TLS Fingerprinting Guide

TLS Fingerprinting in 2025JA3, JA4+, and ClientHello Detection Explained

TLS fingerprinting identifies clients before any application data is exchanged. Your TLS handshake parameters reveal what software you're using - even if you spoof everything else. In 2025, JA4 has replaced JA3 as the industry standard.

JA4+
Current Standard
2022
Chrome Randomized
98.8%
Unique After Sorting
CDN
Wide Adoption

Research updated: December 2025

What is TLS Fingerprinting?

When your browser connects to a website, it sends a TLS ClientHello message to initiate encryption. This message contains dozens of parameters that uniquely identify your client software.

The TLS Handshake

1

Client Hello

Browser sends supported ciphers, extensions, and TLS version

2

Server Fingerprints

Server hashes ClientHello to identify client before responding

3

Decision Made

Block, challenge, or allow - before data exchange begins

ClientHello Parameters

  • TLS Version: 1.2, 1.3, or supported versions list
  • Cipher Suites: Ordered list of encryption algorithms
  • Extensions: SNI, ALPN, signature algorithms, etc.
  • Elliptic Curves: Supported key exchange curves
  • EC Point Formats: Compression support

From JA3 to JA4: The Evolution

TLS fingerprinting has evolved rapidly. Chrome's randomization broke JA3, leading to JA4's development.

2017

JA3 Released

Salesforce releases JA3, enabling TLS client fingerprinting by hashing cipher suites and extensions from the ClientHello.

2022

Chrome Extension Randomization

Chrome 108 begins randomizing TLS extension order in ClientHello. JA3 effectiveness drops dramatically as Chrome now produces billions of different hashes.

2023

JA4+ Suite Released

FoxIO releases JA4+, sorting extensions before hashing to defeat randomization. Cloudflare begins JA4 integration.

2024

Enterprise Adoption

Cloudflare, Akamai, and major CDNs integrate JA4. Bot management solutions widely adopt the new standard.

2025

Current State

JA4 is now standard for enterprise detection. HTTP/3 fingerprinting added. ML models combine JA4 with behavioral signals.

JA4 Fingerprint Structure

JA4 consists of three parts: protocol info, cipher hash, and extension hash. By sorting before hashing, it defeats Chrome's randomization.

Example JA4 Fingerprint

t13d1516h2_a0e9c7f32f1c_e5b1d8a03d9a
a

Protocol Info

t13d1516h2

TLS version (13), SNI presence (d), cipher count (15), extension count (16), ALPN (h2)

b

Cipher Hash

a0e9...2f1c

12-character truncated SHA256 of sorted cipher suites

c

Extension Hash

e5b1...3d9a

12-character truncated SHA256 of sorted extensions

Why Sorting Defeats Randomization

Chrome randomizes extension order on each connection, generating billions of possible JA3 hashes. JA4 sorts extensions alphabetically before hashing, producing the same fingerprint regardless of order.

JA3 (Broken)

Chrome v128: 109+ possible hashes

JA4 (Current)

Chrome v128: 1 consistent fingerprint

Enterprise Detection Systems in 2025

Major CDNs and bot protection services now use JA4 as a core detection signal.

Cloudflare

JA4 integrated into Bot Management and WAF. Enterprise customers can create rules based on JA4 fingerprints. Also exposes JA4 in Workers for custom detection logic.

Note: JA4 access requires Enterprise Bot Management subscription.

Akamai

EdgeWorker implementation of JA4 for edge-based detection. Combined with Akamai's HTTP/2 fingerprinting and "sensor data" collection for multi-layered bot detection.

Note: Akamai checks battery status, canvas, and TLS together.

PerimeterX/HUMAN

Combines JA4 with behavioral signals and JavaScript challenges. ML models correlate TLS fingerprints with client-side fingerprints for bot detection.

Note: Detects TLS/browser fingerprint mismatches aggressively.

Bypassing TLS Fingerprinting

TLS fingerprinting is one of the hardest detection methods to bypass. Here are the current approaches in 2025.

Effective Approaches

  • Real Browsers: Playwright, Puppeteer, Selenium use real Chrome/Firefox with authentic TLS stacks
  • curl-impersonate: Modified curl that mimics Chrome/Firefox TLS fingerprints
  • uTLS (Go): Library for custom ClientHello construction
  • Antidetect Browsers: GoLogin, Multilogin maintain consistent TLS profiles

Common Mistakes

  • Generic HTTP libraries: Python requests, Node axios show non-browser fingerprints
  • Headless browser detection: Default headless modes have detectable TLS differences
  • TLS/Browser mismatch: JA4 shows Chrome but JavaScript reveals Python user agent
  • Static fingerprints: Never changing fingerprint across sessions triggers ML detection

Example: curl-impersonate Usage

# Install curl-impersonate (Chrome 119 fingerprint)
docker pull lwthiker/curl-impersonate:0.5-chrome

# Use curl that mimics Chrome's TLS fingerprint
docker run --rm lwthiker/curl-impersonate:0.5-chrome \
  curl_chrome119 https://target-site.com \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) ..."

# The TLS handshake now matches real Chrome 119
# JA4: t13d1516h2_... (authentic Chrome fingerprint)

Mobile Proxies: The IP-TLS Connection

TLS fingerprinting doesn't work in isolation. Detection systems correlate your JA4 fingerprint with your IP address.

IP-TLS Correlation

Modern detection systems check if your IP type matches your TLS fingerprint. A Chrome JA4 fingerprint from a datacenter IP is immediately suspicious - real Chrome users don't browse from datacenters.

Datacenter IP + Chrome JA4 = Flagged
Mobile IP + Chrome JA4 = Trusted

Why Mobile IPs Work

Mobile IPs from real carriers have high trust scores. Combined with authentic TLS fingerprints, your traffic looks indistinguishable from a real mobile user.

  • CGNAT IP sharing expected for mobile
  • Carrier ASN matches legitimate traffic
  • IP reputation databases show clean history

Mobile Proxy Pricing

Shared

High-trust mobile IP pool

from $4/GB
from $10/slot/mo
Private

Dedicated modem

from $3/GB
from $40/slot/mo
See Full Pricing

Ready to Bypass TLS Detection?

Get 1GB free to test our mobile proxies with your automation setup.