Free online service for scanning TLS fingerprints of client applications (JA3 and JA4 scanner)

TLS Fingerprinting is a technique for obtaining unique fingerprints of clients and servers, allowing you to determine the type of software used (web browser, console utility, bot, malware, etc.).

A TLS (Transport Layer Security) handshake is used for identification. Moreover, the unencrypted part of the transmitted data is used – that is, there is no need to decrypt the data.

A TLS handshake has enough unique features that allow you to identify the client (which software group it belongs to) and, sometimes, even the version of the program.

A TLS fingerprint is a hash obtained by hashing the identifying features of the client or server.

Usually, different groups of clients have different TLS fingerprint values, but sometimes the hash values ​​​​may coincide for unrelated utilities and programs.

A distinction is made between TLS fingerprints of servers and clients. Sometimes the same program can be both a server (listening for incoming connections) and a client (initiating connections) – for example, this is common among malware that acts as a Command and Control infrastructure (also known as C2 or C&C).

This service will show JA3 and JA4 fingerprints for your web browser.

Description of the output fields:

• JA3 – the original version of the TLS client fingerprint. Currently, the Google Chrome web browser actively resists obtaining this TLS fingerprint – as a result, for the Google Chrome web browser, this value is different every time.
• JA3_FULL – the raw data used to compute the JA3 hash.
• JA3N – an improved version of JA3 – it sorts the part of the data whose order is randomized in Google Chrome, due to which the hash becomes the same for all Google Chrome requests (and other applications that use this method of preventing TLS fingerprinting).
• JA3N_FULL – the raw data used to obtain the JA3N hash.
• JA4 – the next version of the client TLS fingerprint. Currently, for the Google Chrome web browser, it gives the same results.
• JA4_R – the raw data used to compute the JA4 hash.

This service has a variant for console utilities, its address is https://w-e-b.site/?act=ja4, example of usage:

curl -A 'Chrome' 'https://w-e-b.site/?act=ja4'

Scan results for: 18.116.90.161

=================================================
Your TLS fingerprints:
JA3: eb837036cf1edd1f37f5d03c57e430ec
JA3_FULL: 771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,0-11-45-35-51-10-23-13-43-16-5,29-23-24,0
JA3N: 24dd0f987266c37f39231f6f2130d12e
JA3N_FULL: 771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,0-5-10-11-13-16-23-35-43-45-51,29-23-24,0
JA4: t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3
JA4_R: t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401
=================================================

Your User Agent:

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)

Details:

Parent browser: DefaultProperties

Platform: unknown

Comment: Default Browser

Browser: Default Browser

Browser maker: unknown

Version: 0.0

Major version: 0

Device type: unknown

Device pointing method: unknown

Minor version: 0

Is it a mobile device? No

Is it a tablet? No

Is it a crawler (bot)? No

Share