psk_key_exchange_modes
psk_key_exchange_modes tells a TLS 1.3 server how resumed sessions may derive keys. Most clients send it.
What it is
psk_key_exchange_modes (extension 45) is defined in RFC 8446. In TLS 1.3, a session can be resumed with a pre-shared key (PSK) from an earlier connection. This extension says how the client allows such a resumption to work: psk_ke uses the PSK alone, psk_dhe_ke combines it with a fresh Diffie-Hellman exchange for forward secrecy.
A client that does not send it cannot resume TLS 1.3 sessions, because RFC 8446 requires it alongside any pre_shared_key offer, and servers must abort a resumption attempt that lacks it.
The extension is small, but its presence shows that the client supports TLS 1.3 session resumption, and the listed modes show whether it insists on forward secrecy for resumed sessions.
RFC 8446 requires a client that offers a pre-shared key to send this extension as well, so the two always appear together on resumed connections.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 10 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
Chrome, curl_cffi, curl-impersonate, Debian curl, Python requests, httpx, Node.js fetch and Guzzle send it. macOS curl and Go net/http do not send it in our measurements. The position varies from 4th for curl-impersonate chrome116 to 13th for the ff117 profile.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for psk_key_exchange_modes in the TLS details.
Run the TLS fingerprint test