[Blog](https://scrapfly.io/blog) / [JA3/JA4 TLS Fingerprinting: Guide to Detection and Evasion](https://scrapfly.io/blog/posts/ja3-ja4-tls-fingerprinting-guide-to-detection-and-evasion) # JA3/JA4 TLS Fingerprinting: Guide to Detection and Evasion by [Hisham Medhat](https://scrapfly.io/blog/author/hisham) Jul 13, 2026 20 min read [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fja3-ja4-tls-fingerprinting-guide-to-detection-and-evasion "Share on LinkedIn") [ ](https://x.com/intent/tweet?url=https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fja3-ja4-tls-fingerprinting-guide-to-detection-and-evasion&text=JA3%2FJA4%20TLS%20Fingerprinting%3A%20Guide%20to%20Detection%20and%20Evasion "Share on X") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fja3-ja4-tls-fingerprinting-guide-to-detection-and-evasion "Share on Facebook") Summarize this article with [ ](https://chat.openai.com/?q=Summarize%20this%20article%20and%20explain%20how%20Scrapfly%20helps%20me%20scrape%20any%20website%20at%20scale%20and%20bypass%20anti-bot%20systems%20for%20my%20use%20case%3A%20https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fja3-ja4-tls-fingerprinting-guide-to-detection-and-evasion) [ ](https://claude.ai/new?q=Summarize%20this%20article%20and%20explain%20how%20Scrapfly%20helps%20me%20scrape%20any%20website%20at%20scale%20and%20bypass%20anti-bot%20systems%20for%20my%20use%20case%3A%20https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fja3-ja4-tls-fingerprinting-guide-to-detection-and-evasion) [ ](https://x.com/i/grok?text=Summarize%20this%20article%20and%20explain%20how%20Scrapfly%20helps%20me%20scrape%20any%20website%20at%20scale%20and%20bypass%20anti-bot%20systems%20for%20my%20use%20case%3A%20https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fja3-ja4-tls-fingerprinting-guide-to-detection-and-evasion) [ ](https://www.perplexity.ai/search/new?q=Summarize%20this%20article%20and%20explain%20how%20Scrapfly%20helps%20me%20scrape%20any%20website%20at%20scale%20and%20bypass%20anti-bot%20systems%20for%20my%20use%20case%3A%20https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fja3-ja4-tls-fingerprinting-guide-to-detection-and-evasion) [ ](https://www.google.com/search?udm=50&aep=11&q=Summarize%20this%20article%20and%20explain%20how%20Scrapfly%20helps%20me%20scrape%20any%20website%20at%20scale%20and%20bypass%20anti-bot%20systems%20for%20my%20use%20case%3A%20https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fja3-ja4-tls-fingerprinting-guide-to-detection-and-evasion) Your web scraper returns a 403 Forbidden response. The headers look perfect, the IP is residential, and the cookies are clean. What went wrong? The server fingerprinted your TLS handshake before your request reached the application layer. Most scrapers overlook TLS fingerprinting entirely. But anti-bot systems like Cloudflare and DataDome rely on TLS fingerprints to catch automated traffic. That handshake happens before your first HTTP header lands, so header spoofing never touches it. This guide breaks down how JA3 and JA4 read the TLS Client Hello and how anti-bot systems act on it. You'll also see why Chrome's 2023 randomization broke JA3, then how to make your handshake match a real browser with curl\_cffi or Scrapfly. [How TLS Fingerprint is Used to Block Web Scrapers?TLS fingeprinting is a popular way to identify web scrapers that not many developers are aware of. What is it and how can we fortify our scrapers to avoid being detected?](https://scrapfly.io/blog/posts/how-to-avoid-web-scraping-blocking-tls) ## Key Takeaways - TLS fingerprinting identifies your scraper from the handshake itself, before a single HTTP header is read. No amount of header or cookie spoofing hides a Python client that shakes hands like Python. - **JA3** hashes five TLS Client Hello fields into one 32-character MD5 fingerprint - **Mismatch is the tell**: your User-Agent says Chrome while your JA3 says Python - **Chrome's 2023 randomization** broke JA3 for browsers but made static scrapers obvious - **JA4** sorts extensions and adds QUIC, so shuffling extension order no longer defeats it - **Bypass it**: curl\_cffi mimics one browser; Scrapfly rotates real fingerprints per request **Get web scraping tips in your inbox**Trusted by 100K+ developers and 30K+ enterprises. Unsubscribe anytime. ## What Is TLS Fingerprinting? Every HTTPS connection starts with a Client Hello message. The client sends the Client Hello in plaintext before encryption begins. Anyone between the client and the server can read the Client Hello contents. The handshake has to happen in the clear because neither side has agreed on encryption keys yet. The Client Hello contains several fields that describe the client's TLS capabilities: - **TLS version**: The protocol version the client supports (e.g., TLS 1.2, TLS 1.3) - **Cipher suites**: An ordered list of encryption algorithms the client can use - **Extensions**: Additional features the client supports, like server name indication (SNI) and application layer protocols - **Elliptic curves**: The mathematical curves available for key exchange - **EC point formats**: How the client represents points on elliptic curves Each HTTP client sends a slightly different combination of these values. Chrome, Firefox, Safari, Python's `requests` library, and Go's `net/http` package all produce distinct Client Hello messages. The differences come from each client's underlying TLS library, its configuration, and the features the developers chose to allow. For example, Chrome uses Google's BoringSSL library, which advertises a specific set of cipher suites in a specific order. Python's `requests` library uses OpenSSL through `urllib3`, which advertises a different set in a different order. These differences are consistent and predictable. Every time Chrome connects to a server, it sends a nearly identical Client Hello. Every time Python `requests` connects, it sends its own consistent Client Hello. TLS fingerprinting in web scraping exploits these differences. Servers extract specific fields from the Client Hello and build a unique identifier. That identifier reveals which software made the connection, no HTTP headers needed. JA3 is the most widely used TLS fingerprinting method. Salesforce researchers John Althouse, Jeff Atkinson, and Josh Atkins created it in 2017, and the name comes from their initials. JA3 converts these Client Hello fields into a normalized string and an MD5 hash. ## How JA3 Fingerprinting Works ### JA3 Field Order and Hash Calculation JA3 works by extracting five specific fields from the TLS Client Hello message and concatenating them in a fixed order: text```text TLSVersion,Ciphers,Extensions,EllipticCurves,EllipticCurvePointFormats ``` Each field uses decimal values. A comma separates the five fields, and a hyphen separates individual values within each field. The result is the **JA3 full string**, which is the human-readable form of the fingerprint. Here's what a JA3 full string looks like for a Chrome browser: text```text 771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-21,29-23-24,0 ``` The five sections map directly to the Client Hello fields: - `771` = TLS version 1.2 (0x0303 in hex = 771 in decimal) - `4865-4866-4867-...` = Cipher suites in the order the client sends them - `0-23-65281-...` = TLS extensions in the order the client sends them - `29-23-24` = Supported elliptic curves (named groups) - `0` = EC point formats The JA3 full string is then hashed with MD5 to produce a 32-character **JA3 hash**: python```python import hashlib # JA3 full string (human-readable form) ja3_full_string = ( "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53," "0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-21," "29-23-24," "0" ) # MD5 hash produces the 32-character JA3 fingerprint ja3_hash = hashlib.md5(ja3_full_string.encode()).hexdigest() print(f"JA3 Hash: {ja3_hash}") # Output: JA3 Hash: cd08e31494f9531f560d64c695473da9 ``` This code takes the raw JA3 full string and computes its MD5 hash. The resulting 32-character string gets stored in databases and compared across requests. Salesforce chose MD5 because the full string can grow large, and the hash keeps storage compact. JA3 also ignores **GREASE values** (Generate Random Extensions And Sustain Extensibility). Google introduced GREASE to stop servers from rejecting unknown TLS values. GREASE values follow a specific pattern (0x0a0a, 0x1a1a, etc.), and JA3 strips them before hashing. That keeps Chrome's JA3 hash consistent no matter which random GREASE values it inserts. ### JA3S: Server-Side Fingerprinting JA3S applies the same concept to the Server Hello response, using three fields: TLS version, selected cipher suite, and extensions. Servers respond differently depending on what the client sends. A JA3S fingerprint paired with a JA3 fingerprint gives a more precise identification. Anti-bot systems mostly rely on client-side JA3, so JA3S is a secondary signal in scraper detection. Anti-bot systems compare that fingerprint with the client's claimed identity and other request signals. ## How Anti-Bot Systems Use JA3 to Detect Scrapers Anti-bot services can use TLS handshake characteristics as one detection signal. [Cloudflare](https://scrapfly.io/blog/posts/how-to-bypass-cloudflare-anti-scraping) documents JA3 and JA4 fields in Bot Management, while other systems combine protocol, network, HTTP, and behavioral signals. These systems keep databases of known browser fingerprints and compare each request's JA3 hash against those records. The default Python `requests` library produces a distinctive JA3 hash that anti-bot systems recognize instantly. The same applies to `httpx`, `aiohttp`, Go's `net/http`, and Node.js `axios`. Each library uses its platform's default TLS stack with default settings, creating a fingerprint that no real browser would ever produce. The detection process works in three steps: 1. **Capture**: The anti-bot system intercepts the TLS Client Hello before the encrypted connection starts 2. **Compute**: The system calculates the JA3 hash from the Client Hello fields 3. **Compare**: The system checks the hash against a database of known browser and bot fingerprints The core detection strategy relies on **mismatch analysis**. Your scraper might send a `User-Agent` header claiming to be Chrome 120 on Windows 11. But the JA3 hash reveals that Python's `urllib3` library made the connection. The anti-bot system sees two contradictory signals: - **HTTP layer**: "I'm Chrome 120" - **TLS layer**: "I'm Python urllib3/OpenSSL" Cloudflare exposes JA3 and JA4 fingerprint fields in its bot management system. When a request arrives, it computes the JA3 hash and checks it against a known fingerprint database. A mismatch between the claimed browser identity and the TLS fingerprint can increase the request's bot score and contribute to a block or challenge. DataDome takes a similar approach but adds behavior analysis on top. It compares the JA3 hash against known bot signatures, then combines that signal with request timing, mouse movement, and JavaScript results. TLS fingerprinting can flag a client whose handshake conflicts with its claimed browser identity, while behavioral and JavaScript signals provide additional evidence. Akamai's Bot Manager also uses JA3 fingerprinting in its detection stack. Akamai maintains an updated database of browser fingerprints. The system scores each request based on how closely the TLS fingerprint matches expected browser behavior. This explains why many scrapers get blocked despite perfect headers and valid cookies. The [header configuration](https://scrapfly.io/blog/posts/python-requests-headers-guide) might be flawless, but the TLS handshake happens before any HTTP header is sent. By the time your crafted headers arrive, the anti-bot system has already classified the connection. Even rotating IP addresses and residential proxies won't help if the JA3 fingerprint stays the same. Anti-bot systems track the same hash across different IPs and flag the pattern as bot traffic. A residential IP with a Python `requests` JA3 hash looks more suspicious than a datacenter IP with a Chrome hash. Residential IP reputation does not make a non-browser TLS profile look like a browser. [How to Bypass Anti-Bot Protection When Web ScrapingLearn how anti-bot systems detect scrapers and 5 universal bypass techniques including proxy rotation, fingerprinting, and fortified headless browsers.](https://scrapfly.io/blog/posts/how-to-bypass-anti-bot-protection-when-web-scraping) So if JA3 is such a powerful detection tool, why are security researchers calling JA3 outdated? The answer lies in how modern browsers changed the rules. ## Why JA3 Is No Longer Enough ### TLS Extension Randomization (Chrome 2023+) In January 2023, Google Chrome started randomizing the order of TLS extensions in the Client Hello message. Since JA3 records extensions in the exact order the client sends them, randomizing that order produces a completely different JA3 hash on every connection. The scale of the randomization is huge. A typical Chrome Client Hello contains around 16 extensions that get shuffled. That gives 16 factorial (16!) possible orderings, or over **20 trillion different JA3 hashes** for the same browser. Firefox later followed with similar extension randomization. Before randomization, a single JA3 hash could identify "Chrome 110 on Windows." After randomization, that same browser produces a different hash on each connection. Fastly's network data confirmed the impact. The share of Chrome clients matching the most common JA3 hash dropped to near zero within days. RFC 8446 allows TLS extensions in any order, so randomization doesn't break the protocol. Browser vendors adopted it to stop TLS implementations from depending on a fixed order, which would make future protocol changes harder to deploy. ### Other JA3 Limitations Beyond extension randomization, JA3 has several other weaknesses: - **MD5 hash collisions**: MD5 is a weak hashing algorithm. Two different JA3 full strings can theoretically produce the same hash, though collisions are rare in practice - **Shared library fingerprints**: Multiple applications that use the same TLS library (like OpenSSL) can produce identical JA3 hashes, making the fingerprint less specific than expected - **No QUIC support**: JA3 only works with TLS over TCP. Modern HTTP/3 connections use QUIC, which JA3 can't fingerprint at all Here's the important point for web scrapers. **JA3 is now more dangerous for scrapers than before.** Modern browsers randomize their extensions, but standard HTTP libraries like Python's `requests` and Go's `net/http` don't randomize anything. The JA3 hash from a Python scraper stays the same on every request. With browsers producing trillions of different hashes, a static JA3 fingerprint stands out even more as automated traffic. [How Javascript is Used to Block Web Scrapers? In-Depth GuideIntroduction to how javascript is used to detect web scrapers. What's in javascript fingerprint and how to correctly spoof it for web scraping.](https://scrapfly.io/blog/posts/how-to-avoid-web-scraping-blocking-javascript) JA4 addresses extension-order randomization by normalizing more of the Client Hello before hashing. ## JA3 vs JA4: What’s the Difference? The most important change is how JA4 handles extensions. Instead of recording them in the order sent, JA4 **sorts extension codes by hexadecimal value** before computing the fingerprint. Sorting makes JA4 resistant to extension-order randomization. The same set of extensions always produces the same sorted order, no matter how the client shuffles them. JA4 also introduces several structural improvements over JA3: | Aspect | JA3 | JA4 | |---|---|---| | Extension ordering | Sequential (as sent) | Sorted by hexadecimal value | | Randomization resistant | No | Yes | | Hash algorithm | MD5 | Truncated SHA-256 | | QUIC/HTTP3 support | No | Yes | | ALPN included | No | Yes | | Format | Opaque 32-char hash | Human-readable sections | | Created | 2017 (Salesforce) | 2023 (FoxIO-LLC) | JA4 uses a three-part `a_b_c` format instead of a single opaque hash. The `a` section holds protocol metadata like TLS version and extension count, the `b` section hashes the cipher suites, and the `c` section hashes the sorted extensions. This structure lets analysts search on individual sections. You can match on `a` and `c` while ignoring `b`, which helps when attackers rotate cipher suites but keep the same extensions. Another major addition is **ALPN** (Application Layer Protocol Negotiation) support. JA3 doesn't include ALPN, so JA3 can't tell apart HTTP/1.1 and HTTP/2 connections from the same client. JA4 captures the ALPN value, giving a more complete picture of the client's capabilities. For web scrapers, the JA4 migration means anti-bot systems are getting harder to evade. Cloudflare already supports both JA3 and JA4 fingerprinting. AWS WAF added JA4 support as well. Modern evasion now requires impersonating both JA3 and JA4 fingerprints at once. JA4 also supports **QUIC protocol fingerprinting**. HTTP/3 uses QUIC instead of TCP, and JA3 has no way to fingerprint QUIC connections. As HTTP/3 adoption grows, that matters for both detection and evasion. Anti-bot systems that only use JA3 have a blind spot when connections arrive over HTTP/3, and JA4 closes that gap. One licensing note: FoxIO released the core JA4 client TLS/QUIC fingerprinting under a BSD license. Some extended JA4+ techniques carry commercial licensing requirements. Check the JA3 and JA4 profile your scraper presents before choosing an impersonation method. ## How to Check Your JA3/JA4 Fingerprint Verifying your scraper's TLS fingerprint is the first step toward successful evasion. Several online tools can show you exactly what JA3 and JA4 hash your client produces. The most useful tools for checking TLS fingerprints include: - **Scrapfly JA3/JA4 Fingerprint Tool**: Visit [Scrapfly's JA3/JA4 Fingerprint Checker](https://scrapfly.io/web-scraping-tools/ja3-fingerprint) to check your browser's or scraper's JA3 and JA4 fingerprint. The tool displays both the full string and the hash, making comparison straightforward - **BrowserLeaks TLS test**: A [browser-focused TLS client test](https://browserleaks.com/tls) that shows your fingerprint alongside other browser properties - **abuse.ch SSLBL**: A [database of malicious JA3 fingerprints](https://sslbl.abuse.ch/ja3-fingerprints/) maintained by the security community. Useful for checking whether your scraper's JA3 hash appears in known-bad lists To check what JA3 hash your Python scraper presents, send a request to a fingerprint testing endpoint. Then compare the result against a real browser's fingerprint: python```python import curl_cffi # Check fingerprint WITHOUT impersonation (shows curl_cffi's default TLS profile) r = curl_cffi.get("https://tls.browserleaks.com/json") data = r.json() print(f"JA3 Hash: {data.get('ja3_hash')}") print(f"JA3 Text: {data.get('ja3_text')}") ``` This request reveals the raw TLS fingerprint your client sends. Compare the reported TLS fields with the browser profile you intend to impersonate. Because modern Chrome randomizes extension order, an exact JA3 hash mismatch alone does not prove that a request will be flagged. The verification workflow for testing your scraper's fingerprint follows three steps: 1. **Capture your scraper's fingerprint**: Run the code above to get your JA3 hash 2. **Capture a real browser's fingerprint**: Open the same URL in Chrome or Firefox and note the JA3 hash 3. **Compare the profiles**: Check whether the protocol, cipher, extension, ALPN, and HTTP/2 characteristics are consistent with the claimed browser; do not use one JA3 hash as a binary pass/fail test You can also use Scrapfly's fingerprint tool to see both JA3 and JA4 hashes side by side. The tool breaks down each field in the Client Hello. This breakdown helps identify where your scraper's fingerprint diverges from a real browser. The next step is making the handshake consistent with the intended browser profile. ## Bypassing JA3/JA4 Detection in Web Scraping Standard Python HTTP clients like `requests`, `httpx`, and `aiohttp` produce well-known JA3 fingerprints that anti-bot systems recognize on sight. Bypassing TLS fingerprint detection means changing the handshake itself, not the HTTP headers. Two approaches work here. You can use a TLS impersonation library that mimics browser handshakes, or route requests through a service that handles TLS negotiation for you. ### TLS Fingerprint Impersonation with curl-impersonate [curl-impersonate](https://scrapfly.io/blog/posts/curl-impersonate-scrape-chrome-firefox-tls-http2-fingerprint) is a modified version of curl. The tool rebuilds the TLS stack with Chrome's or Firefox's own TLS libraries. Instead of OpenSSL, which produces a distinctive fingerprint, curl-impersonate uses BoringSSL (Chrome's library) or NSS (Firefox's library). The result is an authentic browser TLS fingerprint. The curl-impersonate project changes more than the TLS fingerprint. It also adjusts HTTP/2 settings like header table size, window size, and stream priority to match real browsers. Anti-bot systems check these HTTP/2 parameters alongside TLS fingerprints, so matching both layers gives stronger evasion. The Python library `curl_cffi` provides a `requests`-like API on top of curl-impersonate. You can switch from Python `requests` to `curl_cffi` with minimal code changes while getting a genuine browser TLS fingerprint. The library supports Chrome, Firefox, Safari, and Edge impersonation profiles. First, install curl\_cffi: bash```bash pip install curl_cffi ``` Then use the `impersonate` parameter to mimic a specific browser: python```python import curl_cffi # Create a session with Chrome browser impersonation session = curl_cffi.requests.Session(impersonate="chrome") # Send a request that looks like Chrome at the TLS level response = session.get("https://web-scraping.dev/products") print(f"Status: {response.status_code}") # Verify the TLS fingerprint matches Chrome fingerprint_check = session.get("https://tls.browserleaks.com/json") print(f"JA3 Hash: {fingerprint_check.json().get('ja3_hash')}") # You can also impersonate specific browser versions response_safari = curl_cffi.get( "https://web-scraping.dev/products", impersonate="safari" ) print(f"Safari impersonation status: {response_safari.status_code}") ``` This code creates a session that impersonates Chrome's TLS fingerprint on every request. The `impersonate` parameter applies the selected browser profile's cipher suites, extensions, TLS options, and HTTP/2 settings to the request. You can pass generic names like `"chrome"` or `"safari"`, or pin a version like `"chrome124"`. Prefer a `Session` object over standalone `curl_cffi.get()` calls. The session keeps connection pooling and cookies across requests, which mimics how a real browser reuses connections. Anti-bot systems track whether clients reuse TLS sessions. Creating a fresh handshake on every request is another signal that can trigger detection. The curl\_cffi library also supports proxies, custom headers, and async requests. You can combine TLS impersonation with [IP rotation](https://scrapfly.io/blog/posts/how-to-avoid-web-scraping-blocking-ip-addresses) for stronger evasion: python```python import curl_cffi session = curl_cffi.requests.Session(impersonate="chrome") # Combine TLS impersonation with proxy rotation proxies = {"https": "http://user:pass@proxy-server:8080"} response = session.get( "https://web-scraping.dev/products", proxies=proxies, ) print(f"Status: {response.status_code}") ``` This code combines Chrome TLS impersonation with a proxy server. The proxy handles IP rotation while curl\_cffi handles TLS fingerprint matching, covering two detection layers at once. ### Automatic TLS Impersonation with Scrapfly Scrapfly #### Scale your web scraping effortlessly Scrapfly handles proxies, browsers, and anti-bot bypass — so you can focus on data. [Try Free →](https://scrapfly.io/register)Scrapfly rotates JA3 and JA4 fingerprints automatically through its Anti-Scraping Protection (ASP) feature. When you turn on ASP, Scrapfly's proxy layer negotiates the handshake on your behalf using authentic browser fingerprints. Those fingerprints rotate across requests, so anti-bot systems can't build a pattern from repeated connections. The main advantage over curl\_cffi is that Scrapfly works with any HTTP client. You don't need to swap out your existing `requests` or `httpx` setup. The proxy layer handles TLS negotiation before your request reaches the target server. Each request can present a different browser fingerprint with no extra configuration. First, install the Scrapfly SDK: bash```bash pip install scrapfly-sdk ``` Then turn on ASP in your scrape configuration: python```python from scrapfly import ScrapeConfig, ScrapflyClient scrapfly = ScrapflyClient(key="YOUR_SCRAPFLY_API_KEY") result = scrapfly.scrape(ScrapeConfig( url="https://web-scraping.dev/products", asp=True, # enables anti-scraping protection with TLS fingerprint rotation country="US", )) print(f"Status: {result.upstream_status_code}") print(f"Content: {result.content[:200]}") ``` This code sends a scrape request through Scrapfly with automatic TLS fingerprint management. The `asp=True` parameter turns on the full anti-bot bypass, including TLS impersonation, header normalization, and challenge solving. Scrapfly detects which anti-bot system protects the target site and adjusts the fingerprint to match. [Bypass Proxy Detection with Browser Fingerprint ImpersonationStop proxy blocks with browser fingerprint impersonation using this guide for Playwright, Selenium, curl-impersonate & Scrapfly](https://scrapfly.io/blog/posts/bypass-proxy-detection-with-browser-fingerprint-impersonation) ## Power Up Your Web Scraping with Scrapfly - [Anti-Scraping Protection bypass](https://scrapfly.io/docs/scrape-api/anti-scraping-protection) - automatically defeats Cloudflare, DataDome, PerimeterX, Akamai, and 90+ other bot systems. - [Smart proxy rotation](https://scrapfly.io/docs/scrape-api/proxy) - residential and datacenter pools with country and ASN level geo-targeting. - [JavaScript rendering](https://scrapfly.io/docs/scrape-api/javascript-rendering) - render SPAs and JavaScript-heavy pages through real cloud browsers. - [Browser automation scenarios](https://scrapfly.io/docs/scrape-api/javascript-scenario) - scroll, click, fill forms, and wait for elements without managing a browser fleet. - [Format conversion](https://scrapfly.io/docs/scrape-api/getting-started#api_param_format) - return pages as HTML, JSON, clean text, or LLM ready Markdown. - [Session management](https://scrapfly.io/docs/scrape-api/session) - keep cookies, headers, and IPs consistent across multi step flows. - [Smart caching](https://scrapfly.io/docs/scrape-api/getting-started#api_param_cache) - cache successful responses to cut cost on repeat scraping jobs. - [Python](https://scrapfly.io/docs/sdk/python), [TypeScript](https://scrapfly.io/docs/sdk/typescript), [Scrapy](https://scrapfly.io/docs/sdk/scrapy), and [no-code integrations](https://scrapfly.io/docs/integration/getting-started) including [Make](https://scrapfly.io/integration/make), [n8n](https://scrapfly.io/integration/n8n), [Zapier](https://scrapfly.io/integration/zapier), [LangChain](https://scrapfly.io/integration/langchain), and [LlamaIndex](https://scrapfly.io/integration/llamaindex). TLS impersonation is one signal Scrapfly manages for you, alongside proxies, headers, and browser fingerprints, so your scraper stays focused on data instead of evasion. ### Web Scraping API Scrape any website with our powerful API. Anti-bot bypass, JavaScript rendering, and rotating proxies built-in. [Try Web Scraping API](https://scrapfly.io/docs/scrape-api/getting-started) ## FAQ What is a JA3 hash?A JA3 hash is a 32-character MD5 fingerprint built from five TLS Client Hello fields. Anti-bot systems use it to identify which software made a connection. How is JA3 calculated?JA3 concatenates five Client Hello fields in order, using commas between fields and hyphens between values. The resulting string is then hashed with MD5 to produce the 32-character fingerprint. Is JA3 the same as TLS fingerprinting?No. TLS fingerprinting is the general technique of identifying clients from their TLS handshake, and JA3 is the most popular specific method for doing it. Other methods include JA4, CYU, and JARM. What is the difference between JA3 and JA4?JA4 sorts TLS extension codes by hexadecimal value before hashing, which makes the fingerprint resistant to extension-order randomization. It also uses truncated SHA-256 instead of MD5 and supports QUIC/HTTP3. Is scraping with TLS fingerprint evasion legal?Collecting public data is generally legal, but matching a browser's TLS fingerprint does not widen what you may scrape. Always check a site's terms of service and avoid personal or copyrighted data. ## Summary JA3 and JA4 fingerprinting operate at the TLS layer, below HTTP headers, cookies, and JavaScript. Anti-bot systems check this layer on every request, so it matters for reliable web scraping. Matching User-Agent headers means nothing if your TLS fingerprint reveals a Python client instead of Chrome. JA3 created the foundation for TLS-based detection, but Chrome's extension randomization in 2023 exposed its limitations. JA4 addressed those gaps with sorted extensions, stronger hashing, and QUIC support. Anti-bot systems now deploy both JA3 and JA4, making evasion more demanding than ever. Start by checking your scraper's current fingerprint with Scrapfly's JA3/JA4 tool. For production scraping, use curl\_cffi for direct TLS impersonation. Or use Scrapfly's API for automatic fingerprint rotation with full anti-bot bypass support. Legal Disclaimer and PrecautionsThis tutorial covers popular web scraping techniques for education. Interacting with public servers requires diligence and respect: - Do not scrape at rates that could damage the website. - Do not scrape data that's not available publicly. - Do not store PII of EU citizens protected by GDPR. - Do not repurpose *entire* public datasets which can be illegal in some countries. Scrapfly does not offer legal advice but these are good general rules to follow. For more you should consult a lawyer. [ Add as a preferred source ](https://google.com/preferences/source?q=scrapfly.io) Table of Contents Table of Contents- [Key Takeaways](#key-takeaways) - [What Is TLS Fingerprinting?](#what-is-tls-fingerprinting) - [How JA3 Fingerprinting Works](#how-ja3-fingerprinting-works) - [JA3 Field Order and Hash Calculation](#ja3-field-order-and-hash-calculation) - [JA3S: Server-Side Fingerprinting](#ja3s-server-side-fingerprinting) - [How Anti-Bot Systems Use JA3 to Detect Scrapers](#how-anti-bot-systems-use-ja3-to-detect-scrapers) - [Why JA3 Is No Longer Enough](#why-ja3-is-no-longer-enough) - [TLS Extension Randomization (Chrome 2023+)](#tls-extension-randomization-chrome-2023) - [Other JA3 Limitations](#other-ja3-limitations) - [JA3 vs JA4: What’s the Difference?](#ja3-vs-ja4-what-s-the-difference) - [How to Check Your JA3/JA4 Fingerprint](#how-to-check-your-ja3-ja4-fingerprint) - [Bypassing JA3/JA4 Detection in Web Scraping](#bypassing-ja3-ja4-detection-in-web-scraping) - [TLS Fingerprint Impersonation with curl-impersonate](#tls-fingerprint-impersonation-with-curl-impersonate) - [Automatic TLS Impersonation with Scrapfly](#automatic-tls-impersonation-with-scrapfly) - [Power Up Your Web Scraping with Scrapfly](#power-up-your-web-scraping-with-scrapfly) - [FAQ](#faq) - [Summary](#summary) Join the Newsletter Get monthly web scraping insights Scale Your Web Scraping Anti-bot bypass, browser rendering, and rotating proxies, all in one API. Start with 1,000 free credits. No credit card required 1,000 free API credits Anti-bot bypass included [Start Free](https://scrapfly.io/register) [View Docs](https://scrapfly.io/docs/onboarding) Not ready? Get our newsletter instead. ## Related Articles [ curl ### How to Use cURL GET Requests Here's everything you need to know about cURL GET requests and some common pitfalls you should avoid. ](https://scrapfly.io/blog/posts/how-to-use-curl-get-requests) [ blocking ### What is CreepJS Browser Fingerprint and How to Bypass It In this article, we will explore the inner workings of CreepJS, one of the prominent browser fingerprinting tools and ho... ](https://scrapfly.io/blog/posts/browser-fingerprinting-with-creepjs) [ http tools ### How to Use cURL For Web Scraping In this article, we'll go over a step-by-step guide on sending and configuring HTTP requests with cURL. We'll also explo... ](https://scrapfly.io/blog/posts/how-to-use-curl-for-web-scraping) Scale your web scraping effortlessly, **1,000 free credits** [Start Free](https://scrapfly.io/register)