JA3

JA3 is a method for fingerprinting TLS clients, published by Salesforce engineers in 2017. It takes five fields of the ClientHello (legacy version, cipher suites, extensions, elliptic curves and point formats), writes them as decimal values in the order sent, ignores GREASE values, and hashes the string with MD5. JA3S applies the same idea to the server's reply.

JA3 lets analysts group connections made by the same TLS stack without decrypting traffic. Since early 2023, Chromium browsers randomize extension order, so the same browser yields many different JA3 values; JA4 was designed to stay stable in that case. The comparison is in JA3 and JA4 TLS fingerprinting; the reference implementation is on GitHub.