JA4 fingerprint lookup

What is a JA4 fingerprint?

JA4 summarises the TLS ClientHello a client sends when it opens a connection: the TLS version, the cipher list, the extension list, and the ALPN values it offers. Different software makes different choices there, and makes them consistently, so the summary identifies the client stack far more reliably than a User-Agent header, which the client simply asserts and can set to anything.

A fingerprint looks like t13d1516h2_8daaf6152771_b186095e22b6: three lowercase segments of 10, 12 and 12 characters.

How it works

Paste a fingerprint and the lookup returns an overview. It shows how often the fingerprint was observed, across how many client addresses and networks, and when it was first and last seen, followed by one row for each (User-Agent, TCP stack) pair recorded against it.

If you do not have a fingerprint to hand, the button above the input observes your own connection instead — and records it. The last question below says exactly what that means.

A User-Agent claiming Windows Chrome, arriving on a TCP stack whose option order implies a Unix-like kernel, is a disagreement the client did not intend to publish. Each row shows both halves and leaves the conclusion to you.

Rows keep measurement separate from interpretation. The User-Agent, the TCP fingerprint, the counts and the dates are what was observed. The client family, the OS family and any contradictions are a reading of those observations. Ignore those three fields and the evidence is still there. Every observation comes from a single sensor watching one edge, which the corpus panel restates on every result.

When to use this tool

• You have a JA4 from a WAF log, CDN report, or packet capture and want to know what client stack it belongs to.
• Checking whether a User-Agent’s claim agrees with the TLS and TCP stacks underneath it, such as a crawler presenting a browser User-Agent.
• Confirming which fingerprint a client library produces before writing a detection or allow rule around it.
• Checking that a fingerprint computed from your own capture matches what an edge recorded for the same client.

Common pitfalls

• JA4 identifies a TLS stack, not an application or a person. Two unrelated programs built against the same TLS library version often share a fingerprint exactly.
• Some clients deliberately shuffle their extension order between connections, so one program produces many different JA4 values. For those, a fingerprint is not a stable identifier by the client’s own design.
• Counts are local. “Seen 3 times” means three times at that one edge, not three times on the internet, and a fingerprint that is absent simply never connected here.

Frequently asked

Why does it say my fingerprint was never observed?

Because it probably was not. The corpus watches one edge, so the vast majority of fingerprints in the world are absent from it. That result tells you nothing about whether the client is common, rare, or suspicious, only that it has not connected to this sensor.

Can I search for fingerprints by User-Agent or by name?

No. The corpus answers lookups by exact fingerprint only. There is no search index and no suggestions endpoint, so this tool is designed as “paste one you already have” rather than as a way to browse or discover fingerprints.

What does an empty TCP stack column mean?

That no SYN packet was observed for those connections. It does not mean the client sent no TCP options. Most older observations predate SYN capture, so an absent stack is a gap in the recording rather than a fact about the client.

Does the fingerprint I paste leave my browser?

Yes. The corpus lives on a server we run and cannot be shipped to your browser, so the fingerprint is sent there to answer the lookup. It is not stored, and nothing on that path ties it to you: no cookie, no session, no address recorded against it. It may appear briefly in our own request traces.

What happens when I click “What is my fingerprint?”

Something no other tool here does. Your browser opens a connection to an edge server we run, and the edge records what it saw: the TLS fingerprint of that connection, the TCP fields behind it, your IP address and your User-Agent. We keep that observation. The fingerprint, the TCP fields and the User-Agent become part of this corpus — the next person to look up your fingerprint will see them counted; your address is stored with the observation but is never served by the lookup. The fingerprint is then looked up exactly as if you had pasted it.

The page says this beside the button, before you click, because it is the opposite of what the rest of the site does. Pasting a fingerprint records nothing. Pressing that button records your connection.