JA4 fingerprint checker

t13d1517h2_8daaf6152771_cb7bf5808d99 reads as: t TCP, 13 TLS 1.3, d a domain name in the handshake, 15 cipher suites, 17 extensions, h2 HTTP/2 offered first; then 8daaf6152771, the hash of the sorted cipher suites, and cb7bf5808d99, the hash of the sorted extensions and signature algorithms. The prefix t13d1517h2 alone already separates Chrome from most HTTP libraries.

The 17 extensions, in numeric order (Chrome also adds two GREASE entries and shuffles the rest on every connection). Key-share groups are X25519MLKEM768 (post-quantum, first), X25519, P-256 and P-384; the certificate compression is brotli; its sorted JA3 (JA3N) is bd4930bd9b000ee684830e44bab76fdf.

Microsoft Edge 153 and Brave 154 on Windows leave out one of them, trust anchors (0xca34), so their JA4 reads t13d1516h2. Chrome for Testing, the build made for automation, adds one (0x12e0) unless it is started with --disable-field-trial-config: Playwright passes that flag by default (checked in 1.62), Puppeteer's default arguments do not include it (checked in 25.12).

Every row was measured against two independent TLS echo services and repeated; library rows depend on the library version and the TLS library underneath (OpenSSL 3.0.2 here), so a different version may send something else.

A client that speaks HTTP/2 opens the connection with settings of its own choosing, and the common format (Akamai's) writes them as four parts separated by |: the SETTINGS values in the order sent, the WINDOW_UPDATE increment, the priority information, and the order of the pseudo-headers. Chrome's is 1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p; curl and Go send different settings, window sizes and header orders (table above).

Services disagree about the third part: some record only separate PRIORITY frames (0 for Chrome), ours also records the priority Chrome sends inside its first HEADERS frame (1:1:0:256). The checker above compares the other three parts, which every service reads the same way.

A server sees the handshake before it sees a single header, and it cannot be changed from inside a page or by an HTTP header. So the question it answers is not who you are but what software is talking: a request that claims to be Chrome in its User-Agent and opens with a Python or Node handshake says two different things at once. Browsers built on Chromium's own network stack send Chrome's handshake because it is Chrome's code, which is the approach Clearcote takes (how).