JA3 / TLS fingerprint
A JA3 or JA4 fingerprint identifies your browser from the way it opens an HTTPS connection — before a single byte of your request is read. This page shows what your connection negotiated and explains how the fingerprint is built, and it is honest about the one thing a web page cannot do: read its own raw TLS handshake.
What the server negotiated with your browser on this connection.
Honest limit. A browser cannot see its own TLS handshake — it happens below JavaScript. Computing a real JA3 hash needs a TLS endpoint that captures and echoes the raw ClientHello, which needs bot-management tooling this site does not run. So we show the TLS version and protocol the edge negotiated, which are part of the picture, and explain the rest rather than invent a hash.
Your handshake has a shape
When your browser opens an HTTPS connection it sends a ClientHello: the TLS versions it supports, the cipher suites it offers, the extensions it includes and the elliptic curves it prefers — in a particular order. Different software offers a different set in a different order. JA3 hashes that list into a short string; JA4 is a newer, more structured version of the same idea. A server can read it to tell Chrome from a Python script from a scraper, no matter what the user-agent claims.
TLS version
The protocol version agreed for this connection — TLS 1.2 or 1.3 on a modern browser.
Cipher and curves
Which encryption suites and key-exchange curves your browser offered, and in what order — the heart of JA3.
Extensions
TLS extensions like ALPN and SNI, whose presence and order are part of the fingerprint.
HTTP protocol
HTTP/1.1, HTTP/2 or HTTP/3. The protocol and its settings add to how recognisable a client is.
The handshake is below JavaScript
You cannot change your TLS fingerprint from a page, and that cuts both ways: it is hard for a scraper to disguise, and a tool that claims to be Chrome while presenting a non-Chrome handshake is giving itself away. Mosaic ships one real Chromium build, so every profile presents the same genuine Chrome handshake — there is no JavaScript spoofing of TLS, which is the right outcome, because a handshake that disagrees with the browser’s claimed identity is itself a signal.
- Read your connection. The page shows the TLS version and HTTP protocol the server negotiated with your browser, which are part of what a TLS fingerprint captures.
- Learn what JA3 is. The tool explains how a JA3/JA4 fingerprint is built from the ClientHello — the cipher suites, extensions and curves your browser offers in a fixed order.
- See the honest limit. It is clear about what a page cannot read: the raw ClientHello needs a TLS endpoint that echoes it, which this site does not run, so the full JA3 hash is not shown.
What is a JA3 or JA4 fingerprint?
A fingerprint of your TLS handshake. When your browser opens an HTTPS connection it offers a ClientHello listing TLS version, cipher suites, extensions and curves in a particular order. JA3 and JA4 hash that list, so a server can recognise the client software from the handshake alone.
Why can’t this page show my full JA3 hash?
Because a page cannot read its own TLS handshake — that happens below JavaScript. Computing JA3 needs a TLS endpoint that echoes the raw ClientHello back, which this site does not run. We show the TLS version and protocol the server negotiated, and explain the rest honestly.
How does Mosaic affect the TLS fingerprint?
Mosaic ships one real Chromium build, so every profile presents the same genuine Chrome TLS handshake. There is no JavaScript spoofing of the handshake — which is good, because a TLS fingerprint that disagrees with a browser’s claimed identity is itself a signal.
Every account its own browser. One price for all of them.
Free holds 3 profiles and 10 profile creations, with no card. Pro is $49 a month for any number, or $490 a year with 2 months free. Try it for 14 days; cancel before day 14 and you pay nothing.