TLS fingerprint

When a browser or a script opens a site over HTTPS, the first step is the TLS handshake. The client's first message is called ClientHello, and it is sent in the clear. In it the program lists what it supports: TLS versions, cipher suites, extensions and their order, supported curves and protocols.

Every library builds its ClientHello in its own way. Chrome, Firefox and Safari each have typical sets, and libraries used in Python, Go or Node.js scripts have theirs. So from these parameters a site can tell which kind of program is connecting, without even looking at the headers.

To make fingerprints easy to compare, they are turned into a short string. The most widely known methods are JA3 and the newer JA4. JA3 takes the version, ciphers, extensions and curves and computes a hash from them. JA4 also takes the protocol into account and sorts the lists, because some browsers shuffle the order of extensions on every connection.

A proxy does not change the TLS fingerprint. For HTTPS, your program sends the proxy a CONNECT command, and after that the proxy only relays encrypted bytes between you and the site. The TLS handshake happens directly between your program and the site, and the proxy sees at most the site name from the SNI field.

This is why a script and a real browser look different to a site even when they share the same IP and the same User-Agent. If the header says "Chrome" while the ClientHello is typical of a Python library, the site sees the mismatch. The same goes for headless browsers: their TLS fingerprint is usually close to a regular browser, but other signals may differ.

Sites find the TLS fingerprint useful because it is hard to change by accident. It depends on the library version and its settings, not on which page you open or which network you connect from. When a browser updates, its fingerprint may change slightly too, so sites usually compare it against known values for current versions. Some services let you view your own fingerprint and compare how different programs look.

The TLS fingerprint is just one part of the wider browser fingerprint. Sites combine it with other data and decide for themselves how to react. A proxy is responsible for the IP address, while the connection parameters depend on the program you use.