tls.peet.ws APItls.peet.ws ↗
Get JA3, JA4, Akamai HTTP/2, and PeetPrint fingerprints for any HTTP client via the tls.peet.ws API. Includes cipher suites, TLS extensions, and TCP/IP details.
No input parameters required.
curl -X GET 'https://api.parse.bot/scraper/146dfd2e-1372-4c03-b84c-ba2a6b10e352/get_all' \ -H 'X-API-Key: $PARSE_API_KEY'
Get the complete TLS fingerprint data including all TLS details, HTTP/2 frames, TCP/IP info, request headers, user agent, and all fingerprint hashes (JA3, JA4, Akamai, PeetPrint). Returns a single object with all connection analysis data.
No input parameters required.
{
"type": "object",
"fields": {
"ip": "string - Client IP address and port",
"tls": "object - TLS details including ciphers, extensions, tls_version_record, tls_version_negotiated, ja3, ja3_hash, ja4, ja4_r, peetprint, peetprint_hash, client_random, session_id",
"http2": "object - HTTP/2 details including akamai_fingerprint, akamai_fingerprint_hash, sent_frames array",
"tcpip": "object - TCP/IP details including cap_length, dst_port, src_port, ip, tcp sub-objects",
"donate": "string - Donation message",
"method": "string - HTTP method used",
"user_agent": "string - User agent string sent in request",
"http_version": "string - HTTP version used (e.g. h2)"
},
"sample": {
"data": {
"ip": "198.145.51.27:47484",
"tls": {
"ja4": "t13d1516h2_8daaf6152771_d8a2da3f94cd",
"ciphers": [
"TLS_GREASE (0x6A6A)",
"TLS_AES_128_GCM_SHA256"
],
"ja3_hash": "0088f0ca9e80858155b27a741b119bce",
"extensions": [
{
"name": "TLS_GREASE (0x9a9a)"
}
],
"peetprint_hash": "1d4ffe9b0e34acac0bd883fa7f79d7b5",
"tls_version_record": "771",
"tls_version_negotiated": "772"
},
"http2": {
"akamai_fingerprint": "1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p",
"akamai_fingerprint_hash": "52d84b11737d980aef856699f885ca86"
},
"tcpip": {
"ip": {
"ttl": 43,
"ip_version": 4
},
"dst_port": 443,
"src_port": 47484
},
"donate": "Please consider donating to keep this API running. Visit https://tls.peet.ws",
"method": "GET",
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36",
"http_version": "h2"
},
"status": "success"
}
}About the tls.peet.ws API
The tls.peet.ws API exposes 3 endpoints that return live TLS, HTTP/2, and TCP/IP fingerprint data for the calling client, covering over 15 distinct response fields including JA3/JA4 hashes, Akamai HTTP/2 fingerprints, PeetPrint hashes, cipher suite arrays, and TLS extension lists. The get_all endpoint returns the full connection analysis in a single object, while get_fingerprints provides a lightweight summary of just the hash values.
What the API Returns
The get_all endpoint returns a single JSON object with every connection detail: the client IP and port, the full tls object (cipher suites array, extensions array, tls_version_record, tls_version_negotiated, ja3, ja3_hash, ja4, ja4_r, and peetprint), an http2 object with akamai_fingerprint, akamai_fingerprint_hash, and a sent_frames array, a tcpip object with src_port, dst_port, cap_length, and nested ip and tcp sub-objects, plus the http_version, method, and user_agent fields.
Targeted Endpoints
If you only need fingerprint hashes, get_fingerprints returns a flat object with ja3, ja3_hash, ja4, ja4_r, akamai, akamai_hash, peetprint, peetprint_hash, and http_version — no frame-level or TCP/IP detail. For TLS-only analysis, get_tls returns the tls object with its ciphers and extensions arrays and all fingerprint fields; the ip, method, http_version, and donate fields are returned as empty strings on this endpoint, and the tcpip object contains empty sub-objects.
Fingerprint Formats Covered
The API surfaces four fingerprinting schemes: JA3 (MD5 hash of TLS client hello parameters), JA4 and JA4_r (a newer TLS fingerprint format with a raw variant), Akamai HTTP/2 (based on SETTINGS and WINDOW_UPDATE frames), and PeetPrint (an extended TLS fingerprint with its own MD5 hash). All four are available from get_all and get_fingerprints; JA3, JA4, JA4_r, and PeetPrint are also present in the get_tls response.
Limitations and Scope
All three endpoints are zero-input — there are no query parameters or path variables. The data always reflects the live connection made by the API caller at request time. Historical or cached fingerprint data is not available. The get_tls endpoint does not populate ip, method, http_version, or TCP/IP sub-fields, so use get_all if those fields are required.
- Verify the JA3/JA4 fingerprint a custom HTTP client or bot-detection bypass stack presents to servers
- Audit whether a proxy or VPN changes the Akamai HTTP/2 fingerprint (
akamai_fingerprint_hash) of outgoing connections - Confirm the TLS cipher suite order and extensions array match a target browser's known fingerprint
- Compare PeetPrint hashes across different TLS library configurations to detect unintended divergence
- Log the
user_agentalongside JA4 to flag mismatches between declared browser and actual TLS behavior - Retrieve
sent_framesfromhttp2to inspect SETTINGS and WINDOW_UPDATE frame values for HTTP/2 stack profiling - Use
get_fingerprintsfor a fast, low-payload fingerprint health check in CI pipelines
| Tier | Price | Credits/month | Rate limit |
|---|---|---|---|
| Free | $0/mo | 100 | 5 req/min |
| Hobby | $30/mo | 1,000 | 20 req/min |
| Developer | $100/mo | 5,000 | 250 req/min |
One credit = one API call regardless of which marketplace API you call. Exceeding the rate limit returns a 429 response. Authenticate with the X-API-Key header.
Does tls.peet.ws have an official developer API?+
What does `get_tls` return compared to `get_all`?+
get_tls returns only the tls object (ciphers, extensions, and all four fingerprint hashes) plus an empty tcpip skeleton. It does not populate ip, method, http_version, user_agent, or the http2 frames data. Use get_all when you need the full connection picture including Akamai HTTP/2 frames or the client IP.Can I pass a target URL or remote IP to fingerprint a server rather than my own client?+
get_all, get_fingerprints, get_tls) fingerprint the calling client's own connection — there is no input parameter to target a remote host. You can fork this API on Parse and revise it to add an endpoint that accepts a target host and returns its server-side TLS details.Is historical or time-series fingerprint data available?+
What is the `ja4_r` field and how does it differ from `ja4`?+
ja4 is the standard JA4 fingerprint string, which sorts and hashes certain TLS client hello fields. ja4_r is the raw (unsorted, unhashed) variant of the same data, preserving the original field order. It is useful when you need to compare exact extension ordering rather than just the final hash.