# What is the difference between JA3 and JA4?

Both fingerprint the client side of a TLS handshake, but JA4 copes with how modern browsers behave. JA3, published in 2017, hashes the fields of the ClientHello in the order they appear. From early 2023 Chrome began shuffling the order of TLS extensions on every connection, which changes the JA3 value each time and makes it far less useful for recognising browsers. JA4, published in 2023, sorts the fields before hashing, adds the TLS version, the transport (TCP or QUIC) and the first application protocol offered, and produces a readable string whose parts can be compared separately. Neither proves malice on its own: many programs share a fingerprint, and malware can imitate a browser. They are useful for spotting a client that does not fit the device, such as a script posing as a browser on a server. NetSenX computes TLS fingerprints from the Starter plan, with its own implementation, where its agent captures packets: on Linux or as a SPAN/TAP sensor, not in the basic macOS mode.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/what-is-the-difference-between-ja3-and-ja4

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is SNI, and why does it matter for monitoring?](https://netsenx.com/en/faq/what-is-sni-and-why-does-it-matter-for-monitoring)
- [What is Encrypted Client Hello (ECH)?](https://netsenx.com/en/faq/what-is-encrypted-client-hello)
- [Does Encrypted Client Hello blind network monitoring?](https://netsenx.com/en/faq/does-encrypted-client-hello-blind-network-monitoring)
- [Do QUIC and HTTP/3 blind firewalls?](https://netsenx.com/en/faq/do-quic-and-http3-blind-firewalls)
- [Can DNS over HTTPS hide traffic from security monitoring?](https://netsenx.com/en/faq/can-dns-over-https-hide-traffic-from-security-monitoring)