2 entries in this register are declared substitutes for, successors to or predecessors of JA4+, and none of them are still shipping at the last field check. JA4+ itself reads ACTIVE, and 2 of the candidates carry a state mark other than ACTIVE or SEMI, which is the part a list without check dates cannot tell you. Every row is judged by the same rubric, from the same sweep, on the same fields.
Every row below is judged by the same rule as JA4+ itself, from the
same field check. Supersession is only printed where a project or its
author says so — this register does not infer that one tool replaces
another because it is newer.
Read the state column with the licence column. A permissively licensed
project that stopped shipping is not safer than a copyleft one that did
not.
What JA4+ does, so you know what you are replacing
The current generation of network fingerprints: a family rather than one hash, with separate suffixes for TLS, HTTP, TCP and other layers, and a human-readable structure rather than an opaque digest.
A substitute has to do that job, not merely occupy the same category. The readable structure is the practical improvement — you can see which component differs instead of only that the hash does. Its licence resolves to NOASSERTION, so read the terms directly before redistributing.
How this register decides what counts as an alternative
JA4+ is recorded as the successor to JA3 (Salesforce). Both directions of that edge are stored once and reversed when the index is built, so the graph cannot contradict itself in one direction and agree in the other.
p0f is recorded as a substitute for the same job. The alternative relation is symmetric and carries no ordering at all: it says these things answer the same question, and it says nothing whatsoever about which answers it better.
Nothing on this page is a ranking, a score or a recommendation, and nothing on it is a detection-test result — no entry in this register has been run against any anti-bot system by this register. What the table gives you is four measured columns and one derived one, applied identically to every row.
How to read the comparison above
Not one of the candidates is currently shipping. That is the single most useful thing this page can tell you, and it is the thing no undated list can: the whole neighbourhood around JA4+ has gone quiet, and replacing it means either adopting something equally stale or leaving the approach entirely.
1 of the entries in the table declare no licence at all — p0f. Read that column before the state column if you intend to ship anything: an absent licence file is an absent grant, and no amount of recent activity substitutes for one. Every no-licence entry in the register is grouped together for the same reason.
Why ARCHIVED: archived = true, set 2025-05-01. A maintainer's own statement outranks every date rule.
Field
Value at this printing
pushed_at
—
archived
true
archived_at
2025-05-01
latest_release
—
license.spdx_id
BSD-3-Clause
stargazers_count
3100
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/salesforce/ja3
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why DEAD: pushed_at = 2019-07-09 — 2593 days, past the 1095-day outer threshold.
Field
Value at this printing
pushed_at
2019-07-09
archived
false
latest_release
—
license.spdx_id
null (none declared)
stargazers_count
521
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/p0f/p0f
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Answered from the same fields the table above prints, and from no other source.
What is the best alternative to JA4+?
This register does not answer that, because it publishes no ranking and has tested no tool to rank. What it can tell you is which candidates are still shipping: none of them, at this field check. The rest of the decision is fit, licence and how much of your own stack you are prepared to change.
Are these JA4+ alternatives still maintained?
JA3 (Salesforce) reads ARCHIVED, p0f reads DEAD. Each of those states is derived from that entry's own measured fields by the rubric in force, at the field check printed in the folio, and the clause that produced it is printed on the entry page.
Why does this list not rank the alternatives?
Because a ranking would be an opinion wearing a number's clothes. Every figure on this site is a date, a count, an SPDX identifier or an HTTP status you can re-fetch from the endpoint named beside it, and there is no honest way to compress those into an ordering without inventing weights nobody published. The rubric sets states; it does not rate them against each other.
Where does the alternatives data for JA4+ come from?
From declared edges in the register itself, never inferred. Each edge is stored once and reversed at build time, and every field in the table is read from the same sweep that produced the rest of the catalogue. The whole set is downloadable as CC0 JSON and CSV, including the supersedes, superseded_by and alternative_to columns.
Section 07 is the half of a fingerprint that JavaScript cannot reach, and a browser-shaped page surface over a tool-shaped handshake is a contradiction that no amount of navigator patching fixes. Donut Browser is a real browser rather than an impersonating client, which resolves that layer by not having the problem — and it adds profile-level proxy handling with a launch gate that checks the exit's geography against the profile before anything starts.