Definition

JA4 is an evolution of the JA3 fingerprinting method, designed to provide a more accurate and resilient way of identifying TLS clients.

While JA3 is based on hashing selected fields from the TLS ClientHello message (such as the TLS version, cipher suites, and extensions), JA4 introduces a more structured, versioned, and expressive representation of the TLS handshake.

Instead of producing a single MD5 hash, JA4 generates a compact, human-readable string that encodes multiple characteristics of the TLS connection in a fixed format. These typically include:

• the TLS version and handshake type
• the general structure and ordering of cipher suites
• the presence and pattern of TLS extensions
• protocol negotiation details such as ALPN

Like JA3, JA4 relies on data sent in the ClientHello message, which is transmitted in plain text before encryption begins. This allows network devices and security systems to observe the handshake and derive the JA4 fingerprint without decrypting traffic.

JA4 is designed to reduce the ambiguity and collision issues seen with JA3. By encoding more contextual information and separating different aspects of the handshake, it becomes harder for distinct clients or tools to accidentally share the same fingerprint. However, it is still possible for different implementations with very similar TLS configurations to produce identical or near-identical JA4 fingerprints.

Relevance to Kameleo

Kameleo approaches JA4 fingerprinting in the same way as JA3: by ensuring that the TLS handshake parameters are consistent with real, widely used browsers.

This means that the generated JA4 fingerprints are not random or synthetic, but follow the same patterns, structures, and value combinations observed in genuine browser traffic. By aligning JA4 at the TLS layer just like JA3, Kameleo avoids unusual or inconsistent handshake characteristics that could stand out to detection systems.

In practice, treating JA4 with the same level of control and realism as JA3 helps Kameleo maintain a coherent TLS fingerprint and reduces the risk of being identified as an automated or non-browser client.