# What is a JA3 fingerprint? > A JA3 fingerprint is an MD5 hash of five fields from a TLS ClientHello. Chrome has shuffled its extensions since version 110, so JA3 no longer pins it. Source: https://mosaicbrowser.com/glossary/ja3-fingerprint ## JA3 fingerprint: an MD5 of the TLS ClientHello A JA3 fingerprint is a 32-character MD5 hash of five fields a client sends in its TLS ClientHello: the TLS version, cipher suites, extensions, elliptic curves and point formats, in the order sent. It identifies the TLS library behind a connection, though since Chrome 110 one Chrome produces many JA3 values. ![JA3 fingerprint, drawn as a mosaic of tiles](https://mosaicbrowser.com/covers/ja3-fingerprint.webp) Every HTTPS connection starts with the client saying hello. Before a single byte of a page moves, the browser sends a TLS ClientHello listing which protocol versions, ciphers and extensions it supports. Different TLS libraries send different lists, so the hello says what kind of software is connecting. JA3 turns that hello into one short string a firewall can match. ## How a JA3 fingerprint is made JA3 was invented at Salesforce in 2017. Its [repository](https://github.com/salesforce/ja3) gives the recipe. Take five fields from the ClientHello, as decimal values: ``` SSLVersion,Cipher,SSLExtension,EllipticCurve,EllipticCurvePointFormat ``` Join the values inside a field with `-`, join the fields with `,`, keep the order the client sent them in, and hash the result with MD5. The output is a 32-character fingerprint. The same recipe applied to the server's reply is JA3S. A script built on an HTTP library and a browser build their hellos from different TLS stacks, so each gets a different JA3. That is the whole use: a network team can block a known piece of malware by its hash, and a bot rule can notice a client that says Chrome in its User-Agent and hellos like a Python library. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Its own Chromium](https://mosaicbrowser.com/features/engine) ## Why Chrome broke it JA3 keeps the order of the extensions, and since Chrome 110 Chrome shuffles that order on every connection ([Chrome Platform Status](https://chromestatus.com/feature/5124606246518784), read 2 November 2026). The stated reason is "to reduce potential ecosystem brittleness": servers had started building logic around one fixed Chrome hello. The side effect is that one copy of Chrome produces a different JA3 on almost every connection. We saw this in our own measurements. Our engine and Google's Chrome for Testing 153, on the same Mac, in the same minute, gave different JA3 hashes, and because of the shuffle two connections from one binary disagree as well. Their JA4 values were byte-identical. So a different JA3 between two Chrome connections says nothing, and a JA3 that never changes across connections says a lot, because it is not what a current Chrome does. The same creator now maintains [JA4](https://mosaicbrowser.com/glossary/ja4-fingerprint), which sorts the cipher and extension lists before hashing, so the shuffle no longer moves the result. Salesforce's repository says JA3 is no longer actively maintained there. ## What a site can read with it A JA3 or JA4 hash tells a server which TLS library made the connection. On its own that does not separate two Chrome users, because every Chrome of a version uses the same library. What it catches is disagreement: a handshake from one client paired with headers from another. That is the trap tools fall into when they put a browser's User-Agent on an HTTP library, and it is read before any JavaScript runs. The wider family of handshake checks is in [TLS fingerprinting](https://mosaicbrowser.com/glossary/tls-fingerprinting), and how detection services combine it with the page-level checks is in [how sites detect anti-detect browsers](https://mosaicbrowser.com/guides/how-do-sites-detect-anti-detect-browsers). ![A proxy check result in Mosaic: latency, exit address, ISP, HTTPS tunnelling and reputation](https://mosaicbrowser.com/shots/proxy-check.png) *The proxy changes the exit, not the handshake* ## How Mosaic handles it Mosaic does not change the TLS handshake, on purpose. Tesseract Chrome is Chromium, so it sends Chrome's own ClientHello, with Chrome's per-connection shuffle and GREASE values left as they are. There is no setting for a TLS persona, because a profile with a handshake no Chrome sends would be the only browser on the internet with it. A proxy does not change it either: with HTTPS, the proxy carries the browser's own handshake through a tunnel. Mosaic's detection tests include a JA3/JA4 echo page, so you can read a profile's handshake yourself; the [engine page](https://mosaicbrowser.com/features/engine) covers what we do change. ## Sources 1. [Salesforce: JA3, a method for profiling SSL/TLS clients](https://github.com/salesforce/ja3), read November 2, 2026 2. [Chrome Platform Status: TLS ClientHello extension permutation](https://chromestatus.com/feature/5124606246518784), read November 2, 2026 3. [FoxIO: JA4+ network fingerprinting](https://github.com/FoxIO-LLC/ja4), read November 2, 2026 ## Questions ### What is the difference between JA3 and JA3S? JA3 fingerprints the client's ClientHello. JA3S applies the same idea to the server's reply, the ServerHello, so the pair describes both ends of one handshake. ### Is JA3 still used? Yes, in firewalls and bot rules that were written around it, but Salesforce's repository says the project is no longer actively maintained there, and its creator now works on JA4. For Chrome traffic, JA4 is the more useful of the two. ### Can JavaScript change a JA3 fingerprint? No. The ClientHello is sent by the browser's network stack before any page loads, so no script, extension or page-level spoof reaches it. Only the TLS library that makes the connection decides it. ### Should an anti-detect browser randomise JA3? Not for a browser that claims Chrome. Every Chrome of one version sends the same set of ciphers and extensions, so a different set makes a profile the only Chrome with that handshake. ## Related [JA4 fingerprint: reading a TLS hello that survives shuffling](https://mosaicbrowser.com/glossary/ja4-fingerprint): JA4 is a TLS client fingerprint in three parts: a readable summary of the ClientHello, then hashes of its sorted cipher suites and extensions. [TLS fingerprinting: identifying a client by its handshake](https://mosaicbrowser.com/glossary/tls-fingerprinting): TLS fingerprinting identifies the software behind a connection from its TLS ClientHello, read before any page loads. JA3 and JA4 are the common formats. [Chromium vs Chrome: same source, different browser](https://mosaicbrowser.com/glossary/chromium-vs-chrome): Chromium is the open-source browser project; Chrome is Google's build of it, with codecs, keys and components Chromium lacks. A page can tell them apart. [How do sites detect anti-detect browsers?](https://mosaicbrowser.com/guides/how-do-sites-detect-anti-detect-browsers): Sites detect anti-detect browsers by contradictions: a page and its workers disagreeing, a GPU name the driver does not match, fonts from another OS. [An anti-detect browser with its own Chromium engine](https://mosaicbrowser.com/features/engine): Mosaic is an anti-detect browser with its own Chromium engine, Tesseract Chrome: stock source plus 64 patches that change fingerprint values in C++.    ## See JA3 fingerprint on a real profile Mosaic shows the values a site reads, per profile, and runs a leak test from inside the profile’s own page. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.