JA3 Fingerprint

JA3 is a popular way to compute a TLS fingerprint. It gathers specific fields from the client's ClientHello — the TLS version, the ordered list of cipher suites, the extensions, the elliptic curves and their point formats — concatenates them and hashes the result into a short MD5 string. Because different clients order and populate these fields distinctively, the JA3 hash acts as a signature: many Chrome installs share one value, a given Python HTTP library shares another. The server-side counterpart, JA3S, fingerprints the server's response.

A User-Agent and a JA3 hash describe different signals; a mismatch can inform a detector but does not prove identity or abuse. JA4 uses a different fingerprint construction. A pass-through proxy usually preserves the client's TLS handshake; a TLS-terminating intermediary can originate another handshake. See the original JA3 specification; fingerprints can change with software and configuration.

In practice, if a target inspects JA3 you cannot fix it by changing IPs — a proxy leaves the hash untouched. What matters is that the client building the handshake resembles the browser you claim to be, and that your User-Agent, JA3 and behaviour agree. Because JA3's extension-order weakness led to JA4, expect strict sites to check the newer scheme too, so aim for genuine browser-grade software rather than a superficially spoofed header.