Does JA3 or JA4 prove which application sent the traffic?
No. Fingerprints group observable ClientHello characteristics. Different clients can share a fingerprint, and one client can change its fingerprint across versions or configurations.
TLS ClientHello / JA3 / JA4 Inspector
Decode TLS ClientHello records or handshake bytes, inspect negotiation signals and exact extension ranges, and calculate JA3 and JA4 client fingerprints locally.
Local input limit: 5 MB · Processing timeout: 8 s
Inspect a TLS ClientHello
Open a captured TLS handshake record or bare ClientHello message. Parsing and fingerprint calculation run in a browser worker without connecting to a host.
TLS ClientHello bytes
0 KB
ClientHello inspection
ClientHello inspection
TLS versions, SNI, ALPN, cipher suites, extensions, exact byte ranges, JA3, JA4, and structural findings will appear here.
Did DecodeLens help?
Support the continued development of independent, browser-local developer tools.
Map the TLS client offer before encryption starts
DecodeLens parses the ClientHello record boundary, cipher list, compression methods, and extensions with bounded reads. It maps exact extension ranges back to the supplied bytes and derives JA3 plus the open-source JA4 TLS client fingerprint without contacting a server.
Capture, fingerprint, and trust boundaries
- Accepts TCP TLS handshake records or a bare ClientHello handshake. It does not parse PCAP, Ethernet, IP, TCP, QUIC, HTTP/2, or ServerHello messages.
- JA3 uses the legacy_version, cipher suites, extension types, supported groups, and EC point formats after GREASE removal.
- Only the BSD-3-Clause JA4 TLS client fingerprint is calculated. JA4S, JA4H, JA4X, and the rest of JA4+ are not implemented.
- ECH can hide the inner ClientHello. When an ECH-related extension is visible, the tool reports the outer signal and does not attempt decryption.
- A fingerprint is a correlation hint, not an identity, reputation, malware, authentication, or trust verdict.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- Binary analysis
Hex Viewer & Binary Inspector
Inspect file bytes, pasted hex, offsets, ASCII, numeric values, and magic-byte signatures.
Open tool - Binary analysis
Universal Payload Inspector
Detect unknown files and nested encoded, compressed, token, certificate, structured, and binary artifacts, or compare two independent payload graphs.
Open tool - API & network
Raw HTTP Request & Response Inspector
Parse raw HTTP/1.x messages, inspect framing and multipart bodies, reconstruct HTTP signature bases, compare Content-Digest, and optionally verify supplied-key signatures.
Open tool - Security & identity
X.509 / PEM Certificate Decoder & Inspector
Inspect PEM or DER certificates, identity, validity, algorithms, SANs, extensions, fingerprints, and chain signatures.
Open tool
Inspect ClientHello bytes copied from a TLS capture
Extract the TLS handshake record bytes, paste them as Hex or Base64, then review offered versions, SNI/ALPN, extension ordering, exact byte ranges, and both fingerprint forms.
TLS record bytes
16 03 01 … 01 00 …Negotiation offer and fingerprints
TLS 1.3 · h2 · JA3 hash · JA4 t13d…TLS ClientHello, JA3, and JA4 FAQ
Why does legacy_version show TLS 1.2 for a TLS 1.3 client?
TLS 1.3 keeps the ClientHello legacy_version field at 0x0303 for compatibility. The actual offered versions are carried in the supported_versions extension.
Can I paste a PCAP file?
Not in this version. Extract the TLS record or ClientHello bytes first. Keeping packet reassembly outside this focused tool avoids ambiguous stream reconstruction.