TLS Fingerprint Explainer (JA3 & JA4)

About this tool

A TLS client fingerprint is a short label built from how a program starts a secure connection: the TLS versions, cipher suites, extensions, curves and other options it offers in its first message, the ClientHello. Different software builds that message differently, so the fingerprint tells apart a browser, a command-line tool, a bot framework and some malware, even when they all claim to be Chrome in the User-Agent. This tool does three things. Paste the bytes of a ClientHello (hex or base64, a Wireshark hex stream or hex dump, a C array or an escaped string; two TLS records are joined automatically) and it works out JA3, the older fingerprint (the MD5 of the version, cipher, extension, curve and point-format lists, in the order sent), and JA4, the newer one (a readable part such as t13d1516h2 followed by two hashes of the sorted cipher list and the sorted extension and signature-algorithm lists; sorting makes it stable even though Chrome now shuffles its extensions on every connection, which makes JA3 change each time). It also shows the TLS version, server name (SNI), ALPN protocols and the number of suites and extensions, lists every cipher suite, extension, curve, point format and signature algorithm by its registered name from the IANA registries, and points out what stands out: no extensions at all, no server name, an obsolete top version, weak cipher suites, TLS compression, GREASE placeholders and shuffled extensions. Paste a JA3 string (five comma-separated fields) to get its MD5 hash and the names behind it. Paste a JA4 value to have its readable part explained; the two hashes cannot be reversed, so compare them with a list of known fingerprints. A JA3 hash alone also cannot be reversed, and the tool says so. We checked the tool against independent references: the JA3 string and hash of 9 ClientHellos captured from real programs (OpenSSL 3, curl, Python, Node and Chrome) match what Salesforce's own ja3.py produces for the same bytes, and the JA4 of 146 real ClientHellos from the FoxIO JA4 project's sample captures matches the values in that project's own test results, apart from one capture with an unusual non-ASCII ALPN value, where the written specification and FoxIO's own tool disagree and this tool follows the specification. The JA4 specification's worked example (cipher hash 8daaf6152771, extension hash e5627efa2ab1) is also rebuilt from its lists, and every shortened version of a real ClientHello, and thousands of randomly corrupted ones, either give a fingerprint or are refused with a message: the parser never crashes (a corruption that leaves a valid message simply gives the fingerprint of what is there). JA4 here is the TLS client fingerprint (TCP, QUIC or DTLS), not the other JA4+ fingerprints. A fingerprint describes how a client is built, not who is using it: many programs share one, and it can be imitated. Nothing you paste is sent anywhere.

How to use it

1. In Wireshark, copy the Client Hello's TLS record as a hex stream and paste it here (or paste a JA3 string or JA4 value).
2. Read the JA4 and JA3 results and the summary cards.
3. Open the lists to see every cipher suite, extension, curve and signature algorithm by name.
4. Compare the fingerprints with a list of known clients to identify the software.

Example

The cipher hash 8daaf6152771 is the same for the common Chrome cipher list.

A ClientHello from Chrome (the Example button fills one in)

JA4 t13d1517h2_8daaf6152771_… with ALPN h2 and 15 cipher suites; the JA3 hash differs on every connection because Chrome shuffles its extensions.

Common problems

It says the ClientHello is cut short

Paste the whole TLS record. A large ClientHello (for example with post-quantum key shares) can be split over two TCP packets: copy both records, or reassemble the stream in Wireshark first.

My JA3 hash is different every time for Chrome

That is expected: Chrome shuffles the order of its extensions on every connection since version 110, and JA3 depends on the order. JA4 sorts them and stays stable.

I only have a JA3 hash

A hash cannot be turned back into the lists. Look it up in a database of known fingerprints, or get the ClientHello and paste that instead.