A JA4 fingerprint has three parts, for example t13d1517h2_8daaf6152771_cb7bf5808d99 for a Chrome TCP connection: a readable prefix (t for TCP or q for QUIC, TLS version, d if SNI is a domain, number of cipher suites and extensions, first ALPN), a truncated SHA-256 of the sorted cipher suites, and a truncated SHA-256 of the sorted extensions (without SNI and ALPN) followed by the signature algorithms in order. GREASE values are ignored.
It replaced JA3 (Salesforce, 2017), which hashed extensions in wire order and stopped being stable when Chrome began shuffling extension order in early 2023. JA4 is used for bot detection, malware hunting and traffic analytics; it identifies software, not users, and anyone can imitate a fingerprint with libraries such as uTLS. JA4 itself is BSD 3-Clause licensed; the other JA4+ methods (JA4S, JA4H, JA4X and more) use the FoxIO License 1.1, which restricts commercial use.