TLS proxy with real browser TLS profiles
A TLS proxy that connects to websites with a real browser’s handshake. Pick an exit country and one of 139 TLS profiles, build the request as in an API client, and see the JA3, JA4 and HTTP/2 fingerprint a website reads. 10 free requests a day with a free account.
- 139 TLS profiles
- 219 countries
- Free account
USChrome 154// The response appears here: status, HTTP version, time, headers and body.
// https://tls.peet.ws/api/all echoes the fingerprint a website sees: JA3, JA4 and the HTTP/2 (Akamai) fingerprint.
- Exit United States
- Fingerprint Chrome 154
- HeadersProfile’s User-Agent
- Gatewaygw.ludaxproxy.com:9999
Check the rest of your setup
Each takes seconds. The IP, IPv6 and WebRTC checks run on your own device with no account.
IP Lookup
Country, region, city, ISP and ASN of any IPv4 or IPv6 address, or of your own.
Open the toolIPv6 Checker
Does a website answer over IPv6? AAAA records of the domain, www and its name servers.
Open the toolWebRTC Leak Test
Does your browser reveal your real IP through WebRTC behind a proxy or VPN?
Open the toolHow the TLS Proxy works
Pick the exit and the browser
Choose an exit country and a TLS profile: an exact build such as Chrome 154 or Safari iOS 26.2, a random build of one browser, or any of the 139.
Build the request
Method, URL, headers as rows or raw lines, body, timeout and redirects, as in an API client. With AE the gateway sets the User-Agent to match the profile.
The gateway connects like a browser
The TLS proxy opens the connection from a residential IP with the profile’s TLS ClientHello and HTTP/2 settings, then returns the status, headers, body and timing.
What is a TLS proxy?
A TLS proxy sits between a client and a server and handles the TLS (HTTPS) encryption between them. The name covers three kinds of proxy. A TLS termination proxy, such as a load balancer or reverse proxy, decrypts HTTPS in front of a website’s own servers. A TLS inspection proxy, used by company networks and security products, decrypts traffic to scan it. A TLS fingerprint proxy, used for web scraping and automation, ends the client’s TLS connection and opens a new one to the website with the handshake of a real browser.
Ludax’s TLS proxies are the third kind, on residential IPs. Your HTTP library talks to the gateway; the gateway talks to the website as Chrome, Safari, Firefox or Edge would, from a home connection in the country you choose. The website sees a browser on a household IP, not a script on a server.
What a website sees in the TLS handshake
Before any page is sent, the client opens TLS with a ClientHello: its TLS versions, cipher suites and their order, extensions and their order, supported groups, signature algorithms, ALPN and GREASE values. Every browser build sends its own combination, and HTTP libraries such as Python’s requests, Node.js fetch or Go’s net/http send combinations no browser does.
Anti-bot systems reduce the ClientHello to a fingerprint. JA3 is an MD5 hash of five ClientHello fields in the order sent. JA4 sorts the cipher suites and extensions, adds the TLS version and ALPN, and uses SHA-256, so it survives the extension shuffling recent Chrome builds do. On HTTP/2 the SETTINGS frame, the window update and the order of pseudo-headers form a second fingerprint, often called the Akamai fingerprint. A Chrome User-Agent over a Python handshake is one of the clearest bot signals there is.
How to choose a TLS profile
Match the profile to the User-Agent you send. With AE (auto emulation) the gateway sets User-Agent and the sec-ch-ua client hints from the profile for you; with NAE your headers pass through unchanged, so send a User-Agent of the same browser and version.
Recent Chrome builds are the most common handshake on the web and a safe default. Pick an exact build to keep the fingerprint stable across a job, a random build of one browser (randomchrome, randomsafari…) to vary it within a family, or auto for any profile. With a sticky session the profile is held for the session along with the IP. OkHttp profiles match the HTTP client inside most Android apps, for app APIs.
When a TLS proxy helps, and when it does not
A TLS proxy is for HTTP clients: scripts and services built on requests, httpx, axios, fetch, curl or Go. A real browser driven by Playwright, Puppeteer or Selenium already sends its own genuine handshake and needs a standard residential proxy instead.
To present the browser fingerprint you pick, the gateway ends your HTTPS connection and re-signs the website’s certificate with the Ludax CA, which you install as a trusted root on the systems that send proxy traffic. Apps with certificate pinning, such as many banking and mobile apps, reject that certificate; use a standard plan, which passes HTTPS through end to end. The TLS profiles run over TCP as HTTP/2 or HTTP/1.1, not over HTTP/3.
Setting up a proxy? The documentation has ready-to-run examples for Python, Playwright and Selenium.
All 139 TLS profiles
Each profile is a real browser build’s TLS ClientHello and HTTP/2 settings. Put its name at the end of the proxy username, or pick a random build of one browser (randomchrome, randomedge, randomfirefox, randomsafari, randomopera, randomokhttp) or auto for any.
Chrome TLS profiles 46
Desktop Chrome builds, the most common browser handshake on the web.
- Chrome 154
- Chrome 153
- Chrome 152
- Chrome 151
- Chrome 150
- Chrome 149
- Chrome 148
- Chrome 147
- Chrome 146
- Chrome 145
- Chrome 144
- Chrome 143
- Chrome 142
- Chrome 141
- Chrome 140
- Chrome 139
- Chrome 138
- Chrome 137
- Chrome 136
- Chrome 135
- Chrome 134
- Chrome 133
- Chrome 132
- Chrome 131
- Chrome 130
- Chrome 129
- Chrome 128
- Chrome 127
- Chrome 126
- Chrome 124
- Chrome 123
- Chrome 120
- Chrome 119
- Chrome 118
- Chrome 117
- Chrome 116
- Chrome 114
- Chrome 110
- Chrome 109
- Chrome 108
- Chrome 107
- Chrome 106
- Chrome 105
- Chrome 104
- Chrome 101
- Chrome 100
Edge TLS profiles 19
Microsoft Edge on Windows: Chromium with its own build history.
- Edge 148
- Edge 147
- Edge 146
- Edge 145
- Edge 144
- Edge 143
- Edge 142
- Edge 141
- Edge 140
- Edge 139
- Edge 138
- Edge 137
- Edge 136
- Edge 135
- Edge 134
- Edge 131
- Edge 127
- Edge 122
- Edge 101
Firefox TLS profiles 21
Firefox desktop, private windows and Firefox for Android: a non-Chromium TLS stack.
- Firefox 152
- Firefox 151
- Firefox 150
- Firefox 149
- Firefox 148
- Firefox 147
- Firefox 146
- Firefox 145
- Firefox 144
- Firefox 143
- Firefox 142
- Firefox 139
- Firefox 136
- Firefox Private 136
- Firefox 135
- Firefox Android 135
- Firefox Private 135
- Firefox 133
- Firefox 128
- Firefox 117
- Firefox 109
Safari TLS profiles 29
Safari on macOS, iPhone (iOS) and iPad, with Apple’s own handshake.
- Safari 26.4
- Safari 26.3
- Safari 26.2
- Safari iOS 26.2
- Safari iPad 26.2
- Safari 26.1
- Safari 26
- Safari iOS 26
- Safari iPad 26
- Safari 18.5
- Safari 18.3.1
- Safari 18.3
- Safari 18.2
- Safari iOS 18.1.1
- Safari 18
- Safari iPad 18
- Safari 17.6
- Safari 17.5
- Safari 17.4.1
- Safari iOS 17.4.1
- Safari 17.2.1
- Safari iOS 17.2
- Safari 17.0
- Safari 16.5
- Safari iOS 16.5
- Safari 16
- Safari 15.6.1
- Safari 15.5
- Safari 15.3
Opera TLS profiles 16
Opera desktop builds.
- Opera 131
- Opera 130
- Opera 129
- Opera 128
- Opera 127
- Opera 126
- Opera 125
- Opera 124
- Opera 123
- Opera 122
- Opera 121
- Opera 120
- Opera 119
- Opera 118
- Opera 117
- Opera 116
OkHttp TLS profiles 8
The HTTP client inside most Android apps.
- OkHttp 5
- OkHttp 4.12
- OkHttp 4.10
- OkHttp 4.9
- OkHttp 3.14
- OkHttp 3.13
- OkHttp 3.11
- OkHttp 3.9
TLS proxy vs a standard residential proxy
Both give you a home IP. Only a TLS proxy changes the handshake the website fingerprints.
| Feature | Standard residential proxy | TLS proxy |
|---|---|---|
| IP address the website sees | A residential (home) IP | A residential (home) IP |
| TLS handshake (JA3 / JA4) | Your HTTP library’s | The browser profile you pick |
| HTTP/2 fingerprint | Your HTTP library’s | The browser profile’s |
| User-Agent | As you send it | Matched to the profile (AE) or yours (NAE) |
| HTTPS | End to end, never opened | Re-signed by the gateway with the Ludax CA |
| Apps with certificate pinning | Work | Do not work: use a standard plan |
| Best for | Real browsers (Playwright, Selenium), apps | HTTP clients: requests, httpx, axios, curl, Go |
Use the TLS proxy from Python
Any HTTP client that takes a proxy URL works the same way: the profile and the header mode go in the username, the country in the password.
Every option is in the TLS profiles documentation and the Python guide. Plans: Residential TLS proxies
import requests
# Username: your username, the header mode (AE) and the TLS profile.
# Password: your plan password and the exit country.
proxy = "http://resi-YOUR_USERNAME-AE-chrome154:[email protected]:9999"
r = requests.get(
"https://tls.peet.ws/api/all",
proxies={"http": proxy, "https": proxy},
verify="ludax-ca.crt", # the gateway re-signs HTTPS with the Ludax CA
timeout=30,
)
print(r.json()["tls"]["ja4"])The tools are free. The proxies are why we build them.
Residential IPs that read as real home users, with the targeting and browser fingerprints the hardest sites check for.
Residential
ISP-assigned home IPs for scraping, SEO and multi-account work with location targeting.
Residential TLS
Everything in Residential, plus a genuine browser TLS handshake on every request.
Residential Premium
Hand-picked premium ISP pools with the lowest block rates on the hardest targets.
Not sure which one fits? Help me choose a proxy
Frequently asked questions
What is a TLS proxy?
A proxy that handles the TLS (HTTPS) layer between a client and a server. In web scraping it means a proxy that opens the connection to the website with a real browser’s TLS handshake, so the site sees a browser fingerprint instead of the HTTP library’s. Ludax’s TLS proxies do this from residential IPs.
Is the TLS proxy tool free?
Building a request is open to everyone. Sending it needs a free Ludax account, which includes 10 TLS requests a day, reset at 00:00 UTC. A Residential TLS or Residential Premium TLS plan removes the limit and adds state and city targeting.
What is a TLS profile?
A recorded TLS and HTTP/2 handshake of one browser build, such as Chrome 154 or Safari iOS 26.2: its cipher suites, extensions, ALPN, key shares and HTTP/2 settings, in the browser’s own order. The proxy replays it on every connection.
How many TLS profiles are there?
139: 46 Chrome, 19 Edge, 21 Firefox, 29 Safari, 16 Opera and 8 OkHttp builds. Safari includes macOS, iPhone and iPad builds; Firefox includes private windows and Android.
What is the difference between JA3 and JA4?
Both are fingerprints of the TLS ClientHello. JA3 hashes five fields in the order sent, so a browser that shuffles its extensions gets a new JA3 on every connection. JA4 sorts the fields, adds the TLS version and ALPN, and stays the same for a browser build.
Does a TLS proxy change my IP address?
Yes. The Ludax TLS proxy connects from a residential IP in the country you choose, so the IP address and the TLS fingerprint both look like a home user’s browser.
Why do I need to install a certificate?
To send your request with the browser’s handshake, the gateway ends your HTTPS connection and opens a new one, re-signing the website’s certificate with the Ludax CA. Trust ludax-ca.crt on the systems that send proxy traffic and remove it when you stop using TLS plans.
Does the TLS proxy support HTTP/3?
No. The TLS profiles run over TCP as HTTP/2 or HTTP/1.1. HTTP/3 (QUIC) goes through the SOCKS5 gateways, where your own client builds the handshake.
Free tools today. Real residential IPs when you need them.
Plans from $0.49/GB. No subscription, no monthly minimum: start with a $0.99 package and pay in crypto.
- No subscription
- Crypto payments
- 30-day plan validity