JA4 Fingerprint

JA4 is the successor to JA3 in a broader family of network fingerprints. It rebuilds the TLS fingerprint to be more robust: it sorts certain fields so trivial reordering can no longer evade a match, encodes useful facts (TLS version, number of ciphers and extensions, ALPN) in a partly human-readable form, and hashes the rest. The result is harder to spoof accidentally and easier to reason about than JA3's single opaque MD5. The wider JA4+ suite extends the idea to HTTP, TCP and other layers.

Because JA4 resists the extension-shuffling tricks that could change a JA3 hash, anti-bot and security platforms are adopting it to spot automation more reliably. For anyone running scripted traffic, the lesson is the same as with JA3: your User-Agent, TLS handshake and behaviour should tell one consistent story. A proxy or the VPN changes only your exit IP; the JA4 signature comes from the client that negotiates TLS, so matching a real browser's handshake requires browser-grade client software, not just a different network path.

Because JA4 is more tamper-resistant than JA3 and part of a wider JA4+ family covering HTTP and TCP, strict targets increasingly rely on it. The practical response has not changed: make your User-Agent, handshake and behaviour tell one consistent story, using browser-grade client software rather than a raw scripting library. A proxy or the VPN still only changes your exit IP, so treat the network layer and the client layer as two problems you solve together.