# Why not decrypt TLS traffic for inspection?

Decryption gives payload visibility, but it means running an interception point that holds keys, installing an interception certificate on every device, and handling decrypted content that may include personal data. Since TLS 1.3, a passive sensor can no longer decrypt sessions with a copy of the server's private key.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/why-not-decrypt-tls-traffic-for-inspection

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What does TLS inspection on a firewall break?](https://netsenx.com/en/faq/what-does-tls-inspection-on-a-firewall-break)
- [Can deep packet inspection work on encrypted traffic?](https://netsenx.com/en/faq/can-deep-packet-inspection-work-on-encrypted-traffic)
- [Can malware be detected from flow statistics alone?](https://netsenx.com/en/faq/can-malware-be-detected-from-flow-statistics)
- [Can encrypted traffic reveal what is inside it?](https://netsenx.com/en/faq/can-encrypted-traffic-reveal-what-is-inside)
- [Is network metadata personal data under GDPR?](https://netsenx.com/en/faq/is-network-metadata-personal-data-under-gdpr)