TLS JA3/JARM: the fingerprint your VPN can't hide

The short version

Every secure website connection starts with a silent handshake. The very first message your device sends — before any page loads — has a recognizable style, and software can turn that style into a fingerprint called JA3 (and related ones like JARM). The surprising part: a VPN or proxy does not hide this fingerprint, because it comes from the program making the connection, not from where the traffic travels. This is more of a "know what it is" topic than a quick fix — and that's fine.

What's actually happening

Picture two people walking into a shop and saying hello. They speak the same language, but each has a slightly different accent, phrasing, and set of polite openers. If you heard only that greeting, you could often guess which app or device was "speaking."

When your browser connects to a secure site, it opens with a technical greeting (the TLS "Client Hello") that lists which encryption methods and options it supports, in a particular order. Different browsers, apps, and programming libraries all phrase that greeting differently. JA3 is simply a way to boil that greeting down to a short code. JARM is the same idea aimed at servers.

Why it matters to you

• It identifies your software (which browser or app), not your name — but it can flag you as "not a normal browser."
• A VPN hides your location and IP address, but the greeting is sent inside the VPN tunnel by your app, so the fingerprint survives.
• Unusual tools — some privacy scripts, bots, or custom apps — produce rare greetings that stand out, which is the opposite of blending in.

How to fix it

Here's the honest truth: as a normal user, you don't hand-tune your TLS handshake, and you shouldn't try. The goal is to blend in with the huge crowd of ordinary browsers. The practical steps:

Use a mainstream browser at its defaults

1. Chrome, Edge, Firefox, and Safari each produce a common greeting shared by millions of people. That's exactly what you want — your fingerprint looks like everyone else's.
2. Keep the browser updated. Current versions are the most common, so you sit in the biggest crowd.
3. Recent Chrome even shuffles part of its greeting on every connection, which makes the old JA3 code unreliable for singling out Chrome users.

Be careful with "privacy" tools

1. Some standalone proxy apps, scraping tools, or scripts speak with a library's greeting (not a browser's). That's rarer and more noticeable. If privacy is the goal, a mainstream browser beats an obscure tool here.
2. A VPN is still worth using for hiding your IP and location — just don't expect it to change this particular fingerprint.

If you want the strongest option

1. Tor Browser aims to make all its users look identical, including at this low level. If TLS fingerprinting is your main worry, that's the most uniform choice — at the cost of speed.

How to check it worked

This is a network-level fingerprint, so you can't see it in your browser's menus. This site's test (and tools like one that reports your JA3) will show whether your greeting matches a common browser or looks unusual. A result that matches a mainstream, up-to-date browser is a good outcome — you're in the crowd.

If your result was already good

If you scored an A or B, you're already using a normal, current browser whose handshake blends in — which is the right answer. There's nothing to install or tweak. Just keep your browser updated so you stay in the largest, most common group.

Want to go further?

The Advanced version explains what JA3, JA4, and JARM actually hash, why they sit below the VPN layer, how browser GREASE/extension-shuffling broke JA3, and the honest limits of trying to change your TLS fingerprint.

What JA3, JA4, and JARM actually are

These are TLS fingerprints derived from the handshake, not from HTTP, cookies, or JavaScript. When a client opens a TLS connection it sends a ClientHello advertising its TLS version, cipher suites, extensions, supported elliptic curves (groups), and EC point formats. JA3 (Salesforce, 2017) concatenates selected fields in order and MD5-hashes them into a 32-char client fingerprint. JA4 (FoxIO, 2023) is the successor: it sorts ciphers/extensions before hashing and emits a human-readable prefix plus two truncated SHA-256 segments, fixing JA3's order sensitivity. JARM (Salesforce) is the server-side analog: it actively sends ten crafted ClientHellos and hashes the pattern of ServerHello responses to fingerprint server TLS stacks.

Why a VPN or proxy can't hide it

A VPN encrypts and re-routes your IP packets, and a forward proxy relays them — but the TLS ClientHello to the destination is still generated by your client application (the browser) and travels end-to-end to the server (or to a TLS-terminating proxy that then makes its own connection). The JA3/JA4 value reflects the TLS library and its configuration, which the network path doesn't alter. So JA3 is orthogonal to IP-based anonymity: it can link "the same software" across different IPs/VPN exits. The only way to change it is to change what speaks TLS, or how it's configured.

Why JA3 degraded (and what replaced it)

• GREASE (RFC 8701) injects random dummy values into ClientHello; JA3 implementations must strip them or the hash becomes noisy.
• Chromium began randomizing TLS extension order (around Chrome 110, 2023). Because JA3 is order-sensitive, Chrome now yields a different JA3 on nearly every connection, making JA3 nearly useless for identifying Chrome. This is a privacy win by default.
• JA4 responds by sorting before hashing, restoring a stable value — so it re-identifies the browser family/version despite shuffling. The arms race continues: pre-shared keys and ephemeral extensions can still make even JA4 vary (e.g., observed with Safari), prompting proposals like ignoring ephemeral extensions or a future "JA5."

What it reveals — and doesn't

A TLS fingerprint identifies the TLS stack: browser engine and version, OS crypto library, or a scripting library (OpenSSL, BoringSSL, Go crypto/tls, Python). It is not a per-person identifier — many people sharing a browser version share a hash, and one hash can appear across unrelated clients using the same library. Its security uses are bot/malware detection and distinguishing "real browser" from "automation." For a user, the privacy-relevant facts are: (1) it survives VPNs, and (2) rare stacks stand out.

What actually helps

1. Use a mainstream, current browser at defaults. Chrome/Edge (BoringSSL), Firefox (NSS), and Safari (Secure Transport/BoringSSL) each produce a high-population fingerprint. Updates keep you in the largest cohort; outdated versions shrink your crowd.
2. Chrome's extension shuffling already defeats stable JA3 for Chrome users — nothing to configure.
3. Avoid custom TLS clients for browsing privacy. Tools built on libraries like utls can mimic a browser's ClientHello (and are used precisely to blend in), but a misconfigured or outdated mimic is more detectable than a real browser. For ordinary users this is not a maintainable strategy.
4. Tor Browser aims for uniformity across its users at this layer too; it's the strongest blend-in option, with the usual latency/compat costs.
5. VPN is still useful for IP/location privacy and against network-level observers — just not for changing JA3/JA4.

Verify properly

• Use a service that echoes your JA3/JA4 (e.g., tls.browserleaks.com / browserleaks.com/tls) plus this site's test; these read the ClientHello server-side.
• Confirm your hash maps to your actual browser/version and isn't a library signature. For Chrome, expect JA3 instability (shuffling) but a consistent JA4.
• Test through your VPN to confirm the fingerprint is unchanged versus without it — demonstrating the layer independence.

Trade-offs & gotchas

• You cannot meaningfully "fix" this from browser settings — there's no UI for cipher/extension ordering, by design. Blending in is the whole strategy.
• Rare TLS stacks are a liability: niche privacy browsers, forks, or scripts can produce uncommon handshakes that single you out even behind a VPN.
• Mimicry is brittle: utls-style impersonation must track the target browser's exact ClientHello across versions; drift makes it detectable.
• JARM is about servers, not your browser — relevant to operators and researchers, not to personal browsing privacy.
• Everything here is software and configuration; no hardware changes your TLS fingerprint.