95e1cefdbe28

What this hash is

A full JA4 string has three parts: the human-readable JA4_a prefix, then two twelve-character truncated SHA-256 digests - JA4_b over the sorted cipher-suite list and JA4_c over the sorted extension list. 95e1cefdbe28 is thecipher-suite hash (JA4_b) piece, so on its own it names one dimension of the handshake: whichcipher suites the TLS library offers, not the whole ClientHello.

That makes it the stable core of the fingerprint. A TLS engine's cipher stack barely changes across versions or across products embedding the same engine, which is why one cipher hash can cover browsers, their headless builds, and everything else compiled against that stack - while the extension hash around it shifts with session resumption, QUIC, and per-build extension sets.Threat feeds and SIEM logs often quote a component hash alone; matching it against full fingerprints is how you get back to a named client.

Fingerprints that share it

Every fingerprint in Foil's reference database whose cipher-suite hash is 95e1cefdbe28:

Paste any of them - or a fingerprint of your own - into the decoder above, or start from the full JA4 database. For how the hashes are built and why they matter for bot detection, see TLS fingerprinting.