Repository navigation
Sift 2.1.0
Adds TLS fingerprint impersonation and the Jar.
TLS fingerprints. Every request the Sender and Jar send can impersonate a real client's TLS
and HTTP/2 fingerprint, using tls-client. Pick from
83 profiles — Chrome, Firefox, Safari (desktop and iOS), Edge, Opera, Brave, OkHttp. A route
carries a default; the toolbar dropdown overrides it per tab.
It changes what the server actually sees:
| Go default | chrome_131 | |
|---|---|---|
| JA3 | d6627faa72aa91c9e2ae51d456173c69 |
a19ab9f02aacf42deddc1f2acb3d3f63 |
| JA4 | t13d2512h2_b78ed14e2fd0_ab7e3b40a677 |
t13d1516h2_8daaf6152771_02713d6af862 |
Headers also go out in the order you typed them, passed through to HTTP/2 as the header order.
A Chrome JA3 with Go's alphabetical header order still reads as a bot, so both halves matter.
Works through every route, including an upstream HTTP or SOCKS5 proxy and Sift's own proxy.
Routes can also force HTTP/1.1.
Jar. A new tab that takes a URL and shows you everything about its cookies. It walks the
redirect chain keeping a jar like a browser would, and per hop shows the cookies sent, the
Set-Cookie headers received with domain, path, expiry and flags, and both header sets. The
Find box searches all of that at once, as plain text or regex, and says where each hit came
from. Every hop is also a normal row in the Traffic tab.
The binary is 18 MB now, up from 11.5 MB — that is the cost of utls and quic-go.
SHA-256: 35b4ffc51cb1c5fc1877d3c9c1f2bc9fae6d78ae19ac075916da086b855b007e
Windows x64. MIT.