TLS fingerprinting recognizes a client library from details of the handshake, which can separate common browsers from unusual automation tools.
It is a recognition signal, and this page does not describe any way to disguise a handshake.
How it works
During the handshake the client offers versions, cipher suites, and extensions in an order that often identifies the library.
Defenders compare that pattern with the browser the request claims to be.
A mismatch can mean a script using a different library than a normal browser.
Libraries and browsers change, so the signal should sit beside account behavior rather than convict a visitor alone.
Concrete examples
- A request claims a popular browser, but the handshake matches a common automation library.
- Many logins share one rare handshake pattern over a short period.
- A privacy tool presents a stable unusual handshake that you allow after a careful review.
Protective measures
- Record handshake features where your edge can see the session start.
- Treat a mismatch as a risk signal, not as automatic proof of abuse.
- Refresh reference patterns as browsers and libraries change.
- Combine the signal with account behavior before you decide to block.