JA3 and JA4 are fingerprints of the first message your software sends when it opens an HTTPS connection, the TLS ClientHello. They name the program behind a connection before it asks for a single page: Chrome, curl or a Python script. A proxy changes the IP address a website sees and relays that first message as it is. We tested this on October 22, 2026. Through a proxy, Chrome, curl and Python requests each kept the exact JA4 they had without one. Below is how both fingerprints are built, what nine clients on one PC sent, and why JA4 replaced JA3.
What is JA3/JA4 fingerprinting?
JA3/JA4 fingerprinting reads the TLS ClientHello and turns it into a short string that names the client software. JA3 came out of Salesforce in 2017 and hashes five fields with MD5. JA4 followed from FoxIO in 2023. It sorts what it reads, so a client that shuffles its lists keeps one fingerprint.
JA3 and JA4
TLS fingerprints
Two schemes that turn the first bytes a client sends, the ClientHello of its TLS handshake, into a short fingerprint that names the software behind the connection. A proxy relays the handshake untouched, so a new IP does not change the fingerprint.
Both read the same message. A website, a CDN or a firewall can compute them before any page is asked for, because the hello travels in the clear.
What does a ClientHello give away?
Every HTTPS connection opens with a TLS handshake, and the client speaks first. Its hello proposes the terms: TLS versions, cipher suites and a block of extensions. RFC 8446 defines the cipher suites as a list "in descending order of client preference". The extensions carry the server name (SNI), the offered application protocols (ALPN), the supported key groups and the signature algorithms.
Each TLS library fills those lists its own way, and the app on top can change some of them. In our test on one Windows PC, Node 22 offered 59 cipher suites, Python requests 43, curl 20 and Chrome 15. The server reads all of it before encryption starts.
How is a JA3 fingerprint built?
JA3 reads five fields from the hello as decimal numbers, in this order:
SSLVersion,Cipher,SSLExtension,EllipticCurve,EllipticCurvePointFormat
Fields are joined with commas, and the values inside a field with hyphens. The string is then hashed with MD5, in the project's words "to produce an easily consumable and shareable 32 character fingerprint". The JA3 project gives this example:
769,47-53-5-10-49161-49162-49171-49172-50-56-19-4,0-10-11,23-24-25,0
Here 769 is TLS 1.0. Then come the ciphers in the order sent, the extensions 0, 10 and 11, the curves 23, 24 and 25, and point format 0. The MD5 of that line is ada70206e40642a3e4461f35503241d5. JA3 also drops GREASE, the random placeholder values that Google's browsers add. That way "programs utilizing GREASE can still be identified with a single JA3 hash".
ClientHello
ciphers + extensions
JA3 / JA4
join and hash
Fingerprint
matched to known clients
How is a JA4 fingerprint built?
JA4 keeps the idea and changes the recipe. Its fingerprint has three parts joined by underscores. Here is the one Chrome 155 sent in our test:
t13d1517h2_8daaf6152771_cb7bf5808d99
- The first part is readable. The t means TCP, 13 is TLS 1.3 and d means the client named a domain. Then come 15 cipher suites, 17 extensions and h2, the first ALPN value.
- The second part covers the ciphers. It is the first 12 characters of a SHA-256 hash of the cipher list, sorted first.
- The third part covers the extensions. It hashes the sorted extension list without SNI and ALPN, followed by the signature algorithms in their original order.
Sorting is the point. The JA4 specification notes that applications "choose a unique cipher list more than unique ordering". A client that reorders its lists therefore keeps its JA4. The parts also work alone: FoxIO describes tracking a scanner by parts a and c while its single cipher kept changing.
Why did JA4 replace JA3?
Order broke JA3. RFC 8446 lets extensions appear "in any order", except pre_shared_key, which must come last. In November 2022, Chrome's team announced that Chrome "will randomly order extensions". Its reason: a fixed order invites servers to fingerprint Chrome and build logic around that one order. Since then, every new connection from Chrome carries a fresh extension order, and with it a fresh JA3.
We measured it. Nine clients on one Windows 11 PC sent hellos to our own test server, which read each one and hung up. Chrome 155 sent 62 hellos with 62 distinct JA3 hashes and one single JA4. Edge 155 did the same: 64 hellos, 64 JA3 values, one JA4.
- JA3 values
- JA4 values
Firefox 149 did not shuffle. Each first attempt sent the same hello. After our server hung up, Firefox retried with one extension fewer, which gave a second JA3 and a second JA4. The command-line clients sent one fingerprint each, every time. Cloudflare sums up the gain: JA4 "reduces the number of unique fingerprints for modern browsers and makes grouping easier".
JA3 (archived May 2025)
Hashes five fields as sent
one MD5 of the ClientHello
Beaten by cipher stunting
shuffle the order, change the hash
Scattered by Chrome randomization
one browser, many JA3 values
Still widely computed
the deployed classic
JA4 (current standard)
Sorts ciphers and extensions first
reordering no longer changes it
Resists cipher stunting
the sorted list ignores order
Readable a_b_c structure
metadata you can eyeball
Enables partial matching
track by a and c even when b shifts
What did nine clients send?
Here is the JA4 of each client's first attempt in our test:
Client JA4
Chrome 155 t13d1517h2_8daaf6152771_cb7bf5808d99
Edge 155 t13d1516h2_8daaf6152771_806a8c22fdea
Firefox 149 t13d1717h2_5b57614c22b0_3cbfd9057e0d
curl 8.16 (Git) t13d2013h1_2b729b4bf6f3_e24568c0d440
curl 8.21 (Windows) t13d2013h1_2b729b4bf6f3_e24568c0d440
PowerShell 7.6 t13d201100_2b729b4bf6f3_36bf25f296df
Python 3.13 urllib t13d1813h1_85036bcba153_d339722ba4af
Python requests 2.32 t13d4312h1_c7886603b240_b26ce05bbdd6
Node 22 fetch t13d5911h1_a33745022dd6_1f22a2ca17c4
- A fingerprint names the TLS library. Both curl builds use Schannel, the TLS library built into Windows, and sent the identical JA4. PowerShell shares their cipher part; its own extensions and the missing ALPN change the rest.
- One language, two fingerprints. From the same Python install, requests offered 43 cipher suites and urllib 18.
- Same engine, other browser. Chrome and Edge share the cipher part and differ by one extension.
- Fingerprints drift. FoxIO's table of November 2023 lists Chrome as t13d1516h2_8daaf6152771_e5627efa2ab1. Chrome 155 kept the cipher part and changed the extension part.
- A script can resemble malware. The same table lists the IcedID malware as t13d201100_2b729b4bf6f3_9e7b989ebec8. Our PowerShell request matched its first two parts, so a rule on those parts alone would catch both.
Does a proxy change your JA3 or JA4?
No. Through an HTTP proxy, an HTTPS request travels in a CONNECT tunnel. RFC 9110 says the proxy then limits itself to "blind forwarding of data, in both directions". Your client still builds the hello and sends it through the tunnel as it is. A SOCKS5 proxy relays the bytes the same way.
We checked it with a small CONNECT proxy on the same PC, our own code. This is what the test server saw, direct and through the proxy:
Client Route JA4
Chrome 155 direct t13d1517h2_8daaf6152771_cb7bf5808d99
Chrome 155 proxy t13d1517h2_8daaf6152771_cb7bf5808d99
curl 8.16 direct t13d2013h1_2b729b4bf6f3_e24568c0d440
curl 8.16 proxy t13d2013h1_2b729b4bf6f3_e24568c0d440
Python requests 2.32 direct t13d4312h1_c7886603b240_b26ce05bbdd6
Python requests 2.32 proxy t13d4312h1_c7886603b240_b26ce05bbdd6
curl and Python requests also kept the same JA3 through the proxy. Chrome's JA3 changed every time, with or without the proxy. Cloudflare's docs says the fingerprint "acts as a stable identifier across different destination IPs, ports, and certificates".
That is why a clean residential address leaves a script's handshake as it was. The proxy changes the IP and its network, which sites read through the ASN. The hello still says Python. Rotating the exit IP on every request changes nothing here either.
One layer down, the rule flips. The proxy opens its own TCP connection to the site, so TCP fingerprinting sees the proxy's operating system. A Windows User-Agent sent through a Linux exit can contradict itself twice: once in your TLS hello, and once in the exit's TCP packets.
How do websites use JA3 and JA4?
Usually at the edge, in a CDN or a firewall that sits in front of the site.
- CDNs and firewalls compute them. The JA3 project lists Cloudflare, AWS WAF, Azure Firewall and Google Cloud among the products with JA3 support. bunny.net computes a JA4 for incoming HTTPS requests and passes it on in a CDN-JA4 header.
- Rules can block or allow one fingerprint. Cloudflare suggests a rule that "blocks or challenges the JA3 used for the attack". It also suggests allowing a mobile app's traffic by its JA3.
- They feed statistics. Cloudflare's Workers can read "JA4 Signals" for each JA4, hourly figures such as browser_ratio_1h and ips_rank_1h.
- A mismatch weighs most. A User-Agent header is text the client chooses. A request that claims Chrome but sends a Python hello contradicts itself. How websites detect proxies shows how such contradictions add up, and Cloudflare is the edge most scrapers meet first.
A clean IP buys the first gate, as we explain in what is a residential proxy. The handshake is the second.
Can you change your TLS fingerprint?
Only by changing the hello itself. Tools such as curl-impersonate and the uTLS library rebuild it to copy a real browser's lists. Shuffling the lists no longer helps against JA4, because JA4 sorts them before hashing. The copy has to match a real browser version, and it has to keep matching. FoxIO expects fingerprints to change "about once a year" as TLS libraries update, and Chrome's extension part has changed since 2023.
How can you see your own JA4?
Capture your own traffic. FoxIO publishes a Wireshark plugin and Zeek scripts for JA4, and it recommends Arkime as the open source tool for the whole JA4+ family. Our test used a small capture server instead. It read each hello on the PC and hung up, so nothing left the machine. If your own site runs behind Cloudflare or bunny.net, they compute the values for your visitors. bunny.net hands the JA4 to your server in the CDN-JA4 header.
Is JA3 still used?
Yes. Salesforce archived the JA3 project on May 1, 2025, and its author now maintains JA4 at FoxIO. Cloudflare still exposes both fingerprints, and the list of products with JA3 support is long. JA4 itself is BSD 3-Clause, with no patent claims. The wider JA4+ family is under FoxIO's own license.
Search interest has moved too. Google searches for "ja4 fingerprint" passed "ja3 fingerprint" in March 2026. By September they stood at 1,900 a month, against 880.
A proxy handles the other gate, the address. Our residential proxies cost $0.50 per GB, falling to $0.44/GB at 2,000 GB+. Our proxy checker shows the network behind any proxy's IP. The handshake stays your client's job.
What this page could not check
- One PC, one day. We captured 282 ClientHellos from nine clients on one Windows 11 PC on October 22, 2026. Other versions and systems send other hellos.
- Retries count. Our server closed each connection after the hello, so the browsers retried. Firefox's retry dropped one extension, which a completed connection would not show.
- A local proxy. The proxy was our own code on the same PC. We did not run this test through any commercial proxy network, ours included.
- No site's rules. We cannot see how a site weighs a fingerprint. Cloudflare and bunny.net document what they compute.
- Check by January 22, 2027. The JA4 of a browser changes about once a year.
Sources
- JA3: A method for profiling SSL/TLS Clients. Salesforce, README on GitHub, read October 22, 2026; project archived May 1, 2025.
- JA4+ Network Fingerprinting, README and JA4 technical details. FoxIO on GitHub, read October 22, 2026.
- JA4+ network fingerprinting. APNIC Blog, November 22, 2023.
- RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3. IETF, August 2018.
- RFC 9110: HTTP Semantics, section 9.3.6 on CONNECT. IETF, June 2022.
- Intent to Ship: TLS ClientHello extension permutation. Chromium blink-dev mailing list, November 17, 2022.
- JA3/JA4 fingerprint. Cloudflare bot solutions docs, updated May 6, 2026, read October 22, 2026.
- JA4 Fingerprinting. bunny.net docs, updated March 9, 2026, read October 22, 2026.
- HProxy TLS capture: nine clients on one Windows 11 PC, direct and through a local CONNECT proxy, October 22, 2026.
- Google Keyword Planner, monthly searches for ja3 fingerprint and ja4 fingerprint, October 2025 to September 2026, read October 22, 2026.
