What is the difference between JA3 and JA4?

Both fingerprint the client side of a TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake, but JA4 copes with how modern browsers behave. JA3, published in 2017, hashes the fields of the ClientHello in the order they appear. From early 2023 Chrome began shuffling the order of TLS extensions on every connection, which changes the JA3 value each time and makes it far less useful for recognising browsers. JA4, published in 2023, sorts the fields before hashing, adds the TLS version, the transport (TCP or QUIC) and the first application protocol offered, and produces a readable string whose parts can be compared separately. Neither proves malice on its own: many programs share a fingerprint, and malware can imitate a browser. They are useful for spotting a client that does not fit the device, such as a script posing as a browser on a server. NetSenX computes TLS fingerprints from the Starter plan, with its own implementation, where its agent captures packets: on Linux or as a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it./TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor, not in the basic macOS mode.

← All 40 questions on Encryption and encrypted trafficAll topics