JA4 fingerprint
t13i181000_85036bcba153_d41ae481755e
Python - a non-browser HTTP client.
TCP · TLS 1.3, no SNI (IP), 18 cipher suites, 10 extensions, none offered ALPN.
Anatomy
85036bcba153 is a SHA-256 of the sorted cipher list · d41ae481755e covers the extensions and signature algorithms. Hashes aren't reversible - the identity below comes from matching them.
Identity
from FoxIO ja4dbPython is the published identity for this exact fingerprint in FoxIO's ja4db - a known mapping, not a guess.
Python’s TLS via OpenSSL (the ssl module, requests, urllib3, httpx). A non-browser client - a Python JA4 behind a browser User-Agent is an immediate contradiction. This variant connects without SNI (to a bare IP); otherwise identical.
Get hundreds of insights
connection_fingerprint: {ja4: {hash: "t13i181000_85036bcba153_d41ae481755e",family: "python",},user_agent_alignment: "?", // needs a live requesth2_fingerprint: "?", // needs a live request}
A JA4 is one clue. Foil checks hundreds more - the network, the device, and how the session behaves - and tells you when they don't add up. That's usually where the bots are.
See it on a real session - free →What to do
ChallengeA non-browser HTTP library is expected on APIs and server-to-server traffic - allow it there, but authenticate it (API keys or mTLS) and rate-limit per credential.
On human-facing flows - login, signup, checkout, password reset, coupon redemption - a library JA4 behind a browser User-Agent is one of the cheapest high-confidence automation tells: block or challenge it, and rate-limit by IP/ASN to blunt credential-stuffing and scraping. Caveat: impersonation tools like curl-impersonate and tls-client can forge a browser JA4, so use the library fingerprint to flag traffic, not to clear it.
About this fingerprint
Python’s TLS via OpenSSL (the ssl module, requests, urllib3, httpx). A non-browser client - a Python JA4 behind a browser User-Agent is an immediate contradiction. This variant connects without SNI (to a bare IP); otherwise identical.
The breakdown above is computed from the string itself: the readable JA4_aprefix gives the transport, TLS version, SNI flag, cipher and extension counts, and ALPN, while the two hashes are matched against Foil's reference database to name the client. For the full background, see TLS fingerprinting, or try any fingerprint of your own in the JA4 database.
Both component hashes can be looked up on their own: cipher hash 85036bcba153 lists every fingerprint built on this cipher stack, and extension hash d41ae481755e lists the variants that share this extension set.
Frequently asked
JA4 is a fingerprint of the TLS ClientHello a client sends before any HTTP. It is a three-part string, JA4_a_JA4_b_JA4_c: a readable prefix (transport, TLS version, SNI, cipher and extension counts, ALPN) followed by two truncated SHA-256 hashes over the sorted cipher and extension lists. Unlike JA3, it survives Chrome's extension-order randomization.
The JA4_a prefix decodes by eye: the first character is the transport, the next two are the TLS version, then SNI, a two-digit cipher count, a two-digit extension count, and the first ALPN value. The two hashes are not reversible; you identify them by matching against a database or by decoding the raw (JA4_r) variant.
A JA3 fingerprint is an MD5 hash of the handshake, so the hash itself carries no readable structure. Only the raw JA3 string (version, ciphers, extensions, curves, point formats) can be decoded back into its components.
Yes. Fingerprints are matched against a distilled reference database of common browsers, HTTP libraries, and automation tools. The match tells you what a client is; identifying whether it is lying about that requires cross-checking against the User-Agent, HTTP/2 fingerprint, and JavaScript environment in a live request.