Skip to content
Get Started
G2G2
4.7/5
Excellent
Trustpilot

What Is a TLS Fingerprint (JA3 and JA4)?

A TLS fingerprint is a short identifier computed from the TLS ClientHello a client sends at the start of every HTTPS connection: its TLS versions, cipher suites, extensions and curves. Each browser, library and app has a characteristic one, so a server can tell Chrome from Python requests before a single header is read.

Try Now for $4.99Continue with Google
  • Session Control
  • High Speed
  • Privacy First
Best fit for TLS fingerprintRotating Residential Proxiesfrom$0.63/GB
how it works

How JA3 and JA4 work

JA3, published by Salesforce engineers in 2017, takes five fields from the ClientHello, joins them into one string and hashes it with MD5. Two clients built on the same TLS library with the same settings produce the same JA3, whatever IP they come from.

In early 2023 Chrome began randomising the order of its TLS extensions, which made JA3 values for Chrome change on every connection. JA4, released by FoxIO in 2023, sorts the extensions before hashing and adds readable parts, such as the protocol, TLS version, SNI presence and ALPN, so fingerprints stay stable and are easier to compare. Anti-bot systems also fingerprint the HTTP/2 SETTINGS frame and header order in a similar way.

What JA3 hashesText
# Five ClientHello fields, joined with commas:
# Version,Ciphers,Extensions,Curves,PointFormats

771,4865-4866-4867-...,0-23-65281-10-11-...,29-23-24,0

# JA3 = md5(that string): 32 hex characters
why it matters

Why TLS fingerprints matter for proxy users

For HTTPS, your client runs TLS straight to the website through the proxy's CONNECT tunnel. The proxy never touches the ClientHello, so the site sees your client's fingerprint and the proxy's IP. Change the IP and the fingerprint stays exactly the same.

  • 1

    Real Chrome or Firefox

    Fingerprint
    Matches the browser it claims
    What the site concludes
    Consistent with a person browsing
  • 2

    Python requests, Go net/http, Node fetch

    Fingerprint
    The library's TLS stack
    What the site concludes
    A script, whatever the User-Agent says
  • 3

    Library with a Chrome User-Agent

    Fingerprint
    Library fingerprint, browser headers
    What the site concludes
    A mismatch, which is a strong bot signal

  • Headless browser

    Fingerprint
    Close to the real browser
    What the site concludes
    Depends on other signals, such as JavaScript checks

Keep the whole client consistent: if the target expects browsers, use a real browser engine through the proxy, and never pair a library's TLS with a browser's User-Agent. CleanProxies rotating residential proxies supply the consumer IP; the fingerprint is your client's job. See browser fingerprinting for the browser side.

Rotating residential proxies from $0.63/GB

The CleanProxies proxy that fits best here, with a $4.99 trial to test it first.

Go deeper

Guides from the blog

Setup guides and best practices from the CleanProxies blog.

Get the latest insightsAll Blogs

Related terms

Terms that come up alongside TLS fingerprint.

All glossary terms

TLS fingerprint FAQs

Straight answers about TLS fingerprint.

A TLS client fingerprinting method from 2017 that hashes the TLS version, cipher suites, extensions, elliptic curves and point formats from the ClientHello into one MD5 value.

Got more questions?All FAQs