Thumbprint — JA4, JA4H, HTTP/2, QUIC and TCP Fingerprint Test

Your fingerprints

These are the fingerprints your client presented on this connection, as computed at the edge before your request reached this application. Expand a value to see its decomposed attributes. Empty rows mean the signal does not exist on this connection type — HTTP/3 has no TCP SYN or HTTP/2 frame fingerprint, and vice versa.

Transporttcp (HTTP/2)<br>NetworkAS13335 Cloudflare, Inc. · United States (US) · CDN: cloudflare<br>stats →<br>country →

TCP SYN (p0f)

4:55+9:0:1460:65535,13:mss,sok,ts,nop,ws:df,id+:0

IP version4Initial TTL55+9Options length0MSS1460Window size65535Window scale13Options layoutmss,sok,ts,nop,wsQuirksdf,id+Payload class0

stats →

TCP SYN (JA4T)

65535_2-4-8-1-3_1460_13

TCP window65535Option kinds2-4-8-1-3MSS1460Window scale13

stats →

QUIC transport params

not available on this connection

TLS ClientHello (JA4)

t13d1312h2_a44d0ee8b3cc_e381dae6da6b

Protocolt (TLS over TCP)TLS version13 (TLS 1.3)SNId (domain)Cipher count13Extension count12ALPNh2Ciphers000a, 002f, 0035, 009c, 009d, 1301, 1302, 1303, c013, c02b, c02c, c02f, c030Extensions000a, 000b, 000d, 0015, 0017, 0023, 002b, 002d, 0033, ff01Signature algorithms0904, 0403, 0804, 0401, 0503, 0805, 0501, 0806, 0601, 0201, 0603

stats →

TLS ClientHello (JA4_o)

t13d1312h2_11a1eeccea26_d699d1290f9d

Variantoriginal ordering — cipher and extension hashes computed over the lists as sent, not sortedStabilityclients that randomize ClientHello ordering (e.g. Chrome) change this value per connection, so it is shown for context but not tracked as a population key

HTTP/2 frames (Akamai)

2:0;3:1;4:8388608;5:65536|8323073|0|m,s,a,p

SETTINGS 2 (ENABLE_PUSH)0SETTINGS 3 (MAX_CONCURRENT_STREAMS)1SETTINGS 4 (INITIAL_WINDOW_SIZE)8388608SETTINGS 5 (MAX_FRAME_SIZE)65536WINDOW_UPDATE8323073PRIORITY frames0Pseudo-header orderm (:method), s (:scheme), a (:authority), p (:path)

stats →

HTTP request (JA4H)

ge20nn070000_1c05be67a921_000000000000_000000000000

Methodge (GET)HTTP version20 (HTTP/2)CookienoReferernoHeader count7Accept-Language0000 (none)Header orderx-forwarded-for, cf-ray, user-agent, cf-worker, cf-visitor, x-forwarded-proto, accept-encodingHeader-order hash1c05be67a921

stats →

User-Agent

Mozilla/5.0 (compatible; HackerNewsAggregator/1.0)

Browser / clientHackerNewsAggregator 1.0Noteinferred from the self-declared string — a claim, not a measurement; compare with the wire fingerprints above

stats →

Test from the command line<br>Any client that connects is fingerprinted at the edge — check what yours presents with:

curl -s https://thumbprint.me/api/v1/probe | jq

auto<br>http3

Returns your full stack as JSON (the jq is optional). Each request is also a contribution: it is recorded as one deduplicated observation, the same as a page view.

Cross-transport view

Your browser is now probing this site over each configured origin (TCP/TLS and QUIC where supported) with a shared one-time correlation id, so the observatory can associate the same client's stacks across transports.

JavaScript disabled — passive view above still works.

Explore the population

TLS ClientHello fingerprints (JA4, over TCP and QUIC)

TCP SYN signatures (p0f)

TCP SYN fingerprints (JA4T)

QUIC transport-parameter fingerprints

HTTP/2 frame fingerprints (Akamai-style)

HTTP request fingerprints (JA4H)

User-Agent strings

Origin countries

Origin networks (ASN)