What is a TLS fingerprint?

A TLS fingerprint is the pattern of settings your browser offers when it opens an encrypted HTTPS connection. Every connection starts with a TLS handshake, where browser and server agree on encryption settings. The first message from your browser is the ClientHello. It lists supported TLS versions, cipher suites, TLS extensions, elliptic curves and other capabilities in a specific order. This combination of values is your TLS fingerprint.

The fingerprint describes the TLS library, not you as a person. Chrome, Firefox, curl, Python scripts and malware each build their ClientHello differently. For the wider picture, see our complete browser fingerprinting guide and the online privacy check overview.

TLS fingerprinting has one powerful property: it happens at the network level, before any page or script loads. Privacy settings, VPNs and proxies cannot intervene.

What does the TLS handshake reveal?

The ClientHello reveals which encryption options your client supports and in which order. It is mostly sent in plain text, so the server and anyone on the network path can read this metadata.

ClientHello fieldUsed by
TLS versionJA3, JA4
Cipher suitesJA3, JA4
Extensions (SNI, ALPN, key share …)JA3, JA4
Elliptic curves and point formatsJA3
Signature algorithms, ALPN value, SNI present or notJA4

TLS fingerprint JA3: the standard method

JA3 builds an MD5 hash from five ClientHello fields. Researchers at Salesforce (John Althouse, Jeff Atkinson and Josh Atkins) published it in 2017.

The fields are TLS version, cipher suites, TLS extensions, elliptic curves and elliptic curve point formats. JA3 joins their values in the order the client sent them and turns the string into a 32-character MD5 hash. JA3S does the same for the server's reply.

How unique is a JA3 fingerprint?

A JA3 fingerprint identifies a client type, not a person. All users of one browser build on one platform used to share the same hash, so JA3 is most useful for detecting browser types and anomalous traffic, not for tracking individuals. Cloudflare notes that mobile app traffic often shares one JA3 fingerprint across many devices.

Why does JA3 change on every Chrome connection?

Chrome shuffles the order of its TLS extensions in each ClientHello, so its JA3 hash changes with every connection. Fastly saw this from January 2023; the feature was planned for Chrome 110 and also appeared in versions 108 and 109. Salesforce archived the JA3 repository in May 2025.

JA4: the modern evolution

JA4 is the successor to JA3. FoxIO, the company of JA3 co-author John Althouse, launched it in September 2023 as part of the JA4+ suite. Key improvements over JA3:

  • Sorted cipher suites and extensions: random extension order no longer changes the fingerprint.
  • ALPN extension handling: it records the application protocol being negotiated (HTTP/1.1, HTTP/2, HTTP/3).
  • Human-readable format: the first part, such as t13d1517h2, reads without a lookup table: TLS over TCP, TLS 1.3, a domain in the SNI, 15 cipher suites, 17 extensions, HTTP/2. Two truncated SHA-256 hashes follow.
  • QUIC support: separate prefixes for TCP, QUIC and DTLS.

JA4+ adds methods such as JA4S (server), JA4H (HTTP client) and JA4X (certificates). JA4 itself is open source (BSD 3-Clause).

Who uses TLS fingerprinting?

CDNs, bot protection services, security teams and network operators use it to detect clients that are not what they claim to be.

CDNs and DDoS protection

Cloudflare, Akamai and Fastly use TLS fingerprinting to distinguish legitimate browsers from bots. Cloudflare offers JA3 and JA4 in Bot Management, Fastly lets customers act on JA3 hashes, and an Akamai patent describes TLS-based bot detection at the edge. A request claiming to be Chrome in its User-Agent header but presenting a Python or headless scraper fingerprint is likely from an automated tool.

Security monitoring and network surveillance

Security teams log JA3 and JA4 values to detect malware, which often ships its own TLS library. Because the ClientHello is mostly unencrypted, ISPs and government surveillance systems can fingerprint TLS connections without decrypting the traffic. Encrypted Client Hello (ECH), announced by Cloudflare in 2023, hides the real domain inside an encrypted inner ClientHello, but the outer one stays visible.

How does TLS fingerprinting differ from browser fingerprinting?

Browser fingerprinting runs at the application layer, with JavaScript in your browser. TLS fingerprinting happens at the network layer, before your browser's application code runs. It cannot be blocked by browser extensions, privacy settings or JavaScript restrictions. Even the Tor Browser has a TLS fingerprint, shared by all its users. Even a VPN does not change your TLS fingerprint. Signals such as canvas fingerprinting or HTTP header fingerprinting are more device-specific; detection systems compare both layers and flag mismatches.

Can you change or spoof a JA3 fingerprint?

Scraping tools can imitate a browser's ClientHello, but matching JA3 alone rarely avoids detection, because headers, HTTP/2 settings and behaviour are checked too. For normal users the best choice is a common, up-to-date browser, so your fingerprint matches millions of others. For anonymity, use Tor Browser; our Tor Browser privacy guide explains the trade-offs.

Can SpeedIQ show my TLS fingerprint?

No. JavaScript cannot read the ClientHello, so the SpeedIQ check in your browser shows browser-side signals instead: Canvas hash, screen, hardware, language, timezone, User Agent, cookies and Do Not Track, plus IP, WebRTC, IPv6 and Tor checks. Results stay in your browser. Run the SpeedIQ test to see them.

Summary

TLS fingerprinting captures your browser's signature from the TLS handshake, before encryption is established. JA3 and JA4 are the standard methods, widely used in security tooling, bot detection and network surveillance. Unlike browser fingerprinting, it cannot be blocked by browser settings or extensions.

FAQ

What is a JA3 fingerprint?

A JA3 fingerprint is an MD5 hash of five ClientHello fields: TLS version, cipher suites, extensions, elliptic curves and point formats. Salesforce researchers published it in 2017.

How does JA4 differ from JA3?

JA4 sorts cipher suites and extensions, adds ALPN, SNI and signature algorithms, and has a readable first part. Random extension order breaks JA3 but not JA4.

Does a VPN change my TLS fingerprint?

No. A VPN changes your IP address, but your browser still sends the same ClientHello, so the website sees the same fingerprint.

Can a TLS fingerprint identify me personally?

Usually not. It identifies the browser or tool and its version, and many users share one fingerprint.

Sources