A JA3 fingerprint is a short hash of the fields a client sends in its TLS handshake, such as cipher suites, extensions and their order, that identifies the software making the connection regardless of its IP address or headers. Anti-bot systems use JA3, and its successor JA4, to flag traffic whose TLS fingerprint doesn't match what its User-Agent claims, such as a request claiming to be Chrome but carrying the JA3 hash of a Python HTTP library.

JA3 was developed by researchers at Salesforce in 2017. It combines five fields from the TLS ClientHello message (the TLS version, accepted cipher suites, list of extensions, supported elliptic curves, and elliptic curve point formats) and hashes the result with MD5 into a 32-character fingerprint. A companion method, JA3S, does the same for the server's response.

JA3's weakness is that a change to any field it hashes, including the order of extensions, produces an entirely different hash. When Chrome began shuffling the order of its TLS extensions in early 2023, the same browser started producing different JA3 values from one connection to the next. JA4, published by FoxIO in September 2023, sorts the extensions before hashing, which makes it resistant to that randomization, and providers such as Cloudflare now use JA4 fingerprints in their bot detection.