Free tool · TLS and HTTP/2
TLS fingerprint test
See the JA4, JA3 and HTTP/2 fingerprint of your connection, and whether it matches the browser you claim to be.
Checking your browser…
The check runs in your browser and takes about five seconds.
IP location by DB-IP. How this test works.
Direct answer
A TLS fingerprint describes how a client starts an encrypted connection: its TLS version, cipher suites, extensions and signature algorithms. JA4 and JA3 turn these into short codes, and the HTTP/2 settings add a second fingerprint. Every browser engine has its own, so sites can see when a Chrome user agent sits on top of a Python, Go or proxy connection.
What the TLS and HTTP/2 fingerprint shows
| Value | What it is |
|---|---|
| JA4 | TLS version, SNI, cipher and extension counts, ALPN, and hashes of the sorted ciphers, extensions and signature algorithms. Stable across Chrome's random extension order. |
| JA3 | The older MD5 fingerprint of the TLS ClientHello. Chrome changes it on every connection because it shuffles extensions. |
| HTTP/2 (Akamai) | The SETTINGS values, the window update, priority frames and the order of the :method, :authority, :scheme and :path headers. |
Our test reads these values on our own server, from the connection your browser opens to it. It then compares the TLS stack with the engine in your user agent: Chromium browsers send random GREASE values and the ALPS extension, Firefox sends record_size_limit and delegated_credentials and no GREASE.
Why a fingerprint can not match
- Antivirus HTTPS scanning: the antivirus opens the encrypted connection and starts a new one with its own TLS stack.
- A company proxy or firewall that inspects encrypted traffic does the same.
- A script or tool that sends requests with a browser user agent, such as Python requests, Go or curl.
- A browser whose user agent was changed to another browser.
Questions
Can I change my TLS fingerprint?
Not from page scripts or extensions. The TLS fingerprint comes from the network stack of the browser. To show a Chrome fingerprint, use a Chromium-based browser; to show a Firefox fingerprint, use Firefox.
Why does my JA3 change on every visit?
Chrome shuffles the order of its TLS extensions on every connection, and JA3 keeps the order, so it changes. JA4 sorts the extensions and stays the same.
Does a proxy change my TLS fingerprint?
A normal HTTP or SOCKS proxy does not: the encrypted connection still runs between your browser and the site. Only a proxy that decrypts traffic changes it.