See yourJA3, JA4 & HTTP/2fingerprint — the way Cloudflare sees it.

What is a browser fingerprint?

A browser fingerprint is a set of device, network, and software signals a website can read from your client to identify it — without using cookies. Two broad families exist. Passive fingerprints come from data you send just by connecting: the TLS ClientHello, HTTP/2 SETTINGS frame, IP, and headers. Active fingerprints are gathered with JavaScript: canvas, WebGL, fonts, audio context, screen geometry. Anti-bot systems combine both into a stable identifier that survives proxy rotation, incognito mode, and clearing cookies — which is exactly why simple "rotate the User-Agent" tactics rarely fool modern WAFs.

What is JA3?

JA3 is a fingerprint of the TLS ClientHello — the first packet your client sends on every HTTPS connection. It hashes (MD5) five fields concatenated in order: TLS version, cipher suites, extensions, elliptic curves, EC point formats. Because each TLS library (OpenSSL, BoringSSL, NSS, Schannel, rustls, Go crypto/tls) builds the ClientHello slightly differently, the resulting hash is a strong tell about which client you're using — even if your User-Agent says otherwise. JA3 was published by Salesforce in 2017 and is used in Suricata, Zeek, and most commercial anti-bot vendors. Its weakness: post-Chrome-110 extension shuffling and GREASE values broke JA3's stability for real browsers, which is why JA4 was created.

What is JA4?

JA4 is the 2023 successor to JA3 from FoxIO. It fixes two big problems: it sorts extensions before hashing (so Chrome's extension shuffling no longer changes the fingerprint), and it explicitly covers TLS 1.3 features JA3 didn't — ALPN, signature algorithms, supported versions. The format is human-readable: t13d1516h2_8daaf6152771_b0da82dd1658 means TLS 1.3, 15 ciphers, 16 extensions, ALPN h2, then a hash of the sorted ciphers and a hash of the extensions plus signature algorithms. Anti-bot vendors are migrating from JA3 to JA4 throughout 2024–2025.

How anti-bot systems use TLS fingerprints

Cloudflare, Akamai Bot Manager, DataDome, PerimeterX (HUMAN), and Imperva all score the TLS fingerprint as one of their highest-weighted signals. The classic story: a scraper sends User-Agent: Mozilla/5.0 ... Chrome/128 but the JA3 hash is cd08e31494f9531f560d64c695473da9 — the well-known Python requests fingerprint. The WAF blocks the request before your code even gets to handle a response. This is why "Cloudflare blocks Python requests" is the most-Googled question in the scraping community — it's not Python, it's the OpenSSL ClientHello shape that gives it away. Real browsers send 15+ ciphers and 14+ extensions; OpenSSL clients send a distinct set with a different order. The mismatch is trivial to flag.

How to change your client's JA3/JA4

1. Use a TLS-mimicking library

Tools like curl-impersonate, tls-client (Go), and the curl_cffi Python binding patch the TLS stack to send a real browser's ClientHello byte-for-byte. JA3/JA4 will match whichever Chrome/Firefox/Safari profile you pick.

2. Use a real browser

Playwright and Selenium drive actual Chrome/Firefox/Safari binaries, so the TLS layer is genuine and the JA3 matches automatically. Detection then shifts to the JS layer (navigator.webdriver, CDP attributes) — which stealth plugins handle.

3. Route through Scrappey

Scrappey's requestType: "browser" mode runs your target inside a real Chrome with rotating residential proxies — TLS fingerprint, HTTP/2 settings, IP reputation, and JS challenges all handled in one call. 150 free credits to try it.

TLS fingerprinting vs. browser fingerprinting vs. IP reputation

FAQ