Major changes from 1.2: static RSA and finite-field key transport removed (only ephemeral (EC)DHE, now also hybrid KEMs); all cipher suites are AEADs and name only the AEAD and hash; handshake messages after ServerHello are encrypted; renegotiation and compression removed; RSA signatures in the handshake must use PSS; the key schedule is HKDF-based; resumption uses pre-shared keys with optional 0-RTT data.
Version negotiation hides in the supported_versions extension: the legacy version field still says TLS 1.2 (0x0303) because middleboxes broke on new values, and the server signals a downgrade in the last 8 bytes of ServerHello.random. RFC 9846 incorporates errata and clarifications without changing the wire protocol.
Support is near-universal in browsers and libraries (OpenSSL 1.1.1 and later, Go, Java 11 and later, .NET, Windows 11 and Server 2022). Post-quantum key exchange (X25519MLKEM768) and Encrypted Client Hello are TLS 1.3 only.