---
id: "ja3s_fingerprint"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["internet"]
langs: ["common"]
quality: 75
url: "http://registry.apicrafter.io/datatype/ja3s_fingerprint"
---

# JA3S TLS server fingerprint (`ja3s_fingerprint`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Server-side counterpart of JA3: the MD5 hash of the TLS version, the chosen cipher suite and the extensions of a ServerHello message, written as 32 lowercase hexadecimal digits. A server answers the same client the same way, so a JA3 and JA3S pair identifies a client-server negotiation, for example malware talking to its command and control server.

- Parent datatype: `md5hash`
- Personal data (PII): no
- Categories: Internet (internet)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^[0-9a-f]{32}$
```

## Examples

- `623de93db17d313345d7ea481e7443cf` — Trickbot command and control server response (JA3 README)
- `80b3a14bccc8598a1f3bbe83e71f735f` — Emotet command and control server response (JA3 README)
- `623de93db17d313345d7ea481e7443c` (invalid example) — One hex digit short

## Sources

- doc: <https://github.com/salesforce/ja3>

## Quality

Score 75/100. Missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage.

JSON: <http://registry.apicrafter.io/api/v1/datatypes/ja3s_fingerprint.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/internet/ja3s_fingerprint.yaml>