTTPS section shows the target host, the port (when it is not 443), and the resolved IP address, followed by the key metrics.
Headline metrics
- Time to first byte (cold): the median TTFB across cold samples.
- Time to first byte (warm) and warm speedup: shown when the warm connection is meaningfully faster, with the time saved.
- Slowest phase: which phase (DNS, TCP connect, TLS handshake, or first byte) takes the most time.
- Diagnostic read: a plain-language summary that names the slowest phase and states whether session resumption helps, for example "TLS handshake is the slowest phase (142 ms). Session resumption saves 40 ms (28%)."
Charts
- Timeline: grouped horizontal bars that show where each connection spends its time, cold compared to warm. This is the connection equivalent of a browser network waterfall.
- Resumption savings: the per-phase time the warm connection saves compared to cold.
For every phase, Novabench records the median, minimum, maximum, and standard deviation across samples, along with the sample count, separately for cold and warm.
Protocol and certificate details
A separate connection collects the negotiated facts, shown in an expandable details table:
Detail | Description |
|---|---|
ALPN | The negotiated application protocol (h2 or http/1.1). |
TLS version | The negotiated TLS version, for example TLS 1.3. |
Cipher suite | The negotiated cipher suite. |
Certificate chain | The number of certificates in the presented chain. |
Certificate expiry | Days until the leaf certificate expires. |
Issuer | The certificate issuer common name. |
Revocation checked | Whether an online revocation check ran, and how long it took, for example "Yes (85 ms)". |
Novabench detects session resumption by observing the TLS handshake directly, rather than guessing. The test reads the ServerHello for a TLS 1.3 pre-shared-key extension, or a TLS 1.2 session-ID echo. When the handshake does not reveal resumption, Novabench reports it as unknown rather than assuming a value.
When a target fails
If a connection cannot complete, Novabench reports which phase failed:
Failure | Meaning |
|---|---|
DNS failure | The host name did not resolve. |
TCP refused | The target refused the connection on that port. |
TCP timeout | The connection attempt timed out. |
TLS failure | The TLS handshake did not complete. |
HTTP failure | The connection opened, but no response byte arrived. |
A target that fails partway still records the phases it completed, so a TLS failure still shows the DNS and TCP connect times that preceded it.
Configuration
Targets
By default, the HTTPS test targets novabench.com. On Plus, you can add custom targets (up to 10) to test connection negotiation to specific sites, APIs, or internal hosts. Each target accepts a host name with an optional port, in the form host or host:port. A target tree lets you select or exclude individual targets before you run the test.
The test needs no elevated permissions and runs the same way on Windows, macOS, and Linux.
Feature availability by plan
Feature | Free | Plus |
|---|---|---|
HTTPS test (single default target) | Yes | Yes |
Multiple custom targets (up to 10) |
| Yes |
Cloud submission and sharing |
| Yes |
Advanced results grid filtering |
| Yes |
Related pages
- Speed test: measure download speed, upload speed, and latency
- DNS benchmark: test DNS resolver performance
- Traceroute: hop-by-hop route analysis with geographic visualization
- Network tests overview: how the network sub-tests relate and when to use each
