Testing guide
JA4 fingerprint: what it is and how it differs from JA3
Before a page loads, your browser starts an encrypted connection. The way it does this is a fingerprint of its own. This guide explains JA4, JA3 and the HTTP/2 fingerprint, and how sites use them.
Direct answer
JA4 is a TLS client fingerprint from FoxIO. It describes the ClientHello, the first message a client sends to start an encrypted connection. It has three parts, a_b_c: a readable summary, a hash of the cipher suites, and a hash of the extensions and signature algorithms. JA4 sorts the lists, so it stays stable when Chrome shuffles its extensions. A changed user agent does not change it.
How a JA4 fingerprint is built
We saw this JA4 from stock Chrome 156: t13d1517h2_8daaf6152771_cb7bf5808d99. FoxIO’s public description defines each part. GREASE values, the random filler values that Chrome sends, are ignored everywhere.
| Part | Chrome 156 | What it means |
|---|---|---|
| a: protocol | t | TLS over TCP. QUIC is “q” and DTLS is “d”. |
| a: TLS version | 13 | The highest version offered, here TLS 1.3. |
| a: SNI | d | The client named a domain. A connection to a bare IP gives “i”. |
| a: cipher count | 15 | The number of cipher suites offered. |
| a: extension count | 17 | The number of TLS extensions sent. |
| a: ALPN | h2 | The first and last characters of the first ALPN value, here HTTP/2. |
| b | 8daaf6152771 | The first 12 characters of a SHA-256 hash of the cipher suites, sorted. |
| c | cb7bf5808d99 | The first 12 characters of a SHA-256 hash of the sorted extensions (without SNI and ALPN), plus the signature algorithms in their sent order. |
Compare curl: t13d3112h2_e8f1e7e78f70_b26ce05bbdd6. It offers 31 cipher suites and 12 extensions, so even part a differs from Chrome. Analysts can match on any part alone, for example a and c without b.
JA3 vs JA4
JA3 is the older fingerprint from Salesforce. It takes the TLS version, ciphers, extensions, elliptic curves and point formats in the order sent, and makes an MD5 hash.
Since Chrome 110, released in early 2023, Chrome shuffles its TLS extension order on every connection. JA3 keeps the order, so Chrome’s JA3 changes on every connection. JA4 sorts the extensions, so it stays the same.
JA4 is not fixed forever. FoxIO notes that it changes when a TLS library is updated, about once a year.
| JA3 | JA4 | |
|---|---|---|
| Format | One 32-character MD5 hash | Readable part a, then two 12-character hashes |
| Extension order | Kept, so Chrome’s JA3 changes per connection | Sorted, so Chrome’s JA4 stays stable |
| Readable without a lookup | No | Yes, for part a |
The HTTP/2 Akamai fingerprint
After the TLS handshake, the browser opens an HTTP/2 connection. Akamai researchers described a fingerprint for this step in 2017. It has four parts: the SETTINGS values, the WINDOW_UPDATE value, the PRIORITY frames, and the order of the pseudo-headers.
The pseudo-headers carry the request line: :method, :authority, :scheme and :path. Chrome sends them in the order m,a,s,p. Firefox sends m,p,a,s. Akamai’s paper notes that many HTTP/2 clients do not let users change these details.
How bot checks use them, and why a user agent cannot change them
Cloudflare’s Bot Management gives sites the JA3 and JA4 fingerprint of each request. Its documentation says each type of client starts connections in its own way, so the same client shows the same fingerprint on every server.
The simplest use is a comparison. The user agent says “Chrome”. The TLS and HTTP/2 fingerprints say what the client really is. A Python script with a Chrome user agent still shows Python’s connection.
The user agent is only a header inside the request. The TLS and HTTP/2 fingerprints come from the network code of the client, before any header is sent. So changing the user agent, with an extension or a setting, cannot change them. It can only create a mismatch.
Two normal things can also change the fingerprint: antivirus HTTPS scanning and company firewalls that decrypt traffic. A normal HTTP or SOCKS proxy does not change it.
Frequently asked questions
What is the difference between JA3 and JA4?
JA3 is an MD5 hash of the ClientHello values in the order sent. JA4 sorts the ciphers and extensions and has a readable first part. Chrome shuffles its extensions, so its JA3 changes per connection while its JA4 stays stable.
Can I change my JA4 fingerprint?
Not with a user agent change, an extension or a page script. JA4 comes from the browser’s network code. To show a Chrome JA4, use a Chromium-based browser.
Does a proxy or VPN change my JA4?
A normal proxy or VPN does not, because the encrypted connection still starts in your browser. Only a service that decrypts and re-encrypts traffic changes it.
Where can I see my JA4 fingerprint?
Open our free TLS fingerprint test. It shows your JA4, JA3 and HTTP/2 fingerprint and checks them against the browser your user agent claims.