What a TLS fingerprint is (JA3/JA4)
Contents
Share
A JA4 TLS fingerprint is a way to fold a client’s greeting into a string. The FoxIO specification builds it from the TLS ClientHello packet. The string describes how the client started a protected connection. It does not claim that the visit was automated, and it does not replace a review of a click on an ad.
A different phrase sits nearby: browser fingerprint. The two are easy to mix, because both talk about recognizability. The W3C Privacy Working Group note of 25 September 2025 defines a browser fingerprint as a site’s ability to identify or re-identify a user, a program, or a device from settings and other observable characteristics. JA4 is narrower. It is a fold of one handshake packet, not the whole surface of settings. Below is what goes into the string, what does not, and what Binetro’s current check does not do with this signal.
What the W3C note calls a fingerprint
A browser fingerprint can link visits inside a session and across sessions. Linking is also possible across different sites when another origin’s cookie policy does not hand over an identifier. Unlike cookies, collection often happens without an explicit sign. A typical fingerprint cannot be cleared or reset. Clearing cookies and using a VPN do not stop later linking by fingerprint.
The note treats complete elimination of fingerprinting, against an interested party and by widely deployed technical measures alone, as implausible. It does not call mitigations a solution. The surface stretches across the program’s capabilities and into other layers, for example differences in TCP connections. This is guidance for specification authors. It is not a detector and it is not a definition of an antidetect browser. The page does not retell uniqueness figures from other articles. Those figures cannot be dropped in here as a share of “recognized” clients.
TCP differences in that text are an example of another layer, not a description of JA4. A network difference and a ClientHello hash are neighboring observable traits, but the JA4 specification talks only about the TLS greeting. Mixing them attributes to a JA4 string what the note attributes to the whole surface of a program.
The advertising boundary is the same. Recognizing a program is not an answer to whether a click was click fraud, how click fraud differs from sklikivanie, or who clicks ads. A fingerprint links visits. It does not classify spend, and it does not say whether invalid clicks will be written off or whether Yandex returns the money.
What JA4 takes from the ClientHello
The FoxIO JA4 specification builds a client fingerprint from the TLS ClientHello packet. The string includes:
the transport — TLS over TCP, QUIC, or DTLS;
the TLS version;
whether SNI is present;
the number of ciphers;
the number of extensions;
whether ALPN is present;
hashes of the cipher list and the extension list.
The specification says to ignore GREASE values. Neighboring methods in the same suite are counted separately. JA4S is the server response. JA4H is the HTTP client. Those are other folds, not fields of the same JA4 string.
The specification describes a way to fold the greeting into a string. It does not claim that a particular string proves an automated visit. The same string on two connections means their ClientHello packets folded the same way on these fields. It does not mean both visits came from the same program, and it does not mean the program acted without a person. Different strings do not prove a “live” visitor either: clients differ in version, transport, and extensions without any automation.
Byte order, hash lengths, and sample strings are not copied into this explanation. For the query “tls fingerprint ja3,” the composition is enough: transport, version, SNI, cipher and extension counts, ALPN, and hashes of the lists. The JA3 name in the topic title points at the same idea of folding a greeting. The facts in this article describe JA4 and the neighboring JA4S and JA4H, not the byte layout of an earlier string.
What Binetro’s check does not do with this signal
The current check does not use a TLS fingerprint or an HTTP/2 fingerprint. That is a product boundary, not a property of JA4. The specification can still fold a ClientHello. Binetro’s check, as it stands, does not take this signal.
Other gaps are named in the same boundary. A repeat of someone else’s visit description is not recognized from the first copy. Some automated browsers can be missed. These are known gaps, not a promise of complete protection. Tool names, repeat thresholds, and a method of evasion are not carried into this text.
It does not follow that a TLS fingerprint “does not work” as a way to describe a client. What follows is different: a method existing in the FoxIO specification and a method being used in a particular check are different facts. The first describes ClientHello fields. The second is absent from Binetro’s current check. This text does not support expecting the cabinet to have already separated visits by JA4.
A matching string would be a thin basis even on the specification’s own terms. It does not issue a verdict that the visitor is a bot. Even if a check someday reads a TLS fingerprint, today’s description of JA4 does not yield a rule that “this string is an automated click.” The specification contains no such rule.
How to read the string if it shows up in a report
A JA4 string answers a narrow question: what the client greeting looked like on the listed fields. Three negations that the sources state outright belong next to it.
The string does not prove an automated visit. The specification says so: it folds the greeting and does not claim that a particular value is a sign of a bot.
The string is not the browser fingerprint from the W3C note. That fingerprint gathers settings and observable traits beyond one packet, lives across sessions, and is not removed by clearing cookies or by a VPN. JA4 does not promise that link and does not describe fonts, the window, or sensors.
The string is not part of Binetro’s current check. A TLS fingerprint and an HTTP/2 fingerprint are not used there. Missing some automated browsers is named as a known gap. That is not a promise that every such browser will be caught another way, and it is not a recipe for hiding one.
If “JA3” or “JA4” comes up in a conversation with a platform or a contractor, it is worth asking which string was captured and what decision was drawn from it. The field list can be checked against the specification. The conclusion “so this is a bot” is not supported by the specification. The conclusion “Binetro already filters on TLS” is not supported by the current product boundary either.