Published
Changing your User-Agent is one of the most commonly recommended privacy moves. Install an extension, report yourself as a different browser, and you appear to have a new face.
The problem is that this face is not the first thing anyone sees.
Order of events
When you open a site, what actually happens is: TCP handshake, then TLS handshake, then the HTTP request, and only then does the browser start running any JavaScript on the page. The User-Agent is in step three. An extension can act in step four.
The first packet of the TLS handshake is called the ClientHello, and it is in step two. Inside it is a list: which cipher suites you support, which extensions, what order those extensions are in, which elliptic curves, which signature algorithms. You did not choose that list. It was compiled into your browser.
Take that list, assemble it by a fixed rule, hash it, and you get JA4.
Why it identifies you
Every copy of the same Chrome version has the same JA4, worldwide. Firefox looks like Firefox, Safari looks like Safari. So JA4 does not tell anyone who you are. It tells them what you are running.
The awkward part is the combination. If your User-Agent says Firefox while your JA4 says Chrome, that contradiction is itself a strong signal: this person is spoofing. You have not become more ordinary. You have become more distinctive.
Anti-fingerprinting tools can change what JavaScript is able to read. JA4 is not in that layer.
A CDN eats it
This has an interesting side effect. If a site sits behind a CDN like Cloudflare, TLS is terminated at the CDN edge, and the server behind it sees the handshake between itself and the CDN, not yours.
So “the site can see your JA4” depends. An extra layer does not make you invisible: your address is still passed to the backend in a header like CF-Connecting-IP. But the handshake fingerprint really is available only to whoever you connected to directly.
That is why WhatYouLeak has two sources. The main site sits behind Cloudflare; a second host, probe.whatyouleak.com, is deliberately not behind a CDN and terminates TLS itself. Put the two views side by side and the difference is exactly what the CDN absorbed.
What you can do
Honestly, not much. JA4 is not a setting, it is an implementation. Changing it means changing browsers, or running a proxy that rewrites the handshake, and that usually makes your fingerprint stranger rather than more ordinary.
A more useful framing: do not try to disappear. Know what is being read off you. You can only decide whether to care about something you can see.