What Is a JA4 Fingerprint? – Definition and How It Works
Learn what a JA4 fingerprint is, how its readable segments are built, why sorting makes it stable, and what the wider JA4+ family covers.
JA4 is a TLS client fingerprint designed to replace JA3. It keeps the idea — summarise the handshake into a comparable identifier — while fixing the properties that made its predecessor unreliable.
1. What Changed
| Property | JA3 | JA4 |
|---|---|---|
| Output | One opaque MD5 hash | Segmented, partly human-readable |
| Ordering | Sensitive — shuffling breaks matching | Sorted where order is not meaningful |
| Information without a lookup | None | Protocol, counts, and ALPN visible directly |
| Scope | TLS client hello | A family across several protocols |
2. The Readable Structure
A JA4 fingerprint is composed of segments rather than a single hash. Those segments encode the transport and TLS version, whether the connection carries a server name, the number of cipher suites and extensions, the negotiated application protocol, and hashes of the sorted cipher and extension lists.
The practical consequence is that a fingerprint carries information before any database lookup — an analyst can see the shape of the client immediately.
3. Why Sorting Matters
Browsers began randomising extension order, which produced a different JA3 hash on every connection from the same browser. Lists keyed on JA3 degraded without anything about the handshake actually changing.
JA4 sorts the values where order conveys nothing, so a client yields a stable identifier despite randomisation. That single change is the main reason for adoption.
4. The JA4+ Family
The scheme extends beyond the TLS client:
- Server-side TLS, fingerprinting what a server presents.
- HTTP, covering header ordering and protocol behaviour.
- Other protocols, where implementation choices are similarly characteristic.
Combining fingerprints across layers is more informative than any one, because contradiction between layers is the strongest available signal.
5. What It Identifies
Software and configuration. Every user of a given browser build shares a fingerprint, so it groups clients rather than identifying individuals.
That makes it appropriate for correlation and scoring, and inappropriate as the sole basis for a block.
6. Practical Use
For operators: one signal among several, useful for grouping traffic and spotting inconsistency between claimed and actual client identity.
For client authors: consistency is what matters. A coherent client — handshake, protocol behaviour, headers, and declared identity all belonging together — presents nothing contradictory, whatever the fingerprint value happens to be.
7. Limits
- Shared values make false positives inherent.
- Version churn changes fingerprints on every library or browser update.
- Terminating middleboxes replace the client's fingerprint with their own.
- Any static list built on specific values ages continuously.
8. Summary
JA4 replaces JA3's order-sensitive hash with a sorted, segmented, partly readable identifier that survives extension randomisation and extends across protocols as JA4+.
It describes client software rather than identity, and its value lies in correlation and in detecting layers of a client that do not agree with one another.