---
title: "TLS fingerprinting"
url: https://proxy.wiki/glossary/tls-fingerprinting/
type: Glossary Term
author: "proxy.wiki editorial"
published: 2026-08-19
updated: 2026-08-19
site: proxy.wiki
topics: ["Proxy fundamentals"]
license: CC BY 4.0 — quote freely with attribution to https://proxy.wiki/
---

# TLS fingerprinting

> Identifying a client from the structure of its TLS handshake, before any HTTP request is sent.

**TLS fingerprinting derives an identifier from how a client opens an encrypted connection.** The Client Hello message exposes the cipher suites offered, their order, supported extensions and their order, and version preferences. Different software produces reliably different combinations.

## Why it defeats naive scraping

A script can send any `User-Agent` it likes, but the TLS handshake is produced by the underlying library. A Python HTTP client claiming to be Chrome still handshakes like Python — and the mismatch between the two is itself a strong signal, arguably stronger than either alone.

This happens _before_ the HTTP request, so the server can decide to block you without ever seeing the request you intended to make.

## What can be done about it

Use a client that reproduces a real browser’s handshake, or drive a real browser. Header-level disguises alone do not address it. Fingerprint databases such as JA3 and its successors are widely used to catalogue these signatures.

## Related

[Browser fingerprinting](/glossary/browser-fingerprinting/) works at a higher layer, using JavaScript. TLS fingerprinting needs no JavaScript at all.