b26ce05bbdd6

What this hash is

A full JA4 string has three parts: the human-readable JA4_a prefix, then two twelve-character truncated SHA-256 digests - JA4_b over the sorted cipher-suite list and JA4_c over the sorted extension list. b26ce05bbdd6 is theextension hash (JA4_c) piece, so on its own it names one dimension of the handshake: whichextensions the TLS library sends, not the whole ClientHello.

Extension sets shift with connection mode - a fresh handshake, a resumed session offering a pre-shared key, or a QUIC connection each produce a different JA4_c from the same client - so one engine typically spawns a small family of full fingerprints that share everything but this hash.Threat feeds and SIEM logs often quote a component hash alone; matching it against full fingerprints is how you get back to a named client.

Fingerprints that share it

Every fingerprint in Foil's reference database that carries b26ce05bbdd6:

Paste any of them - or a fingerprint of your own - into the decoder above, or start from the full JA4 database. For how the hashes are built and why they matter for bot detection, see TLS fingerprinting.