Glossary
JA4
JA4 is FoxIO's TLS client fingerprint: a readable prefix plus truncated SHA-256 hashes of sorted ciphers and extensions, stable under reordering.
JA4 is a TLS client fingerprint published by FoxIO in 2023 as part of the JA4+ family. It has three parts, a_b_c. Part a is readable: protocol (TCP, QUIC or DTLS), highest TLS version, whether an SNI domain is present, the number of ciphers and extensions, and the first and last characters of the first ALPN value. Parts b and c are the first 12 hex characters of SHA-256 hashes of the sorted cipher list and of the sorted extension list plus signature algorithms.
Sorting makes JA4 stable when a client randomizes extension order, which broke JA3 for Chromium browsers. The JA4 TLS client method is BSD 3-Clause licensed; the specification is public. See JA3 and JA4 TLS fingerprinting.