Glossary

TLS fingerprint

An identifier computed from the way a client opens a TLS connection — the cipher suites, extensions and their order in the ClientHello.

Also called: JA3, JA4.

Before any HTTP request exists, a client opens a TLS connection by sending a ClientHello: the protocol versions it supports, the cipher suites it offers, the extensions it advertises, the elliptic curves it accepts, and — importantly — the order it lists them in. Different TLS libraries make different choices there, so hashing that structure produces a fingerprint of the software doing the connecting. JA3 and its successor JA4 are the common formats. It is collected at the network edge, below the browser, which is why nothing running in a page can change or observe it.

Its practical use is catching clients that claim to be something they are not: a script using a generic HTTP library while sending a Chrome user-agent has a TLS fingerprint that no Chrome has ever produced, and the mismatch is decisive. Argus does not alter the TLS fingerprint and does not claim to — it ships a real Chromium build, so the handshake is a genuine Chromium handshake matching the browser it says it is. That is the point rather than a gap, and it is a large part of why collection from a real browser survives where a headless client does not, as the scraping page describes.