# HTTP header-order fingerprint

> Paste a request header block and see how header order and casing fingerprint the client - the passive-HTTP analog of JA3.

- Tool: https://ronutz.com/en/tools/http-header-order-fingerprint
- Family: Security & WAF

---

## What it does

Paste a raw HTTP request header block - a request line and one "Name: value" per line - and the tool explains how the order and casing of the headers fingerprint the client. It classifies the sender as a Chromium-family browser, Firefox, or an HTTP library by matching the header sequence and checking for browser-only headers like Sec-Fetch and Sec-CH-UA, notes the HTTP/2 lowercasing signal, and lists any common browser headers that are missing.

## The passive-HTTP analog of JA3

JA3 fingerprints a TLS client by the order of the ciphers and extensions in its ClientHello. Header order is the same idea one layer up: browsers, libraries, and bots each emit request headers in a characteristic sequence, and that sequence survives even when the values are spoofed. A request whose header order contradicts the User-Agent it claims - Chrome's UA with curl's header set - is a classic bot tell, which is why bot-detection and WAF systems key on it.

## Reading the result

The order hash is a short stable id for the exact header sequence, shown for display only. The per-header notes explain why each position matters; the casing note flags whether the block looks like an HTTP/1.1 capture (Title-Case) or an HTTP/2 one (lowercase on the wire). Decode/explain only; the headers you paste never leave your browser.

## Standards and references

- [RFC 9110 — HTTP Semantics (field order)](https://www.rfc-editor.org/rfc/rfc9110) - header field semantics; order not significant to meaning but observable
- [RFC 9113 — HTTP/2 (lowercased field names, :authority)](https://www.rfc-editor.org/rfc/rfc9113) - the wire lowercasing and pseudo-headers this tool notes
- [W3C — Fetch Metadata Request Headers](https://www.w3.org/TR/fetch-metadata/) - Sec-Fetch-* headers emitted by browsers

## Related reading

- [Passive Fingerprinting: What You Emit Without Being Asked](https://ronutz.com/en/learn/passive-fingerprinting-what-you-emit.md): Every connection announces its stack before a byte of application data flows. How a TCP SYN, a User-Agent string, and the mere order of HTTP headers each identify a client - and why a mismatch between them is the classic proxy and bot tell.