Free tool · No account required
JA4 fingerprint decoder
Read the fields inside a JA4 TLS client fingerprint. Start with the worked example from FoxIO’s JA4 specification, or paste a value from your own logs.
Decoded fields
t13d1516h2_8daaf6152771_e5627efa2ab1- Transport
t - TLS over TCP
- Version
13 - TLS 1.3
- Server Name Indication
d - SNI extension present
- Cipher count
15 - 15, excluding GREASE
- Extension count
16 - 16, excluding GREASE
- ALPN marker
h2 - Two-character encoding of the first offered ALPN value; not the negotiated protocol
- Cipher hash
8daaf6152771 - Truncated SHA-256 of sorted cipher values; zeros represent an empty list
- Extension hash
e5627efa2ab1 - Truncated SHA-256 of sorted extensions and ordered signature algorithms; SNI and ALPN excluded
Format recognized. This checks the structure, not whether the hashes match a real ClientHello or identify a particular client.
What does a JA4 fingerprint tell you?
The prefix describes the client’s handshake: transport, offered version, SNI presence, cipher and extension counts, and an ALPN marker. Two hashes summarize additional handshake values. The fingerprint does not contain the hostname, User-Agent, or software name.
For example, h2 is consistent with an offered ALPN of h2, and h1 with http/1.1. The marker is lossy; it cannot prove the full ALPN string or which protocol the server selected.
Decoding and database lookup answer different questions
This decoder explains the string you provide. It does not query a capture catalog, observe your browser’s TLS connection, or assign a bot score. To identify candidate software, compare the complete fingerprint with reference observations whose client and environment are known.
Byteprint is developing its own TLS fingerprinting approach and software reference database. This tool decodes the public JA4 format; it does not specify Byteprint’s developing format or promise compatibility. Database and API access are in private beta preparation; join the waitlist for access. The decoder is available now.
Why is my fingerprint rejected?
This tool accepts the standard hashed JA4 client format: ten prefix characters, an underscore, twelve lowercase hexadecimal characters, another underscore, and twelve more. JA3, JA4S, raw JA4 exports, and truncated strings have different shapes. Copy the complete JA4 field from your log source.
Can two applications share a JA4?
Yes. Software that shares a TLS implementation and configuration can produce identical fingerprint inputs. A matching value supports a candidate match; it does not prove a unique application, a human visitor, or malicious intent. See the JA3 and JA4 comparison for a practical investigation workflow.