JA4 fingerprint
t13d1617h2_86a278354501_e6dcd7ae0a9e
Firefox - a legitimate web browser.
TCP · TLS 1.3, domain present, 16 cipher suites, 17 extensions, HTTP/2 ALPN.
Anatomy
86a278354501 is a SHA-256 of the sorted cipher list · e6dcd7ae0a9e covers the extensions and signature algorithms. Hashes aren't reversible - the identity below comes from matching them.
Identity
from reference DBThis exact JA4 string is in our reference database, so it's a confident, byte-for-byte match for Firefox.
Get hundreds of insights
connection_fingerprint: {ja4: {hash: "t13d1617h2_86a278354501_e6dcd7ae0a9e",family: "firefox",},user_agent_alignment: "?", // needs a live requesth2_fingerprint: "?", // needs a live request}
A JA4 is one clue. Foil checks hundreds more - the network, the device, and how the session behaves - and tells you when they don't add up. That's usually where the bots are.
See it on a real session - free →What to do
VerifyThis handshake is shared by every real browser on the engine - and by headless Chrome, anti-detect browsers, and automation frameworks built on it. A JA4 match here is necessary but never sufficient, so don’t grant trust on it alone.
Confirm the JA4 family agrees with the declared User-Agent and the HTTP/2 (Akamai) fingerprint, and that a genuine JavaScript environment is present - canvas, WebGL, fonts, real input events. If the UA and JA4 disagree, or a “browser” session has no JS environment, treat it as automation and step up (challenge, MFA, or block) - especially when the same JA4 arrives at scale from datacenter or residential-proxy IPs.
About this fingerprint
This is the JA4 TLS fingerprint of Firefox, a mainstream web browser. Every up-to-date Firefox on the same platform presents essentially this same handshake, which is exactly why a session that claims to be Firefox but presents a different JA4 is worth a second look.
This entry is production-verified: Foil has observed this exact fingerprint across multiple customer networks with consistent client-hint corroboration, and catalogued it in the product's reference tier - it isn't in the public database export at all.
The breakdown above is computed from the string itself: the readable JA4_aprefix gives the transport, TLS version, SNI flag, cipher and extension counts, and ALPN, while the two hashes are matched against Foil's reference database to name the client. For the full background, see TLS fingerprinting, or try any fingerprint of your own in the JA4 database.
Both component hashes can be looked up on their own: cipher hash 86a278354501 lists every fingerprint built on this cipher stack, and extension hash e6dcd7ae0a9e lists the variants that share this extension set.
A matching JA4 does not prove a real user, though: a headless bot driving actual Firefoxpresents exactly this handshake, because the TLS stack is the same. The tells live one layer up, in how the browser is being driven - seeCDP detection,headless browser detection, anddevice fingerprinting in JavaScript.
Frequently asked
JA4 is a fingerprint of the TLS ClientHello a client sends before any HTTP. It is a three-part string, JA4_a_JA4_b_JA4_c: a readable prefix (transport, TLS version, SNI, cipher and extension counts, ALPN) followed by two truncated SHA-256 hashes over the sorted cipher and extension lists. Unlike JA3, it survives Chrome's extension-order randomization.
The JA4_a prefix decodes by eye: the first character is the transport, the next two are the TLS version, then SNI, a two-digit cipher count, a two-digit extension count, and the first ALPN value. The two hashes are not reversible; you identify them by matching against a database or by decoding the raw (JA4_r) variant.
A JA3 fingerprint is an MD5 hash of the handshake, so the hash itself carries no readable structure. Only the raw JA3 string (version, ciphers, extensions, curves, point formats) can be decoded back into its components.
Yes. Fingerprints are matched against a distilled reference database of common browsers, HTTP libraries, and automation tools. The match tells you what a client is; identifying whether it is lying about that requires cross-checking against the User-Agent, HTTP/2 fingerprint, and JavaScript environment in a live request.