JA4 TLS client fingerprint
ID ja4_fingerprint
This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).
TLS client fingerprint of the JA4+ suite by FoxIO, the successor of JA3. It has three parts separated by underscores. The first is readable: protocol (t for TLS over TCP, q for QUIC, d for DTLS), two characters of TLS version (13, 12, s3, d2 ...; 00 if unknown), d if SNI is present or i if not, the number of cipher suites and of extensions as two digits each, and the first and last characters of the first ALPN value (00 if none). The second and third parts are the first 12 lowercase hex digits of the SHA-256 hashes of the sorted cipher list and of the extension and signature algorithm lists.
- Categories
- Internet
- Countries
- Global (not tied to a country)
- Languages
- Common to most languages
- Quality
- 75/100 · missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage
- Metacrafter rules
- no detection rule yet
- Supported by tools
- no tool record lists this type yet
Regular expression
^[tqd](?:1[0-3]|s[23]|d[1-3]|00)[di][0-9]{4}[0-9A-Za-z]{2}_[0-9a-f]{12}_[0-9a-f]{12}$Python re syntax.
Examples
| Value | Description |
|---|---|
| t13d1516h2_8daaf6152771_e5627efa2ab1 | TLS 1.3 client with SNI, 15 ciphers, 16 extensions, ALPN h2 (JA4 specification) |
| t13d1516h2_8daaf6152771_b186095e22b6 | Fingerprint shown in the JA4 algorithm summary |
| t13d1516h2_8daaf6152771 invalid | Third part is missing |
| x13d1516h2_8daaf6152771_e5627efa2ab1 invalid | Unknown protocol letter |
Sources
Use this record
- Page URL:
http://registry.apicrafter.io/datatype/ja4_fingerprint - JSON: API v1 · legacy shape (used by metacrafter) · Markdown (for LLMs)
- Improve it: edit
data/datatypes/any/internet/ja4_fingerprint.yamlon GitHub