What are the drawbacks of hashing in JA3 and JA4?

Back to learning

JA3 and JA4 do not hash the same material in the same way. JA3 applies MD5 to one serialised string and normally publishes only the resulting 32-character identifier. JA4 keeps a readable first section, then uses two 12-character truncated SHA-256 values for its normalised cipher and extension material.

That distinction matters: the published formats preserve and discard different information.

What hashing gives you

Compact identifiers are convenient for high-volume logs, database indexes and exact comparisons. They are also easy to exchange: two systems implementing the same version of the method can compare a short value without moving full packet data.

Hashing also sets a clear equality rule. If the inputs selected by the method are identical after its normalisation, the identifier is identical. If a hashed input changes, the output will usually be completely different.

What the compact value takes away

• Explanation: A JA3 MD5 value does not show which field differs. JA4's a section is readable, but its b and c sections still hide their lists.
• Similarity: Exact hash comparison cannot say that two handshakes differ by one cipher. Useful partial matching needs retained components or raw material.
• Flexible rules: A rule cannot select a particular cipher or extension from the hash alone.
• Future analysis: A later method may need fields that the current fingerprint discarded.
• Original ordering: Canonical JA4 sorts cipher and extension codes. Even its normalised raw JA4_r form does not restore the packet's original order.
• Attribution: Looking up a compact value in a labelled database does not prove that the current connection came from the labelled software.

The short hashes also have a finite collision space. Truncating SHA-256 to 12 hexadecimal characters gives JA4 a 48-bit section, while JA3's MD5 output is 128 bits. That arithmetic does not make JA3 more descriptive: semantic collisions—different clients producing the same selected inputs—are usually the more immediate attribution problem.

Keep the representation that matches the job

For routine grouping, compact JA3 or JA4 values may be enough. For investigations and detector development, retain more:

• the packet or parsed ClientHello, where policy permits;
• the unhashed JA3 string;
• JA4's JA4_r normalised raw output;
• original-order output if ordering matters;
• the capture point, timestamp and parser version.

FoxIO documents JA4_r and original-order output in the JA4 technical specification. The JA3 repository documents its source string and MD5 calculation.

Keeping raw material costs more storage and may carry more sensitive metadata, so retention should be deliberate. A useful compromise is to log the compact identifier broadly and preserve richer material for sampled traffic, investigations or short retention windows.