Browse All TLS Extensions

padding

TLS Extension Code: 21

Extension Details

Extension Name
padding
Extension Code (Decimal)
21
Extension Code (Hex)
0x0015
RFC Reference
RFC 7685

What is padding?

The Padding extension allows clients to pad the Client Hello message to a desired size. This is used to mitigate certain attacks related to traffic analysis and length-based fingerprinting. By padding messages to common sizes (e.g., 512 bytes, 1024 bytes), clients can obscure the exact size of the Client Hello, making it harder for attackers to fingerprint the client based on message length. The padding consists of zero-valued bytes and does not affect security. Defined in RFC 7685. Note that padding is excluded from JA3 fingerprints.

Role in JA3 Fingerprinting

How This Extension Affects Fingerprinting

The padding extension is part of the TLS Client Hello packet that JA3 analyzes to create a unique fingerprint of your browser or HTTP client.

JA3 Construction: JA3 concatenates TLS parameters including extensions in a specific format:
TLS_VERSION,CIPHERS,EXTENSIONS,CURVES,POINT_FORMATS

Different browsers and HTTP clients support different sets of TLS extensions, making this a key differentiator in fingerprinting. The presence, absence, or order of extensions like padding can reveal:

  • Browser type and version (Chrome, Firefox, Safari, Edge)
  • Operating system (Windows, macOS, Linux, Android, iOS)
  • HTTP library (curl, Python requests, Go http.Client, Node.js)
  • Bot detection - automated tools often have distinctive extension sets

Test Your TLS Configuration

See if your browser or HTTP client includes the padding extension in its TLS handshake:

Test Your JA3 Fingerprint

The JA3 tool will show all TLS extensions your client advertises, including padding.

Browser & Client Support

Modern Browser Support:

  • Chrome/Edge: Full support for padding
  • Firefox: Full support for padding
  • Safari: Full support for padding

HTTP Client Libraries:

  • curl: Support varies by OpenSSL/LibreSSL version
  • Python requests: Limited TLS extension control
  • curl_cffi: Can mimic browser TLS configurations
  • Scrapfly API: Automatically matches real browser TLS fingerprints

Related TLS Resources

TLS Extensions
Testing Tools

Technical References