# What is a TLS fingerprint? | SoftGlaze Browser glossary

> A TLS fingerprint such as JA3 or JA4 identifies the software behind an encrypted connection. How it works, and why a web page cannot fake it.

- Canonical URL: https://browser.softglaze.com/glossary/tls-fingerprint
- Last updated 2026-11-07

---

[Fingerprinting](https://browser.softglaze.com/glossary?category=fingerprinting)

## TLS fingerprint (JA3 and JA4)

Also called JA3, JA4, JA3 fingerprint, JA4 fingerprint, TLS fingerprinting, ClientHello fingerprint

Definition

A TLS fingerprint is a short summary of how a client opens an encrypted connection (the TLS version, cipher suites and extensions in its first message) that identifies the software making the connection, whatever its user agent says.

Last updated 7 November 2026

### How it works

Every HTTPS connection starts with a ClientHello message in which the client lists the TLS versions, cipher suites, extensions, curves and other options it supports. Each TLS library fills it in its own way, so Chrome, Firefox, Safari and a Python script all look different at this step. JA3, published by Salesforce engineers in 2017, turns those fields into a hash. Chrome later began shuffling the order of its extensions, which made JA3 values unstable, and JA4 from FoxIO sorts them first and adds readable parts such as the protocol and the number of ciphers.

The fingerprint is taken by the server, or the CDN or firewall in front of it, before any page loads. JavaScript can’t see or change it.

### Why it matters when you run several accounts

The TLS fingerprint describes the real browser build. If a profile’s user agent says Firefox but the handshake is Chrome’s, or an automation library connects with its own TLS stack, the server sees the contradiction without running a single script. It is one of the reasons “changing the user agent” on its own doesn’t hold up.

### How SoftGlaze Browser handles it

SoftGlaze Browser doesn’t try to fake TLS. Chromium profiles run real Chrome builds, either Chrome for Testing downloaded by version or the Google Chrome installed on your computer, so the handshake is genuinely that of the version the profile reports. When a profile presents as another Chromium brand, the user agent, Client Hints and navigator identity change while TLS and JA4 stay those of the real Chrome underneath, as the editor states. Firefox profiles run real Firefox, with Firefox’s own handshake.

### Sources

1.  [JA3: a method for profiling SSL/TLS clients](https://github.com/salesforce/ja3) Salesforce (GitHub)
2.  [JA4+ network fingerprinting](https://github.com/FoxIO-LLC/ja4) FoxIO (GitHub)
3.  [RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3](https://www.rfc-editor.org/rfc/rfc8446) IETF

Outside sources were checked in November 2026. Browsers, standards and vendors' pages change, so details that depend on them are as of that month.

### Related terms

-   [User agent](https://browser.softglaze.com/glossary/user-agent) A user agent string is the line of text a browser sends with every request, and shows to scripts, naming the browser, its version, the rendering engine and the operating system.
-   [User-Agent Client Hints](https://browser.softglaze.com/glossary/client-hints) User-Agent Client Hints are a newer way for a browser to describe itself: a short brand and version list sent in Sec-CH-UA headers, with more detail, such as the platform version, architecture and full version, given only when a site asks for it.
-   [Chromium](https://browser.softglaze.com/glossary/chromium) Chromium is the open-source browser project that Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi and many other browsers are built on.
-   [Browser fingerprint](https://browser.softglaze.com/glossary/browser-fingerprint) A browser fingerprint is the combination of values a website can read from your browser and device without storing anything, such as the user agent, screen size, time zone, fonts and graphics card, which together can tell one browser from another.

### Read more on this site

-   [Docs: engines](https://browser.softglaze.com/docs/profiles#engines)
-   [Fingerprint management: OS and brand](https://browser.softglaze.com/features/fingerprint-management#os-and-brand)

### See it in SoftGlaze Browser

Separate profiles, each with its own cookies, device values and proxy, on Windows. Try the app's screens in your browser first, or start the free trial; no card needed.

[Download for Windows](https://browser.softglaze.com/download) [Try the demo](https://browser.softglaze.com/demo) [All terms](https://browser.softglaze.com/glossary)