Fingerprinting and Detection Glossary: JA4, Entropy, CDP, and 30 More Terms

You open a bot-management log and the word "entropy" is everywhere — "high entropy canvas," "entropy score 0.87," "low entropy screen resolution." Nobody tells you what the number actually represents. It's an easy term to nod along to and never pin down.

That's the problem with fingerprinting terminology. Half of it comes from information theory, half from network engineering, and the rest from security researchers who assume everyone read the same papers. The docs don't define terms. Forums assume prior knowledge.

So here's a different kind of glossary. Not the operator-focused multi-account browser glossary (we have that too). This one covers the measurement side — the terms you meet when you're working out how a site tells browsers apart. The vocabulary that shows up in FingerprintJS documentation, Cloudflare bot scores, CreepJS test results.

Thirty-three terms, organized by where in the stack they appear:

• Network layer (1-7): JA3, JA4, JA4H, p0f, HTTP/2, Akamai, GREASE
• Entropy and statistics (8-12): how distinctive a fingerprint is, and how outliers get spotted
• Browser APIs (13-19): CDP, Client Hints, permissions, prototype tampering, lies, WebDriver
• Persistent tracking (20-23): supercookies, HSTS, ETags, fonts
• Behavioral analysis (24-27): mouse, keyboard and scroll patterns
• Detection infrastructure (28-33): scores, collisions, and where fingerprinting runs

Network-Layer Fingerprinting

1. JA3 Fingerprint

An MD5 hash derived from your TLS Client Hello — cipher suites, extensions, elliptic curves. Created in 2017 by Salesforce. Largely superseded by JA4. If you see JA3 in logs, you're dealing with an older system.

2. JA4 Fingerprint

The successor to JA3. Produces a structured fingerprint like t13d1516h2_8daaf6152771_b0da82dd1658 — human-readable segments showing protocol version, cipher count, extension count, ALPN preference, then separate hashes for cipher and extension lists.

Our JA4 deep-dive covers how sites read it at the network layer. Short version: if a browser's JavaScript says Firefox but its JA4 says Chrome, the mismatch is visible before any JavaScript runs.

3. JA4H (HTTP Client Fingerprint)

JA4's HTTP-layer companion. Where JA4 reads the TLS handshake, JA4H fingerprints the HTTP request itself: the method and HTTP version, whether cookies and a referer are sent, the header count and language, and hashes of the header and cookie names. HTTP/2 SETTINGS values are a separate fingerprint (term 5).

Read together, JA4 and JA4H show whether the handshake and the request came from the same kind of client.

4. p0f Fingerprint

A passive OS fingerprinting technique that analyzes TCP/IP packet characteristics — initial TTL, window size, TCP options, don't-fragment flag. Created for network security in the 2000s, now used by detection systems to verify that your claimed operating system matches your network behavior.

A browser claiming macOS but running on a Windows TCP stack produces a mismatch at this layer. Nothing inside a browser reaches it, extension or engine: the TCP stack belongs to the operating system underneath.

5. HTTP/2 Fingerprint

The settings and frame ordering your browser uses when negotiating HTTP/2 connections. Includes SETTINGS frame values, PRIORITY frame structure, pseudo-header order. Chrome's defaults differ from Firefox's. HTTP/2 fingerprinting operates independently of TLS fingerprinting but correlates with it — both need to match your claimed browser identity.

6. AKAMAI Fingerprint

Akamai's detection fingerprints HTTP/2 SETTINGS and WINDOW_UPDATE frame patterns, and the HTTP/2 fingerprint format many tools log carries Akamai's name.

7. GREASE Values

Short for Generate Random Extensions And Sustain Extensibility. Chrome includes random extension IDs in TLS handshakes (0x0a0a, 0x1a1a, etc.) to prevent middleboxes from breaking when new extensions appear. The GREASE slots change per-connection but follow a fixed pattern.

Detection systems check whether GREASE values are present and follow the expected pattern. No GREASE usually means the client isn't Chrome.

Entropy and Statistical Analysis

8. Entropy

A measure from information theory: how identifying is a piece of information? High entropy = distinctive. Low entropy = common.

Screen resolution of 1920x1080? Low entropy — millions share it. A resolution of 1847x923? High entropy — almost nobody. Detection systems combine multiple low-entropy signals to create high-entropy fingerprints.

"Entropy" sounds like a quality score. It isn't. It's distinguishability — and the naming is a genuine usability gap in most vendor dashboards.

9. Fingerprint Entropy

The total identifying power of a fingerprint, measured in bits. A fingerprint with 33 bits of entropy distinguishes roughly 8 billion unique users. Combine enough signals and a fingerprint carries enough bits to single out an individual browser. When a dashboard reports a figure such as "entropy: 0.87," it's usually a normalized 0-1 score of how distinctive the fingerprint is.

10. Cross-Entropy

A statistical measure comparing two probability distributions. In detection, it can measure how well a fingerprint matches expected distributions. Low cross-entropy = normal values. High cross-entropy = anomalous.

11. Distribution Matching

The idea that a profile's values should be consistent with real browser populations. Not random — consistent. A random canvas hash doesn't exist in any real population, while a hash that fits the profile's stated browser and OS is coherent. Most inconsistent-looking profiles come from mismatched values.

12. Statistical Anomaly Detection

Detection that flags outliers rather than specific bad values. A screen resolution, timezone and canvas hash might each be valid, but a combination that appears in 0.001% of real traffic can be flagged anyway.

This is why a page can look fine on every individual check and still be scored as unusual. Infuriating to debug.

Browser API Detection

13. CDP (Chrome DevTools Protocol)

The protocol Chromium uses for remote debugging and automation. Playwright and Puppeteer communicate via CDP. Detection checks for Runtime.enable traces, debugger presence, modified prototype chains, unusual permission states. JustBrowser gives you a cdp_url from its local REST API so Playwright, Puppeteer or Selenium can attach to your own profiles.

14. CDP Leak

Any signal revealing Chrome DevTools Protocol is active: navigator.webdriver being true, Runtime domain enabled, extra properties on window or document, modified toString() output. CDP leaks happen because automation frameworks inject themselves into page context.

15. Client Hints (UA-CH)

HTTP headers meant to replace User-Agent parsing: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Mobile. Sites request specific hints and cross-check against JavaScript navigator values. Chrome sends Client Hints; Firefox doesn't. A browser that claims to be Firefox but sends Client Hints contradicts itself.

16. Permission API State

The navigator.permissions.query() API reveals granted or denied permissions. Fresh installs have "prompt" state for everything. Real users have mixed states. All "prompt" = probably fresh profile or automation.

17. Prototype Tampering

Modifying JavaScript built-ins to hide detection signals. Extension-based tools do this heavily — overriding canvas.getContext(), modifying navigator getters.

Detection checks property descriptors, function.toString() output, prototype chains. JavaScript-level tampering leaves traces in all of them. Our opinion: patching built-ins from a page script is the weakest way to build a multi-account browser, which is why JustBrowser's Chrome profiles set values inside its custom Chromium engine instead.

18. Lies Detection

Techniques identifying spoofed values. Detection runs fingerprinting calls in main thread and Web Worker — different results mean spoofing. Also: timing analysis (native calls are faster), cross-checking Canvas with OffscreenCanvas, comparing WebGL parameters against claimed GPU.

19. WebDriver Flag

The navigator.webdriver property is true when controlled by automation. Dozens of other signals correlate with automation, so the flag alone tells a site little. Symptom, not disease.

Persistent Tracking

20. Supercookie

Tracking that persists beyond standard cookie clearing. Uses storage that clearing cookies may not wipe: HSTS state, favicon cache, ETag cache, cached redirects. Separate profiles keep this state apart: each JustBrowser profile keeps its own cookies and storage.

21. HSTS Fingerprinting

Browsers remember HSTS state (which domains require HTTPS). Trackers link to 32 domains, some with HSTS, some without, then read back which upgraded. Binary pattern = unique ID. Can survive cookie clears. Only cleared by wiping the browser's stored HSTS state.

22. ETag Tracking

ETags are HTTP cache validators — servers send them, browsers store and resend them. Trackers generate unique ETags per visitor, creating identifiers that persist in HTTP cache. Cache clearing should remove ETags. In practice, some browsers have bugs where they survive partial clears.

23. Local Font Enumeration

Font enumeration reveals installed fonts — through the Local Font Access API where a browser offers it, or by measuring how text renders. Adobe users have Adobe fonts. Developers have monospace fonts. High entropy because font combinations are distinctive. Hard to spoof because faking fonts requires actually having them — or intercepting every font measurement call.

Behavioral Analysis

24. Behavioral Biometrics

Tracking behavior patterns: mouse velocity, click dwell time, keystroke timing, scroll patterns, touch pressure.

Harder to fake than static fingerprints because it requires realistic human variance continuously. Most automation tools don't try — they move mice in straight lines at constant velocity. Our bet: behavior will carry more weight in bot scoring over time, since static values are easy to make consistent.

25. Mouse Movement Analysis

Detection examining mouse trajectories. Real humans have micro-corrections, curved paths, variable acceleration. Automation produces straight lines, constant velocities, robotic precision.

26. Keystroke Dynamics

Timing analysis of typing: inter-key intervals, hold times, rhythm. Detection flags unnaturally consistent timing or impossibly fast input. Automation frameworks injecting keystrokes with setTimeout(type, 50) produce detectable patterns, because real typing varies from key to key.

27. Scroll Fingerprinting

Analysis of scrolling: velocity, acceleration, pause patterns. Trackpad scrolling looks different from mouse wheel from touch scrolling. Programmatic window.scrollTo() looks different from all of them. Detection fingerprints scroll events to distinguish real users from automation.

Detection Infrastructure

28. Trust Score

Numerical rating of how legitimate your browser appears. FingerprintJS, CreepJS, and platform systems calculate these. Usually 0-100 or 0-1. Aggregates fingerprint consistency, behavioral patterns, network characteristics. Different systems weight differently, so one tool's score says little about another's.

Trust scores are opaque, and that's their worst trait. "Your score is 42%" says nothing about which signals counted against you. Just a number. No explanation.

29. Bot Score

Similar to trust score but measuring automation likelihood. Cloudflare, Akamai Bot Manager, PerimeterX assign these. Many weigh behavioral signals: mouse movements, timing patterns, challenge solving speed. Perfect static fingerprint + robotic behavior = flagged.

30. Fingerprint Hash Collision

When two different browsers produce the same fingerprint hash. Common configurations collide often; an unusual combination is what makes a browser stand out.

31. Client-Side vs Server-Side Fingerprinting

Client-side runs JavaScript to collect signals. Server-side analyzes network traffic before JavaScript runs (JA4, p0f, HTTP/2).

32. Passive Fingerprinting

Fingerprinting without executing code — purely from observing traffic: TLS handshake, TCP behavior, HTTP headers. You can't see it from within the browser.

33. Active Fingerprinting

Fingerprinting by executing code: Canvas, WebGL, AudioContext, fonts. Values must be consistent across the main thread, Web Workers, and iframes, or the mismatch itself becomes a signal.

Honorable Mentions

Font Rendering Subpixel Analysis: Examining antialiasing patterns. ClearType on Windows, subpixel rendering on macOS — font rendering reflects the real OS underneath.

Audio Stack Fingerprinting: Processing audio through Web Audio API nodes. Different hardware produces different results. Low entropy alone, useful for cross-validation. See our deep-dive on audio and font fingerprinting.

WebGL Renderer String: GPU identification via WEBGL_debug_renderer_info. High entropy. The string has to agree with actual rendering behavior. Our WebGL fingerprinting guide covers the full detection surface.

The Fingerprinting Detection Glossary, Summed Up

If you take one thing from this glossary: fingerprinting happens at multiple layers, and they have to agree with each other.

JavaScript values that say Firefox next to a Chrome-shaped JA4? Inconsistent. Clean network signals next to robotic mouse movement? Inconsistent. Every signal individually fine but the combination rare? Still unusual.

Knowing what each term means and where it appears in the stack makes bot-score logs readable, whether you're testing your own site, doing QA, or running automation on accounts you're allowed to hold.

Frequently Asked Questions

What's the difference between JA3 and JA4 fingerprinting?

JA3 hashes your TLS handshake into a single MD5 string. JA4 structures the fingerprint into readable segments: protocol version, cipher count, extension count, then separate hashes for cipher and extension lists, so you can see which part differs between two clients.

How do sites tell automated input from a person's?

Detection systems look for statistical anomalies — unnaturally consistent timing, missing micro-corrections, identical scroll velocities across sessions. Human input varies from moment to moment; most scripted input doesn't.

Why does CDP detection matter for automation?

Chrome DevTools Protocol leaves fingerprints: runtime.enable traces, debugger presence checks, altered prototype chains. Detection systems query these specifically because CDP is how Puppeteer and Playwright control browsers. Sites that check for these signals can tell an unmodified automation session from a person's browser.

What makes a supercookie different from a regular cookie?

Regular cookies are deleted when you clear cookies. Supercookies persist through mechanisms outside standard cookie storage — HSTS state, favicon caches, ETags, cached redirect chains. Some can survive a cookie clear because they live in caches and security state that clearing cookies doesn't touch.

---

Try JustBrowser

A multi-account browser for teams, built on a custom Chromium engine — not extension-based — patched on every upstream release. Real C++ engine patches at the canvas / WebGL / audio / font / screen layer across 40+ identity parameters. Local REST API + CDP for Playwright, Puppeteer and Selenium. 7-day free trial, card required — then $9.99/month or $99.99/year, unlimited profiles, free team seats.

Get started → · How it differs from Multilogin / GoLogin / AdsPower