TLS Extensions List: What Each ClientHello Extension Does
TLS extensions are optional fields in the ClientHello that announce features the client supports: which server it wants (server_name), which TLS versions it speaks (supported_versions), its key exchange public keys (key_share), and many more.
Extensions were added to TLS over the years, so the set a client sends tells a lot about its TLS library and its age. Browsers send many, including Chrome-specific ones such as application_settings (ALPS) and encrypted_client_hello. Plain libraries send fewer, and some send extensions browsers never use.
Order matters too. Most libraries send their extensions in a fixed order, so the order is a stable signature. Chrome started shuffling its extension order on every connection, which is what broke the stability of JA3, a fingerprint that hashes extensions in the order sent. JA4 sorts extensions before hashing and counts them in its prefix, so Chrome keeps one JA4 despite the shuffling.
GREASE values, random reserved codes that Chrome-based clients insert on purpose, also appear in the extension list. Our JA3 and JA4 values leave them out, as most implementations do, and they have no page of their own here.
| Name | Code | What it does | Status | Sent by measured clients |
|---|---|---|---|---|
| application_layer_protocol_negotiation | 16 | ALPN: the TLS extension where the client lists the protocols it speaks, such as h2 and http/1.1, so HTTP/2 is agreed in the handshake. | — | 12 of 12 |
| application_settings | 17613 | ALPS: a Chrome extension that sends HTTP/2 settings inside the TLS handshake. Only Chrome and Chrome impersonators send it. | — | 2 of 12 |
| application_settings_old | 17513 | The old code point (17513) of the ALPS extension. Only the outdated curl-impersonate chrome116 profile sends it. | — | 1 of 12 |
| compress_certificate | 27 | compress_certificate lets the server send its certificate chain compressed. Chrome and recent OpenSSL clients send it. | — | 7 of 12 |
| delegated_credential | 34 | delegated_credential (RFC 9345) accepts short-lived server credentials. Only the Firefox profile of curl-impersonate sends it. | — | 1 of 12 |
| ec_point_formats | 11 | ec_point_formats lists elliptic curve point formats, a TLS 1.2 leftover that every measured client still sends. | — | 12 of 12 |
| encrypt_then_mac | 22 | encrypt_then_mac switches TLS 1.2 CBC suites to the safer encrypt-then-MAC order. OpenSSL-based clients send it, browsers do not. | — | 6 of 12 |
| encrypted_client_hello | 65037 | Encrypted Client Hello (ECH, RFC 9849) encrypts the SNI and other ClientHello fields. Chrome always sends it, real or GREASE. | — | 2 of 12 |
| extended_master_secret | 23 | extended_master_secret ties TLS 1.2 session keys to the full handshake, blocking the triple handshake attack. | — | 11 of 12 |
| key_share | 51 | The TLS 1.3 extension that carries the client's public keys for the key exchange, so the handshake finishes in one round trip. | — | 12 of 12 |
| padding | 21 | padding adds filler bytes to keep the ClientHello at a size that old middleboxes handle. Few current clients send it. | — | 3 of 12 |
| post_handshake_auth | 49 | post_handshake_auth lets a TLS 1.3 server ask for a client certificate later. OpenSSL clients such as Python requests send it. | — | 3 of 12 |
| pre_shared_key | 41 | pre_shared_key offers a key from an earlier session for fast TLS 1.3 resumption. It is always the last extension. | — | 1 of 12 |
| psk_key_exchange_modes | 45 | psk_key_exchange_modes tells a TLS 1.3 server how resumed sessions may derive keys. Most clients send it. | — | 10 of 12 |
| record_size_limit | 28 | record_size_limit caps the size of encrypted TLS records. Only the Firefox profile sends it in our measurements. | — | 1 of 12 |
| renegotiation_info | 65281 | renegotiation_info protects TLS 1.2 renegotiation from a known attack. Most clients send it, plain curl does not. | — | 10 of 12 |
| server_name | 0 | Server Name Indication (SNI): the TLS extension that tells the server which hostname the client wants, so one IP can host many sites. | — | 12 of 12 |
| session_ticket | 35 | session_ticket allows resuming a TLS 1.2 session with a ticket from an earlier connection. Half the measured clients send it. | — | 7 of 12 |
| signature_algorithms | 13 | signature_algorithms lists the signature schemes a client can verify, such as ECDSA, RSA-PSS and Ed25519. | — | 12 of 12 |
| signed_certificate_timestamp | 18 | signed_certificate_timestamp asks the server for Certificate Transparency proofs. Chrome sends it, most libraries do not. | — | 4 of 12 |
| status_request | 5 | status_request asks the server to staple an OCSP response proving its certificate is not revoked. Browsers send it. | — | 5 of 12 |
| supported_groups | 10 | supported_groups lists the key exchange groups a client supports, such as X25519MLKEM768, x25519 and secp256r1. | — | 12 of 12 |
| supported_versions | 43 | The extension that lists the TLS versions a client supports. It is how TLS 1.3 is negotiated, and every measured client sends it. | — | 12 of 12 |