JA3
acronymsecuritycryptography
Stands for: JA3 TLS client fingerprint
A fingerprint of a TLS client built from the fields in its ClientHello.
JA3 hashes a set of ClientHello fields - TLS version, cipher list, extensions - into a short signature (an MD5 hash) that often identifies the client software or malware family, regardless of IP. JA4 is its more robust successor.
JA3 turns a TLS Client Hello into a short fingerprint by hashing the ordered list of things a client offers: version, cipher suites, extensions, curves and point formats. Different software makes different choices in a different order, so the hash identifies the implementation without decrypting anything at all.
That property is why it spread. A defender can spot a known malware family by its handshake even inside encrypted traffic, and can flag a client claiming to be a browser in its user agent while handshaking like a scripting library. The signal is metadata rather than content, which is precisely what makes it usable where inspection is impossible or unwelcome.
Its limits are equally worth stating. A fingerprint identifies software, not intent, so a match is a lead rather than a verdict, and legitimate tools share hashes with unpleasant ones. Attackers learned to mimic browser handshakes deliberately, which is straightforward once the target is known. And TLS libraries began randomizing extension order, breaking the assumption the technique rests on, which is why JA4 exists and why treating a fingerprint as identity rather than as a hint ages badly.
Also known as: ja3, JA3 fingerprint