# What is a JA4 fingerprint? > JA4 is a TLS client fingerprint in three parts: a readable summary of the ClientHello, then hashes of its sorted cipher suites and extensions. Source: https://mosaicbrowser.com/glossary/ja4-fingerprint ## JA4 fingerprint: reading a TLS hello that survives shuffling A JA4 fingerprint is a TLS client fingerprint in three parts: a readable summary of the ClientHello such as t13d1516h2, a hash of its sorted cipher suites, and a hash of its sorted extensions and signature algorithms. Sorting makes it stable for Chrome, which shuffles its extension order on every connection. ![JA4: 18 extensions, the same as Chrome, drawn as a mosaic of tiles](https://mosaicbrowser.com/covers/ja4-fingerprint.webp) JA4 is the successor to [JA3](https://mosaicbrowser.com/glossary/ja3-fingerprint), written by the same person, John Althouse, now at FoxIO. Both read the TLS ClientHello a client sends before any page loads. JA3 squeezed it into one opaque MD5; JA4 keeps part of it readable and, more importantly, sorts the lists before hashing. That one change is why JA4 still works on Chrome. ## How to read a JA4 fingerprint FoxIO's [technical details](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md) use this example: ``` t13d1516h2_8daaf6152771_b186095e22b6 ``` The first part, `t13d1516h2`, is plain text. `t` is TLS over TCP (`q` for QUIC, `d` for DTLS). `13` is the highest TLS version offered, here 1.3. `d` means the client sent a server name, so it was going to a domain; `i` would be a bare IP. `15` is the number of cipher suites and `16` the number of extensions, both counted with GREASE values left out. `h2` is the first and last character of the first ALPN value, so HTTP/2. The second part is the first 12 characters of a SHA-256 of the cipher suites, sorted in hex order. The third is the same kind of hash over the extensions, sorted, followed by the signature algorithms in the order sent. The server name and ALPN extensions are left out of that hash, because the first part already records them, so one application gets the same third part whether it connects to a domain or an address. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Its own Chromium](https://mosaicbrowser.com/features/engine) ## Why sorting matters Since Chrome 110, Chrome shuffles the order of its ClientHello extensions on every connection ([Chrome Platform Status](https://chromestatus.com/feature/5124606246518784)), and it scatters random GREASE values through several fields. A hash that keeps the order, like JA3, sees a new Chrome almost every time. JA4 sorts and drops GREASE, so the shuffle disappears and one Chrome version has one JA4. That is also what makes JA4 useful for comparison. In our own measurement, Mosaic's engine against Google's Chrome for Testing 153.0.8010.36, same Mac, same minute: ``` ours JA4 t13d1518h2_8daaf6152771_4980c97edce0 stock JA4 t13d1518h2_8daaf6152771_4980c97edce0 ``` Identical: 15 cipher suites, 18 extensions, ALPN `h2`, the same cipher hash and the same extension hash. Google Chrome 152 on the same machine read `t13d1517h2`, one extension fewer. A change between Chrome majors shows up in JA4, which is why a JA4 is only compared against a browser of the same major version. ## What a site does with it JA4 does not tell two Chrome users apart, since they send the same hello. It tells a site what software is really connecting, and lets it compare that with what the software says it is. A User-Agent claiming Chrome 153 over a JA4 that belongs to an HTTP library, or to a different Chrome major, is a contradiction read before any JavaScript runs. [TLS fingerprinting](https://mosaicbrowser.com/glossary/tls-fingerprinting) covers the rest of the handshake checks, HTTP/2 included. Licensing matters to anyone building on it. JA4 itself is BSD 3-Clause. The rest of the family, JA4S, JA4H, JA4X and the others grouped as JA4+, is under the FoxIO License 1.1, which FoxIO's [README](https://github.com/FoxIO-LLC/ja4) describes as permissive for internal use but not for selling it inside a product without an OEM licence. ## How Mosaic handles it We leave the handshake alone. Tesseract Chrome is built from Chromium source, so its JA4 is Chrome's JA4 for the same major version, as the measurement above shows, and there is no per-profile TLS setting to drift from the version a profile claims. When the engine moves to a new Chrome major, the JA4 moves with it, the way Chrome's does. Mosaic's detection tests include a JA3/JA4 echo page for reading a profile's handshake, and [why we built our own Chromium](https://mosaicbrowser.com/blog/why-we-built-our-own-chromium) explains why we patch values in the engine rather than in the network layer. ## Sources 1. [FoxIO: JA4 technical details](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md), read November 2, 2026 2. [FoxIO: JA4+ network fingerprinting (licensing)](https://github.com/FoxIO-LLC/ja4), read November 2, 2026 3. [Chrome Platform Status: TLS ClientHello extension permutation](https://chromestatus.com/feature/5124606246518784), read November 2, 2026 ## Questions ### What does t13d mean in a JA4 fingerprint? t is TLS over TCP (q would be QUIC, d DTLS), 13 is TLS 1.3, and d means the client sent a server name, so it was connecting to a domain rather than a bare IP address (i). ### What is the difference between JA4 and JA4+? JA4 is the TLS client fingerprint, open source under BSD 3-Clause like JA3. JA4+ is the wider family, such as JA4S for servers, JA4H for HTTP and JA4X for certificates, under FoxIO's own licence. ### Why did JA4 replace JA3? JA3 hashes extensions in the order sent, and Chrome has shuffled that order since version 110, so one Chrome produced many JA3 values. JA4 sorts the lists first and ignores GREASE values, so one Chrome version gives one JA4. ### Does a proxy change my JA4 fingerprint? Not for HTTPS through an ordinary proxy. The proxy tunnels the browser's own handshake, so the site reads the browser's JA4. A proxy changes the exit address, not the TLS hello. ## Related [JA3 fingerprint: an MD5 of the TLS ClientHello](https://mosaicbrowser.com/glossary/ja3-fingerprint): A JA3 fingerprint is an MD5 hash of five fields from a TLS ClientHello. Chrome has shuffled its extensions since version 110, so JA3 no longer pins it. [TLS fingerprinting: identifying a client by its handshake](https://mosaicbrowser.com/glossary/tls-fingerprinting): TLS fingerprinting identifies the software behind a connection from its TLS ClientHello, read before any page loads. JA3 and JA4 are the common formats. [Chromium vs Chrome: same source, different browser](https://mosaicbrowser.com/glossary/chromium-vs-chrome): Chromium is the open-source browser project; Chrome is Google's build of it, with codecs, keys and components Chromium lacks. A page can tell them apart. [Why we built our own Chromium instead of injecting JavaScript](https://mosaicbrowser.com/blog/why-we-built-our-own-chromium): Mosaic changes fingerprint values in C++ inside its own engine. Three measured differences between Chrome and plain Chromium explain why that matters. [An anti-detect browser with its own Chromium engine](https://mosaicbrowser.com/features/engine): Mosaic is an anti-detect browser with its own Chromium engine, Tesseract Chrome: stock source plus 64 patches that change fingerprint values in C++.    ## See JA4 fingerprint on a real profile Mosaic shows the values a site reads, per profile, and runs a leak test from inside the profile’s own page. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.