JA3 Fingerprint

Category: Crypto

Status: Registered and callable in the CyberChef 11.3.0 compatibility inventory.

Input / output: string → string

Background: https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967

What it does

Generates a JA3 fingerprint to help identify TLS clients based on hashing together values from the Client Hello. Input: A hex stream of the TLS Client Hello packet application layer.

Note

Status here means the operation name is implemented and callable. It does not by itself promise byte-for-byte parity for every upstream option. See Compatibility and current status for the verified scope and known boundaries.

Arguments and options

Arguments are positional. Keep their order when using bake() or Pipeline.then().

Index	Name	UI type	PyChef default	Accepted values / format
`0`	Input format	`option`	`'Hex'`	`'Hex'`, `'Base64'`, `'Raw'`
`1`	Output format	`option`	`'Hash digest'`	`'Hash digest'`, `'JA3 string'`, `'Full details'`

Recipe template

Important

This is a call template built from the documented defaults. Replace placeholder values such as empty keys, paths, patterns, or lookup data before running it.

from pychef import bake

input_value = "example"
args = ['Hex', 'Hash digest']
result = bake(input_value, [{"op": 'JA3 Fingerprint', "args": args}])
print(result)

Pipeline example

from pychef import Pipeline

args = ['Hex', 'Hash digest']
transform = Pipeline().then('JA3 Fingerprint', *args)
result = transform("example")

Direct call

pychef.ops.run_operation runs any registered operation as a plain function, under the active ExecutionPolicy (safe defaults, no network):

from pychef.ops import run_operation

args = ['Hex', 'Hash digest']
result = run_operation('JA3 Fingerprint', "example", args=args)

Common operations also have typed helpers in Direct operations.

Low-level operation module

Warning

The module below is an internal implementation detail. It applies no execution policy, resource limits, or error sanitization; prefer bake(), Pipeline, or pychef.ops for application code.

The registered entry point lives in pychef.operations.by_operation.ja3_fingerprint. Direct calls receive the input value and a positional argument tuple:

from pychef.operations.by_operation.ja3_fingerprint import run

result = run("example", tuple(['Hex', 'Hash digest']))

pychef.operations.by_operation.ja3_fingerprint.run(value, args)

Run this operation using its shared internal implementation.

Parameters:

value (str | bytes)
args (Sequence[Any])

Return type:

str | bytes