{
  "id": "ja4_fingerprint",
  "name": "JA4 TLS client fingerprint",
  "status": "draft",
  "doc": "TLS client fingerprint of the JA4+ suite by FoxIO, the successor of JA3. It has three parts separated by underscores. The first is readable: protocol (t for TLS over TCP, q for QUIC, d for DTLS), two characters of TLS version (13, 12, s3, d2 ...; 00 if unknown), d if SNI is present or i if not, the number of cipher suites and of extensions as two digits each, and the first and last characters of the first ALPN value (00 if none). The second and third parts are the first 12 lowercase hex digits of the SHA-256 hashes of the sorted cipher list and of the extension and signature algorithm lists.",
  "categories": [
    {
      "id": "internet",
      "name": "Internet"
    }
  ],
  "langs": [
    {
      "id": "common",
      "name": "Common to most languages"
    }
  ],
  "is_pii": false,
  "classification": "identifier",
  "regexp": "^[tqd](?:1[0-3]|s[23]|d[1-3]|00)[di][0-9]{4}[0-9A-Za-z]{2}_[0-9a-f]{12}_[0-9a-f]{12}$",
  "examples": [
    {
      "value": "t13d1516h2_8daaf6152771_e5627efa2ab1",
      "description": "TLS 1.3 client with SNI, 15 ciphers, 16 extensions, ALPN h2 (JA4 specification)"
    },
    {
      "value": "t13d1516h2_8daaf6152771_b186095e22b6",
      "description": "Fingerprint shown in the JA4 algorithm summary"
    },
    {
      "value": "t13d1516h2_8daaf6152771",
      "valid": false,
      "description": "Third part is missing"
    },
    {
      "value": "x13d1516h2_8daaf6152771_e5627efa2ab1",
      "valid": false,
      "description": "Unknown protocol letter"
    }
  ],
  "links": [
    {
      "type": "doc",
      "url": "https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md"
    }
  ],
  "type": "datatype",
  "translations": {}
}