JA3 Fingerprint

JA3 fingerprint is a technique used to create a unique identifier for a client’s TLS (Transport Layer Security) configuration during the TLS handshake. It was developed by Salesforce researchers to help detect malicious traffic and distinguish between different clients (e.g., browsers, bots, or malware) based on how they initiate secure connections.

JA3 works by collecting specific fields from the Client Hello packet in the TLS handshake—such as the SSL version, accepted cipher suites, extensions, elliptic curves, and elliptic curve formats—and concatenating them into a string. This string is then hashed using MD5 to produce a fingerprint.

Also known as: TLS fingerprint, JA3 hash, Client Hello fingerprint

Comparisons

• JA3 vs. JA3S: JA3 fingerprints the client's handshake (Client Hello), while JA3S fingerprints the server's handshake (Server Hello).
• JA3 vs. User-Agent Strings: JA3 is harder to spoof and more consistent across sessions compared to user-agent strings, which can be easily manipulated.

Pros

• Non-intrusive: Works passively by observing network traffic.

• Effective bot detection: Identifies malware and automated tools that use unique TLS configurations.

• Cross-platform: Works regardless of operating system or language used.

Cons

• Spoofable: Sophisticated attackers can mimic known JA3 fingerprints.

• Not foolproof: Similar clients may share fingerprints, leading to false positives or ambiguity.
• Obfuscation risk: Encrypted and tunneled traffic may hide TLS handshake details.

Example

A client initiates a TLS handshake with the following fields:

This hash can be compared against threat databases or analytics tools to detect suspicious or known malicious clients.