A Playwright script drives a real browser, so it is natural to assume the target site can’t tell it from a person. That assumption is where most confusion starts. JA3 and JA4 are fingerprints of the TLS handshake, which happens before any HTTP header or page content is sent. They are one input among several that a defensive system can use, and a block on its own doesn’t tell you which input fired. This article explains what those fingerprints are, what else bot-detection systems look at (using Cloudflare’s public documentation as the worked example), and how to diagnose a block without guessing.
The short answer
JA3 and JA4 summarize how a client opens a TLS connection. A site’s defenses can use them to group and classify connections. But they are not a verdict, and they are rarely the only signal: Cloudflare documents heuristics, JavaScript detections, machine-learning classification, and request-level features such as headers, session characteristics and browser signals. So “I got a 403” does not mean “my JA3 was flagged.” Work from evidence, and where the target publishes an API or access policy, start there.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Basic Latent Fingerprint Kit, Black | $43.00 | Buy on Amazon |
| 2 |
|
Forensic Postmortem Fingerprint Collection Kit with Finger Straighteners, Ink Pad, Left & Right Hand... | $35.00 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
What JA3 and JA4 actually are
The handshake comes first
For HTTPS, the client and server negotiate TLS before the HTTP request exists. The client’s opening message, the ClientHello, advertises connection parameters such as cipher suites and extensions. Cloudflare’s documentation describes JA3 and JA4 as compact fingerprints that identify TLS clients by how they initiate connections.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteJA3 versus JA4
According to Cloudflare’s engineering blog (2024), JA3 was introduced by Salesforce researchers in 2017 and hashes the ordered list of cipher suites, extensions and other parameters. Cloudflare also describes a 2023 Chromium change that shuffled the order of TLS extensions, which made JA3 less useful for recognizing current Chrome, because the same browser could produce many different hashes. JA4 was designed to be less sensitive to this. In Cloudflare’s words: “JA4 improves on JA3 by sorting ClientHello extensions, which reduces the number of unique fingerprints for modern browsers and makes grouping easier.”
#1 Best Overall
- A basic kit with Regular b;ack powder can be used with success on glass, counter tops, table tops, painted surfaces, cabinets and many other non-absorbent surfaces. Inclu
- 1 regular latent powder, 1 oz.
- 1 fiberglass fingerprint brush, extra soft
- 1 set of fingerprint backing cards (25 sheets)
- 1 lifting tape pad ( 25 sheets )
This history is Cloudflare’s account, not a universal description of every JA3 implementation. Cloudflare’s stated rationale for the approach is that it is “an efficient and accurate way to differentiate a browser from a Python script, while preserving user privacy.” That is a vendor’s product claim, not an independent benchmark.
What a fingerprint is not
- It is not a verified identity. Many clients can share one fingerprint, and one client’s fingerprint can change with software and protocol updates.
- It is not content-based. It is computed from connection characteristics, not from the page you request.
- It is not always available, as covered below.
Why a full browser can still be classified as a bot
Playwright automates a browser; it does not decide how the target scores your traffic. Cloudflare says simple bots may be caught by signature matching, while more sophisticated detection uses machine learning and behavioral analysis. Its ML documentation lists headers, session characteristics and browser signals as input features, and maps the predicted probability of a human to a Bot Score from 1 to 99. That scale is Cloudflare’s own output, not an industry standard.
Cloudflare also states that requests from its own Browser Run service are always identified as bots. A useful takeaway: running a real browser does not by itself imply a “human” classification.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe layers a defense can combine
| Layer | What is observed | Scope |
|---|---|---|
| TLS | ClientHello characteristics (JA3/JA4) | Per connection, often aggregated across traffic |
| HTTP | Headers and their consistency | Per request |
| Browser / JavaScript | Browser-visible signals and JavaScript detections | Per page load or session |
| Behavior | Request rate, paths, session patterns | Aggregated over sessions |
Cloudflare’s scraping detections show the layering concretely: one detection watches request patterns by ASN, another by JA4 fingerprint, and its documentation identifies Managed Challenge as a response that can limit scraping. Those are Cloudflare product facts, and other vendors may weigh signals differently. The sources don’t offer a neutral vendor comparison.
Rank #2
- COMPLETE POSTMORTEM KIT: Includes everything needed for collecting fingerprints from deceased individuals, all organized in a nylon carrying bag.
- FINGER STRAIGHTENERS INCLUDED: Comes with both a large and a small finger straightener to help position and prepare fingers for accurate ink impressions.
- SEPARATE LEFT & RIGHT HAND RECORD STRIPS: Dedicated fingerprint card pads for both the left and right hand ensure organized, clearly labeled print documentation.
- FINGERPRINTING DEVICE & INK PAD: The included postmortem fingerprinting device and ink pad work together to capture clear, detailed impressions of all five fingers.
- PROFESSIONAL-GRADE FORENSIC TOOL: Designed for forensic and law enforcement professionals who require reliable and thorough postmortem fingerprint collection.
When JA3/JA4 values are missing
Cloudflare notes that these fingerprints are calculated during the TLS handshake and may be absent for non-encrypted HTTP, when Bot Management is skipped, in specified Worker-to-origin routing cases, and on later connections that use TLS session resumption. The fields are documented for Enterprise customers who have purchased Bot Management. A missing value in a log may reflect collection conditions; it doesn’t prove fingerprinting played no part elsewhere in a detection stack.
Research context: how well can TLS alone work?
A 2026 preprint, “When Handshakes Tell the Truth: Detecting Web Bad Bots via TLS Fingerprints,” reports a CatBoost model reaching AUC 0.998, F1 0.9734 and test-set accuracy 0.9863. The authors trained and evaluated on a dataset derived from JA4DB, so these are study-specific results, not real-world accuracy guarantees. The paper lists HTTP/3 and additional device-fingerprinting features as future work. No general block rate or universal JA3/JA4 accuracy figure has been established.
Troubleshooting without guessing
- Identify the actual response. Record the status code, whether it is a challenge page, a redirect, or an application-level error. Don’t diagnose JA3 from a 403 alone.
- If you operate the destination, read your own telemetry. Cloudflare documents JA3/JA4 availability in Bot Analytics, Security Events, Security Analytics, the Analytics GraphQL API and logs. Check which rule or detection fired before changing anything.
- Review your traffic as a whole. Are sessions, request rates, paths and headers consistent with the use case you intend? The documentation treats these as distinct signals and engines, not TLS as a sole criterion.
- Account for service workers in your own tests. Playwright’s network documentation says service workers can take over requests and make them invisible to
BrowserContext.route()orPage.route(). If routing or mocking seems to miss requests, disable service workers in that test context so the routing events are visible again. - For sites you don’t own, look for permission. Check for an official API, a data-licensing option, or a published access policy such as terms and robots rules. Contact the site if the use case is legitimate but access is limited.
No proxy, browser build, or fingerprint change is guaranteed to alter a classification, and evading a site’s controls without authorization may violate its terms or applicable law. For test environments you control, allow-listing your own test traffic is the more reliable and legitimate fix.
Free tools Windows power users keep installed
One-click scans. No signup required.
For site operators: comparing defensive approaches
If you are evaluating detection options, compare them on five axes: which layer is observed; whether the signal is per request or aggregated; what logs and explainability you get; what false-positive controls and exclusion rules exist; and what plan or data-availability limits apply. Choose by those, not by whether a product advertises JA4.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
