TLS fingerprint check: your browser's JA4, JA3 and HTTP/2 fingerprint

TLS and HTTP fingerprints: JA4, JA3, JA4H

Before any page is requested, your browser sends a TLS ClientHello listing the cipher suites, extensions, key shares and protocols it supports. The order and content of that list is characteristic of the software that produced it: JA3 hashes it, and JA4 encodes it in a readable form that stays stable while browsers shuffle extension order. Neither depends on the User-Agent string, which is why fingerprints are used to tell real browsers from bots and to spot a client claiming to be something it is not.

The HTTP layer adds a second fingerprint: the order of request headers (JA4H) and, over HTTP/2, the SETTINGS frame and priorities the client sent (the Akamai HTTP/2 fingerprint). The likely-client card compares all of them with what the User-Agent claims.

What is JA4?

JA4 is a TLS client fingerprint defined by FoxIO. It writes down the protocol, TLS version, whether a server name was sent, the number of cipher suites and extensions, and the ALPN, followed by hashes of the sorted cipher suites and extensions. Because the lists are sorted, browsers that shuffle their extension order still produce the same JA4.

What is the difference between JA3 and JA4?

JA3 is an MD5 hash over the cipher suites, extensions, curves and point formats in the order the client sent them. Chrome has randomised its extension order since 2023, so JA3 changes from connection to connection while JA4 stays stable. JA3 is still shown because many bot-detection systems and blocklists key on it.

Can I change my TLS fingerprint?

Not by changing the User-Agent string. The fingerprint comes from the TLS library inside the browser engine, so it changes only with a different browser, a major version that alters its cipher list, or tooling built to imitate a browser. That is what makes it useful for telling a real browser from a script claiming to be one.

What is the HTTP/2 fingerprint?

The first frames of an HTTP/2 connection are also characteristic: the SETTINGS the client announces, the initial window update, any priority frames, and the order of the pseudo-headers :method, :path, :authority and :scheme. The Akamai notation shown here combines them into one line that differs between Chrome, Firefox, Safari and most HTTP libraries.

What is JA4H?

JA4H fingerprints the HTTP request itself: the method, HTTP version, whether cookies and a referer were present, the number of headers, the preferred language, and hashes of the header names in order. It is independent of the TLS layer, so it catches a client that borrowed a browser's TLS stack but builds its requests differently.

Why does the likely client differ from my User-Agent?

Something between your browser and this server changed one of the two. A privacy extension or anti-detect browser rewrites the User-Agent, a corporate proxy or some VPN apps terminate TLS and open their own connection, and automation tools imitate one browser while running another. The verdict on the overview counts a contradiction as a signal, a plausible pairing as normal.

Related terms: TLS fingerprint, ClientHello, JA4, JA3, JA4H, HTTP/2 fingerprint, User-Agent