JA4
acronymsecuritycryptography
Stands for: JA4 TLS client fingerprint (JA4+ suite)
A newer, more robust family of TLS and network fingerprints.
JA4 (part of the JA4+ suite) improves on JA3 with a more structured, harder-to-evade fingerprint of the ClientHello, and adds companion fingerprints for other protocols. It resists the ordering tricks that let clients dodge JA3.
JA4 is the successor to JA3, and it exists because the original stopped working. JA3 hashed the ordered list of what a TLS client offers, which identified software reliably until libraries began randomizing extension order deliberately, at which point the same client produced a different hash on every connection.
The redesign fixes that and more. JA4 sorts the fields it hashes so ordering no longer matters, and it produces a human-readable structure rather than one opaque digest, so an analyst can see which component of a fingerprint changed instead of only that it changed. It also covers more than the client handshake, extending the same approach to server responses, HTTP behaviour and other protocols.
The strategic point survives both versions. Fingerprinting identifies implementations, not intentions, so it belongs in correlation and triage rather than in blocking decisions made alone. And it remains an arms race: any signal derived from what a client voluntarily sends can eventually be imitated by a client that knows it is being measured, which is why the technique is a useful input and never a verdict.
Also known as: ja4, JA4+, JA4 fingerprint