# What is TLS fingerprinting? > TLS fingerprinting identifies the software behind a connection from its TLS ClientHello, read before any page loads. JA3 and JA4 are the common formats. Source: https://mosaicbrowser.com/glossary/tls-fingerprinting ## TLS fingerprinting: identifying a client by its handshake TLS fingerprinting identifies what software opened a connection by reading the TLS ClientHello it sends first: the protocol versions, cipher suites, extensions and their settings. Every browser and HTTP library builds that message differently, so a server knows what is connecting before any page or script loads. ![TLS fingerprinting: 0 differing fields from Chrome, drawn as a mosaic of tiles](https://mosaicbrowser.com/covers/tls-fingerprinting.webp) An HTTPS connection begins with the client's ClientHello, defined in the TLS 1.3 standard ([RFC 8446](https://datatracker.ietf.org/doc/html/rfc8446)). It lists the TLS versions the client speaks, the cipher suites it accepts, the extensions it supports, the key-exchange groups and signature algorithms it prefers. The standard lets each client choose those lists, and each TLS library chooses differently. Chrome's BoringSSL, Firefox's NSS and a curl built on OpenSSL send recognisably different hellos. ## How TLS fingerprinting works A server, a CDN or a firewall reads the ClientHello as it arrives and reduces it to a short string. The two common formats are [JA3](https://mosaicbrowser.com/glossary/ja3-fingerprint), an MD5 of five fields in the order sent, published by Salesforce in 2017, and [JA4](https://mosaicbrowser.com/glossary/ja4-fingerprint), which sorts the lists first so that Chrome's per-connection shuffling does not change the result. The fingerprint is then looked up: this hash is Chrome 153, that one is a Go HTTP client, a third belongs to a known piece of malware. None of this needs the page. It happens before the first byte of HTML, it ignores cookies, and no browser extension can see or change it. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Its own Chromium](https://mosaicbrowser.com/features/engine) ## What it catches A TLS fingerprint rarely separates two people. Everyone on the same Chrome version sends the same set of ciphers and extensions. What it catches is a client lying about what it is. The classic case is a script that copies a browser's User-Agent header onto an HTTP library. The headers say Chrome; the handshake says Python. A server that compares the two layers sees the contradiction on the first request. The same check catches a browser that claims one Chrome major in its User-Agent and [client hints](https://mosaicbrowser.com/glossary/client-hints-fingerprinting) while its handshake belongs to another. Between Google Chrome 152 and 153 on the same machine we measured a change in the extension count, 17 against 18, so the version shows in the handshake as well. Above TLS there is HTTP/2. The SETTINGS frame a client sends when the connection opens, its values and their order, and the order of request headers are a second fingerprint of the same kind, read by bot-management services alongside the handshake. ## Why we do not spoof it Many anti-detect browsers advertise a per-profile TLS or JA3 setting. We decided against one. Every real Chrome of a version sends the same hello, so giving a profile a different one does not separate it from other profiles: it makes it the only Chrome on the internet with that handshake. And a handshake chosen per profile drifts from the version the profile claims the moment Chrome updates. So we measured instead. We pointed our engine and Google's branded Chrome at a bare TCP listener on the same machine, parsed the first record of each, and compared every field: legacy version, cipher suites, extension set and count, supported groups, supported versions, signature algorithms and ALPN. Zero fields differed once Chrome's own shuffle and random GREASE values were set aside. The HTTP/2 SETTINGS frame, header order and ALPN matched too. Against Google's Chrome for Testing 153 the JA4 values were byte-identical. ![A proxy check result in Mosaic: latency, exit address, ISP, HTTPS tunnelling and reputation](https://mosaicbrowser.com/shots/proxy-check.png) *A proxy moves the exit; the handshake stays Chrome's* ## How Mosaic handles it Mosaic's engine, Tesseract Chrome, is Chromium built from stock source, so its TLS and HTTP/2 come from Chrome's own network stack, unmodified. A proxy does not change them: with HTTPS, the proxy tunnels the browser's handshake to the site. The patches change the values a page reads, in C++, and leave the connection alone. What they do change is listed on the [engine page](https://mosaicbrowser.com/features/engine), and the other layers detectors compare against the handshake are in [how sites detect anti-detect browsers](https://mosaicbrowser.com/guides/how-do-sites-detect-anti-detect-browsers). ## Sources 1. [RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3](https://datatracker.ietf.org/doc/html/rfc8446), read November 2, 2026 2. [Salesforce: JA3, a method for profiling SSL/TLS clients](https://github.com/salesforce/ja3), read November 2, 2026 3. [FoxIO: JA4 technical details](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md), read November 2, 2026 4. [Chrome Platform Status: TLS ClientHello extension permutation](https://chromestatus.com/feature/5124606246518784), read November 2, 2026 ## Questions ### Can a VPN or proxy hide my TLS fingerprint? No. For HTTPS, a VPN or an ordinary proxy carries the browser's own handshake to the site unchanged. Only the software that opens the TLS connection decides the fingerprint. ### Can JavaScript change a TLS fingerprint? No. The ClientHello is sent by the browser's network stack before the page exists, so page scripts and extensions cannot touch it. ### Is TLS fingerprinting the same as browser fingerprinting? It is one layer of it. Browser fingerprinting usually means values a page reads with JavaScript; TLS fingerprinting reads the connection itself, and the two are compared against each other. ### What is an HTTP/2 fingerprint? The next layer up: the settings a client sends when an HTTP/2 connection opens, their order, and the order of its headers. Akamai published a format for it, and it is often read alongside JA3 or JA4. ## Related [JA4 fingerprint: reading a TLS hello that survives shuffling](https://mosaicbrowser.com/glossary/ja4-fingerprint): JA4 is a TLS client fingerprint in three parts: a readable summary of the ClientHello, then hashes of its sorted cipher suites and extensions. [JA3 fingerprint: an MD5 of the TLS ClientHello](https://mosaicbrowser.com/glossary/ja3-fingerprint): A JA3 fingerprint is an MD5 hash of five fields from a TLS ClientHello. Chrome has shuffled its extensions since version 110, so JA3 no longer pins it. [Client hints fingerprinting: what Sec-CH-UA headers give away](https://mosaicbrowser.com/glossary/client-hints-fingerprinting): Client hints fingerprinting reads the Sec-CH-UA headers and navigator.userAgentData, then checks them against the User-Agent and the rest of the browser. [How do sites detect anti-detect browsers?](https://mosaicbrowser.com/guides/how-do-sites-detect-anti-detect-browsers): Sites detect anti-detect browsers by contradictions: a page and its workers disagreeing, a GPU name the driver does not match, fonts from another OS. [An anti-detect browser with its own Chromium engine](https://mosaicbrowser.com/features/engine): Mosaic is an anti-detect browser with its own Chromium engine, Tesseract Chrome: stock source plus 64 patches that change fingerprint values in C++.    ## See TLS fingerprinting on a real profile Mosaic shows the values a site reads, per profile, and runs a leak test from inside the profile’s own page. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.