TLS Fingerprint

A TLS fingerprint identifies the client software behind an encrypted connection by examining the details of its TLS handshake — the ordered list of cipher suites, extensions, supported groups and protocol versions it advertises in the ClientHello. Different libraries and browsers produce distinctive combinations, so a server can recognise "this looks like Chrome" or "this looks like a Python script" without decrypting any traffic. The best-known encodings of this signature are JA3 and the newer JA4.

A declared User-Agent and a TLS handshake can differ for legitimate reasons; a fingerprint is a signal, not proof of a person or bot. Anti-detect browsers do not guarantee acceptance or anonymity. A pass-through proxy normally preserves the client handshake, while an intermediary that terminates TLS can create a new one. Assess the actual connection and software.

A pass-through proxy or VPN changes the network path without normally replacing an application's TLS handshake. TLS termination is a different case. Location data and a declared User-Agent are additional signals, not reliable proof of identity or permission. For authorized integrations, test the actual client and destination instead of assuming matching signals prevent challenges.