--- id: "ja4_fingerprint" kind: "datatype" status: "draft" is_pii: false categories: ["internet"] langs: ["common"] quality: 75 url: "http://registry.apicrafter.io/datatype/ja4_fingerprint" --- # JA4 TLS client fingerprint (`ja4_fingerprint`) > **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions. TLS client fingerprint of the JA4+ suite by FoxIO, the successor of JA3. It has three parts separated by underscores. The first is readable: protocol (t for TLS over TCP, q for QUIC, d for DTLS), two characters of TLS version (13, 12, s3, d2 ...; 00 if unknown), d if SNI is present or i if not, the number of cipher suites and of extensions as two digits each, and the first and last characters of the first ALPN value (00 if none). The second and third parts are the first 12 lowercase hex digits of the SHA-256 hashes of the sorted cipher list and of the extension and signature algorithm lists. - Personal data (PII): no - Categories: Internet (internet) - Countries: global - Languages: Common to most languages (common) - Classification: identifier ## Detection Regular expression (Python `re`): ``` ^[tqd](?:1[0-3]|s[23]|d[1-3]|00)[di][0-9]{4}[0-9A-Za-z]{2}_[0-9a-f]{12}_[0-9a-f]{12}$ ``` ## Examples - `t13d1516h2_8daaf6152771_e5627efa2ab1` — TLS 1.3 client with SNI, 15 ciphers, 16 extensions, ALPN h2 (JA4 specification) - `t13d1516h2_8daaf6152771_b186095e22b6` — Fingerprint shown in the JA4 algorithm summary - `t13d1516h2_8daaf6152771` (invalid example) — Third part is missing - `x13d1516h2_8daaf6152771_e5627efa2ab1` (invalid example) — Unknown protocol letter ## Sources - doc: ## Quality Score 75/100. Missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage. JSON: · Edit: