record_size_limit
record_size_limit caps the size of encrypted TLS records. Only the Firefox profile sends it in our measurements.
What it is
record_size_limit (extension 28) is defined in RFC 8449. It lets each side say how large the TLS records it receives may be. A device with little memory can ask for small records, so it does not have to buffer up to 16 KB before it can decrypt and check one.
It replaced the older max_fragment_length extension from RFC 6066, which had fixed sizes only and was negotiated in one direction. With record_size_limit both sides announce their own limit.
Mainstream browsers and servers rarely need small records, so the extension mostly matters for constrained devices. In our data it is sent only by the Firefox profile of curl-impersonate.
The limit applies to the plaintext inside each record and is announced by both client and server, so each side can pick a limit that fits its own memory.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 1 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
Among our measured clients only curl-impersonate ff117, the Firefox profile, sends it. Chrome, curl_cffi, curl-impersonate chrome116 and every plain library do not. In our data it marks the Firefox profile, and a client that claims to be Chrome while sending it stands out.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for record_size_limit in the TLS details.
Run the TLS fingerprint test