About JA3Proxy
Customizing TLS (JA3) Fingerprints through HTTP Proxy
JA3Proxy 0.6.0
Customizing TLS (JA3) Fingerprints through HTTP Proxy
- By Lyle
- Open Source
- Portable
- Updated Jul 10, 2026
What's new in 0.6.0
Highlights
- Serve HTTP, HTTPS, and SOCKS5 clients on the same listen address. SOCKS5 TLS streams use the MITM/uTLS path, while non-TLS streams are forwarded as plain TCP.
- Select outbound uTLS fingerprints globally or by upstream host with the new fingerprint catalog, hot-reloadable configuration, and --tls-profile-file routes.
- Monitor active and recent traffic with the optional --tui dashboard, structured log levels, and opt-in payload dumping.
- Reorganize runtime code into focused internal packages and expand unit and end-to-end coverage.
- Build Linux, Windows, and macOS archives for AMD64 and ARM64 with SHA-256 checksums. Stable releases also publish multi-platform GHCR images with SBOM and provenance attestations.
Breaking CLI changes
The runtime flags have been renamed:
- -addr and -port → --listen
- -cert and -key → --ca-cert and --ca-key
- -client, -version, and -fingerprint → --tls-fingerprint
- -fingerprint-config → --tls-fingerprint-file
- -upstream-tls-config → --tls-profile-file
- -upstream → --upstream-proxy
- -list-fingerprints → --list-tls-fingerprints
- -debug → --log-level debug; use --dump-traffic to log payload data
Go 1.26.5 or newer is required when building from source.
Full Changelog: https://github.com/LyleMi/ja3proxy/compare/v0.5.1...v0.6.0
Technical details
| Publisher | Lyle |
|---|---|
| Version | 0.6.0 |
| Release date | 2026-07-10 |
| License | MIT |
| Installer type | zip |
| Architecture | x64, arm64 |
| Package ID | LyleMi.JA3Proxy |
Install JA3Proxy from the command line
- Install with Windows Package Manager
winget install --id=LyleMi.JA3Proxy -e- Update to the latest version
winget upgrade --id=LyleMi.JA3Proxy -e- Uninstall
winget uninstall --id=LyleMi.JA3Proxy -e
JA3Proxy adds this command to the command line: ja3proxy.
JA3Proxy version history
0.5.1 Jun 16, 2026
What's Changed
Features
- Added hot-reloadable TLS fingerprint configuration via -fingerprint-config.
- Supports loading client and version from a JSON file.
- New HTTPS CONNECT connections use the latest loaded fingerprint.
- Existing tunnels continue using the fingerprint they were opened with.
- Fixed CONNECT response handling for clients such as ffprobe.
- Aligned ALPN behavior between client-side and upstream TLS connections.
- Avoided mutating Go's default HTTP transport.
- Passed HTTP transport traffic through the configured upstream dialer.
Improvements
- Added SOCKS5 upstream proxy handling improvements.
- Moved CLI source into cmd/ja3proxy.
- Changed default generated CA paths to:
- credentials/cert.pem
- credentials/key.pem
- Updated Docker runtime paths and Docker context ignores.
- Updated Makefile output paths so release binaries are written under bin/.
- Expanded README with usage, Docker, certificate, fingerprint, and development docs.
Testing
- Added end-to-end proxy tests.
- Added JA3 fingerprint verification coverage.
- Added unit tests for proxy handlers, MITM CONNECT flow, upstream dialer construction, custom TLS wrapping, certificate handling, debug writer behavior, and
edge cases.
Dependencies and CI
- Updated github.com/refraction-networking/utls from v1.6.7 to v1.8.2.
- Updated github.com/cloudflare/cfssl from v1.6.4 to v1.6.5.
- Updated golang.org/x/net from v0.23.0 to v0.38.0.
- Updated GitHub Actions dependencies: …
0.4 May 10, 2025
What's Changed
- Added newer version of dependencies (e.g. utls) for new browsers compatibility by @antoniolch in https://github.com/LyleMi/ja3proxy/pull/17
New Contributors
- @antoniolch made their first contribution in https://github.com/LyleMi/ja3proxy/pull/17
Full Changelog: https://github.com/LyleMi/ja3proxy/compare/v0.3...v0.4
0.3 Jul 10, 2024
What's Changed
- Load certificate at startup by @rosahaj in #9
- fix: reply with sni-specific certs by @rosahaj in #11
- fix: stop goroutine leaks by ensuring both goroutines exit properly by @huboh in #14
New Contributors
- @huboh made their first contribution in #14
Full Changelog: https://github.com/LyleMi/ja3proxy/compare/v0.2...v0.3
Frequently asked questions
Is JA3Proxy free?
Yes. JA3Proxy is free and open-source software released under the MIT license.
What is the latest version of JA3Proxy?
The latest version is 0.6.0, released on Jul 10, 2026.
Is it safe to download JA3Proxy?
The download button links to the official installer published on github.com, the same file Windows Package Manager installs. You can verify the downloaded file by comparing its SHA-256 checksum with 97443bf5334bda71e8a9cf3757aae52e8bc9080c6a28dc2afdd70444266ce2ff.
Which Windows versions does JA3Proxy support?
JA3Proxy runs on Windows and is available for 64-bit (x64), ARM64 systems.
How do I uninstall JA3Proxy?
Open Settings › Apps › Installed apps, find JA3Proxy and select Uninstall. From the command line, run winget uninstall --id=LyleMi.JA3Proxy -e.
Is there a portable version of JA3Proxy?
Yes. JA3Proxy is available as a portable ZIP archive (ja3proxy-v0.6.0-windows-amd64.zip, 64-bit (x64)) that runs without installation. Copy it to any folder or USB drive and run it from there.
Alternatives to JA3Proxy
Other Networking programs for Windows from different developers.
Sheas Cealer 1.1.4
Just Ceal It (Can be used for proxy-free legal defense against network eavesdropping and conducting network research)
DPIGuard 0.3.4
Configurable HTTP, TLS fragmentation tool
Winix NetCat 0.4.0
Cross-platform netcat — TCP/UDP send/receive, port checks, TLS clients.
step-ca 0.30.2
A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management.
Advanced IP Scanner 2.5.4594.1
A simple tool for discovering network devices
Wireshark 4.6.9
The world's most popular network protocol analyzer.