MCPReview
⚡ Browser Leaderboard
Home /Tools /TLS Fingerprint Tester
🔒 Live Security Telemetry

TLS & JA4 Browser Fingerprint Tester

Inspect your browser's unencrypted ClientHello packet in real-time. Analyze modern JA4 and legacy JA3 digests, Akamai HTTP/2 frame signatures, cipher suites, and anti-bot evasion trust scores.

Analyzing ClientHello Handshake...
Capturing TLS ciphers, extensions, and HTTP/2 frames directly from your browser connection
Anti-Bot Trust Score
98 / 100
✅ Verified Human Browser Profile
Detected Cryptographic Engine
BoringSSL (Chromium 131+)
Post-Quantum Kyber768 Key Shares Present
User-Agent vs TLS Consistency
100% Consistent
No User-Agent spoofing discrepancy detected
Modern Standard (FoxIO 2023)

JA4 Fingerprint

Resistant to Chrome's randomized extension shuffling. The primary fingerprint used by Cloudflare & DataDome.

t13d3112h2_e8f1e7e78f70_b26ce05bbdd6
JA4 Section Decomposition:
t (TCP)13 (TLS 1.3)d (SNI Domain)31 Ciphers12 Extensionsh2 (HTTP/2)
Legacy Standard (Salesforce 2017)

JA3 Digest & Raw Hash

MD5 hash of unencrypted SSLVersion, Ciphers, Extensions, EllipticCurves, and ECPointFormats.

0149f47eabf9a20d0893e2a44e5a6323
Note: In modern Chromium, extension permutation changes on each tab, which causes the legacy JA3 hash to alternate between 2-4 variants while JA4 remains stable.
HTTP/2 Frame Analysis

Akamai HTTP/2 Signature

Hashes SETTINGS frame values, WINDOW_UPDATE increments, and pseudo-header sequence (:method, :authority, :scheme, :path).

64a832f547be33249bf4d33e8a46c5dc
1:65536,2:0,3:1000,4:6291456,6:262144|15663105|0|m,a,s,p
Negotiated TransportTLS 1.3

Protocol & ALPN State

  • Negotiated Version:TLS 1.3 (RFC 8446)
  • Record Layer Version:TLS 1.0 (Compatibility)
  • ALPN Protocol:h2 (HTTP/2)
  • GREASE Values:Detected (Active Anti-Ossification)

Detailed Cryptographic Parameters

The exact sequence of cipher suites offered by your browser in the ClientHello packet. Anti-bot heuristics flag clients when this sequence does not match the standard Chromium / Firefox ordering.

#Cipher Suite Name (RFC)Standard
Loading cipher suites...

Why Standard Web Scrapers Get Blocked by TLS Fingerprinting

When scraping modern websites protected by Cloudflare, DataDome, or Akamai, changing your User-Agent header is not enough. Anti-bot engines inspect the TLS ClientHello packet at the transport layer before any HTTP request headers are inspected:

Client StackTLS EngineJA4 SignatureGREASE & ECHAnti-Bot Result
Python requests / urllib3OpenSSL 3.0t13i0015h1_...❌ No (Static order)Blocked Instantly (403)
Node.js axios / undiciNode crypto (OpenSSL)t13d1715h1_...❌ NoBlocked Instantly (403)
Stock Headless ChromiumBoringSSLt13d3112h2_...✔ī¸ YesFlagged on CDP Leaks
⚡ 2Captcha Cloud Browser (Rank #1)BoringSSL + Real Chromet13d3112h2_e8f1e7...✔ī¸ 100% Genuine Chrome100% Pass (Undetected)
🏆 Recommended Solution

Bypass TLS & JA4 Fingerprint Blocking with 2Captcha Cloud Browser

$0.05 / hour
Pay-as-you-go â€ĸ Zero setup fee

Instead of constantly debugging OpenSSL cipher suites, TLS extension permutations, and HTTP/2 settings frames, connect your automation directly to 2Captcha's real Chromium browser cloud. Native residential proxy routing, automatic Cloudflare Turnstile bypass, and 100% authentic browser TLS handshakes included out of the box.

# Python Playwright with 100% Authentic Chrome TLS & JA4 Fingerprint
import asyncio
from playwright.async_api import async_playwright

API_KEY = "YOUR_2CAPTCHA_API_KEY"
WS_ENDPOINT = f"wss://browser.2captcha.com/webdriver/v1?apiKey={API_KEY}"

async def run():
    async with async_playwright() as p:
        # Connects to real cloud Chromium with authentic JA4 & Akamai H2 stack
        browser = await p.chromium.connect_over_cdp(WS_ENDPOINT)
        page = await browser.new_page()
        await page.goto("https://browser-review.com/tls-fingerprint")
        print("TLS Verified: Passed with 100% genuine Chrome fingerprint")
        await browser.close()

asyncio.run(run())
Get 2Captcha Browser API Key ($0.05 / hr) →Open Code & MCP Generator

How TLS Fingerprinting Works (The ClientHello Handshake)

Before an HTTPS connection can transmit encrypted HTTP request headers, cookies, or HTML payloads, the browser and web server must negotiate encryption algorithms. This initial handshake is initiated by the client sending a plain-text ClientHello packet over TCP.

The ClientHello contains the client's supported TLS versions, a prioritized list of cryptographic cipher suites, compression methods, and an array of TLS extensions (such as Server Name Indication, supported elliptic curve groups, and ALPN protocol candidates). Because every browser family (Chromium, Firefox, Safari) and programming runtime (Python, Go, Node.js, cURL) compiles against a different TLS library (BoringSSL, NSS, SecureTransport, OpenSSL), their ClientHello configurations are structurally distinct.

JA3 vs JA4: Why Anti-Bot Firewalls Upgraded

In 2017, Salesforce open-sourced JA3, which concatenated five fields (TLS Version, Ciphers, Extensions, Elliptic Curves, Point Formats) in the exact order received and produced an MD5 digest. While revolutionary, JA3 suffered from a critical vulnerability: modern Chromium builds dynamically shuffle their TLS extension order on every connection to prevent protocol ossification. As a result, a single unmodified Google Chrome browser produces rotating JA3 hashes.

In 2023, FoxIO released JA4 to replace JA3. JA4 sorts extensions and ciphers alphabetically prior to hashing. This ensures that Google Chrome's randomized extension permutation always produces a stable, deterministic JA4 hash (such as t13d3112h2_...). Today, tier-one anti-bot systems like Cloudflare WAF, Akamai Bot Manager, and DataDome rely predominantly on JA4 and JA4+ behavioral telemetry.

What is Akamai HTTP/2 Fingerprinting?

Once the TLS handshake concludes, clients negotiating the h2 ALPN protocol exchange HTTP/2 connection frames. The first frames sent by the client include the SETTINGS frame, which dictates connection limits:

  • HEADER_TABLE_SIZE (e.g. 65536)
  • ENABLE_PUSH (0 for modern clients)
  • MAX_CONCURRENT_STREAMS (e.g. 1000)
  • INITIAL_WINDOW_SIZE (e.g. 6291456)
  • MAX_FRAME_SIZE (e.g. 16384)
  • Pseudo-header order (e.g., :method, :authority, :scheme, :path in Chromium vs :method, :path, :authority, :scheme in standard curl)

Akamai and Cloudflare hash these parameters into a composite HTTP/2 fingerprint. If your automated bot script emulates a Chrome TLS handshake but sends an un-ordered or default Node.js HTTP/2 SETTINGS frame, the connection is immediately flagged as automated scraper traffic.

Frequently Asked Questions

Does a VPN or residential proxy change my TLS fingerprint?

No. Standard HTTPS proxies and VPNs establish a TCP tunnel (HTTP CONNECT). Your local browser still performs the TLS handshake directly with the destination server. Therefore, if you route Python requests through an expensive residential proxy, Cloudflare will still block you because the TLS ClientHello fingerprint remains that of OpenSSL, not Google Chrome.

Can I forge a Chrome JA4 fingerprint in Python without a browser?

Specialized libraries like curl_cffi or tls-client attempt to impersonate Chrome's BoringSSL ciphers. However, anti-bot vendors continuously update their inspection rules to check post-quantum Kyber768 key shares, ECH headers, and subsequent JavaScript CDP leaks. For mission-critical data extraction, connecting to a real cloud browser (like 2Captcha Cloud Browser) provides 100% protection against TLS classification.