Differences observed in hash fingerprints for Safari 18 on Mac and iOS

[charliedelta02]

The question

I was comparing the curl-cffi impersonate fingerprint with the actual fingerprint of Safari on a Mac and iPhone using https://tls.browserleaks.com/json and observed some discrepancies.

For safari18 impersonate, the akamai, ja4 and ja4_o hash were observed to be different.
For 'safari18_ios' impersonate, the ja4, ja4_o hash were observed to be different.
Whereas, for chrome131 and chrome131_android, I observe that only the ja4_o hash is different.

Is this behavior expected?

Versions

If it's related to a specific environment, paste your env info here.

• OS: [MacOS, iOS]
• curl_cffi version [0.8.0b7]

[lexiforest]

Please add the fingerprints you captured and the minor versions.

[charliedelta02]

Please add the fingerprints you captured and the minor versions.

Fingerprint produced by safari18 impersonate on tls.browserleaks.com:

{
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15",
  "ja3_hash": "773906b0efdefa24a7f2b8eb6985bf37",
  "ja3_text": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0",
  "ja3n_hash": "44f7ed5185d22c92b96da72dbe68d307",
  "ja3n_text": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-5-10-11-13-16-18-21-23-27-43-45-51-65281,29-23-24-25,0",
  "ja4": "t13d2014h2_a09f3c656075_e42f34c56612",
  "ja4_r": "t13d2014h2_000a,002f,0035,009c,009d,1301,1302,1303,c008,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,002b,002d,0033,ff01_0403,0804,0401,0503,0805,0805,0501,0806,0601,0201",
  "ja4_o": "t13d2014h2_de3eb69493ac_b9c16f732f1a",
  "ja4_ro": "t13d2014h2_1301,1302,1303,c02c,c02b,cca9,c030,c02f,cca8,c00a,c009,c014,c013,009d,009c,0035,002f,c008,c012,000a_0000,0017,ff01,000a,000b,0010,0005,000d,0012,0033,002d,002b,001b,0015_0403,0804,0401,0503,0805,0805,0501,0806,0601,0201",
  "akamai_hash": "d4a2dcbfde511b5040ed5a5190a8d78b",
  "akamai_text": "2:0;3:100;4:2097152;8:1;9:1|10420225|0|m,s,a,p"
}

Fingerprint produced by Safari browser version 18_2 on a Mac on tls.browserleaks.com:

{
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15",
  "ja3_hash": "773906b0efdefa24a7f2b8eb6985bf37",
  "ja3_text": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0",
  "ja3n_hash": "44f7ed5185d22c92b96da72dbe68d307",
  "ja3n_text": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-5-10-11-13-16-18-21-23-27-43-45-51-65281,29-23-24-25,0",
  "ja4": "t13d2014h2_a09f3c656075_14788d8d241b",
  "ja4_r": "t13d2014h2_000a,002f,0035,009c,009d,1301,1302,1303,c008,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,002b,002d,0033,ff01_0403,0804,0401,0503,0203,0805,0805,0501,0806,0601,0201",
  "ja4_o": "t13d2014h2_de3eb69493ac_65135c5c1a6b",
  "ja4_ro": "t13d2014h2_1301,1302,1303,c02c,c02b,cca9,c030,c02f,cca8,c00a,c009,c014,c013,009d,009c,0035,002f,c008,c012,000a_0000,0017,ff01,000a,000b,0010,0005,000d,0012,0033,002d,002b,001b,0015_0403,0804,0401,0503,0203,0805,0805,0501,0806,0601,0201",
  "akamai_hash": "959a7e813b79b909a1a0b00a38e8bba3",
  "akamai_text": "2:0;4:4194304;3:100|10485760|0|m,s,p,a"
}

[lexiforest]

Sorry, I don't have the bandwidth to install the version you provided and confirm, recently. You can use the ja3 and akamai string.