Glossary · Detection & reputation
TLS fingerprint
An identifier built from how a client negotiates encryption, used to spot automation even through a clean IP.
When a client opens an encrypted connection it announces, in a specific order, which ciphers and extensions it supports. That set and its order vary between a real Chrome, a Python library and a headless browser, and hashing them produces a fingerprint, JA3 and its successor JA4 being the common ones.
This matters because it operates below the IP and below the browser's visible behaviour. You can present a perfect residential address and a convincing user agent, but if your TLS handshake is a Python library's rather than a browser's, a detection system that fingerprints it sees the contradiction immediately.
It is why serious automation uses tooling that mimics a real browser's handshake, not just its headers. The address gets you in the door; a matching TLS fingerprint is part of not being flagged once inside.
Back to the full glossary.