Glossary
TLS fingerprint
A fingerprint of how a browser opens an encrypted connection: the ciphers, extensions and settings in its first TLS message. It comes from the browser engine, so neither a proxy nor a fake user agent changes it.
Also called: JA3, JA4, TLS client fingerprint, ClientHello fingerprint.
The best-known formats are JA3 and its successor JA4. Cloudflare explains that these fingerprints "identify TLS clients based on how they initiate connections" and that JA4 "improves on JA3 by sorting ClientHello extensions," which matters because Chrome has shuffled their order since early 2023.
In our October 2026 test, Chrome 156 with a Safari user agent still sent the JA4 t13d1517h2_8daaf6152771_cb7bf5808d99, the exact value FoxIO, the company that created JA4, lists for Chrome. That's why claiming a different browser family on a Chromium kernel creates a mismatch.
For an antidetect profile, the safe choice is to claim the browser your kernel really is and keep the kernel current. Switches that disable TLS cipher suites move the handshake away from what real Chrome sends.
Related terms: Browser fingerprint, User agent, Browser kernel, Proxy.