TLS Fingerprinting (JA3 / JA4)

TLS fingerprinting is a network security profiling standard that analyzes the unencrypted cryptographic parameters transmitted in a client's TLS Client Hello packet during the initial HTTPS handshake. When asking what is tls fingerprinting, imagine an official diplomatic greeting protocol: before any confidential conversation begins, delegates present credentials following a specific cultural sequence, language choice, and cryptographic protocol that immediately identifies their governing delegation. Security gateways inspect this initial cryptographic greeting to verify client networking authenticity before establishing encrypted communication.

JA3 vs JA4

• JA3: the original fingerprinting method, released by Salesforce in 2017. It hashes the TLS version, cipher suites, extensions, elliptic curves, and elliptic curve point formats from the ClientHello into a single MD5 hash.
• JA4: a newer, more detailed fingerprinting standard. It improves on JA3 by including ALPN values, ordering ciphers/extensions more precisely, and producing a fingerprint that's harder to spoof accidentally and easier to reason about across TLS versions (including TLS 1.3).

Both work the same way at a conceptual level. They turn "how a client negotiates TLS" into a short, comparable signature.