TLS, HTTP/3, JA3 and JA4

Load ipthing.net over HTTPS to see the handshake this server negotiated with your client: TLS version, cipher suite, ALPN, key exchange, and JA3/JA4 fingerprints from the ClientHello.

How do I see my JA3 or JA4 fingerprint?

• TLS version and cipher suite
• Negotiated protocol (for example h2 or h3)
• Whether the TLS session was resumed
• Key-exchange curve when known (for example X25519)
• JA3 and JA4 hashes of the ClientHello

Plain HTTP has no TLS rows. curl over HTTPS includes the same fields in JSON.

What is a JA4 fingerprint?

JA3 (older) and JA4 (current) summarise how a TLS library builds its ClientHello. Browsers that share a stack share a hash; so do many copies of curl. They are useful to tell “browser-like” from “script-like” traffic. They do not identify a person. Aggregate JA3/JA4 frequencies are on stats.ipthing.net without joining hashes back to individual IPs.

Does IPThing support HTTP/3?

HTTPS serves HTTP/1.1 and HTTP/2 on TCP 443. HTTP/3 (QUIC) listens on UDP 443 and is advertised with Alt-Svc. If UDP/443 is blocked on the path, you will still get HTTP/2. The Protocol field on the live page is what was actually used.

Related: request headers your client sent alongside the handshake, and IPv6 vs IPv4 for the peer address family on the same connection.