User Agent Parser and Browser Information

A user agent is a header the browser sends with every HTTP request: User-Agent. It carries the browser's name and version, the operating system it runs on and sometimes the device model. A server reads that single line to guess what is on the other end; whether to send the mobile page, which download link to offer, and whether the request is a bot are usually decided from it.

But a user agent is a declaration, not an identity document. Whatever the browser writes is what gets sent; one client-side setting or an extension changes it, and with curl you can write anything at all. Security decisions are therefore never built on it. Parsing a string tells you what the other end claims to be, not what it is.

The term is user agent everywhere that matters: it is the name used in the HTTP specification, in browser developer tools and in every reference.

Because of a thirty-year chain of imitation. Mosaic came first in 1993; Netscape followed a year later, took Mozilla as its code name and wrote Mozilla/1.0 into its string. Once Netscape became the first browser with frame support, sites started looking for Mozilla in the string and sending the framed page only to it.

To get the same pages, Internet Explorer introduced itself as Mozilla/4.0 (compatible; MSIE 4.0): I am like Mozilla, but I am really IE. Then Safari arrived, wrote like Gecko because it descends from the KHTML engine, and started with Mozilla too. Chrome wrote KHTML, Safari and Mozilla all at once. When Edge moved to Chromium it put Chrome, Safari and Mozilla in its string together and appended Edg at the end.

Today there is hardly a browser that does not begin with Mozilla/5.0, and the phrase says nothing at all. In the same way, like Gecko and the AppleWebKit version number in most strings are historical residue. Reading a string correctly means knowing exactly which of these lies means what.

The string below belongs to Chrome running on Windows. Of its six parts, only two actually carry information.

Whether a user agent parser gets the answer right depends on the order in which it looks for the tokens below. The parser on this page runs from the most specific match to the most general, and that is the only reason it does not mistake Edge for Chrome, Opera for Chrome or Chrome for Safari.

The user agent string became a fingerprinting surface precisely because of its detail: the OS patch level, the device model and the full version together were enough to single out one browser in a crowd. Chromium therefore began freezing the string and introduced a structured mechanism in its place, called User Agent Client Hints.

The idea is simple: low-entropy fields are sent on their own, high-entropy ones only if the server asks. The browser sends Sec-CH-UA, Sec-CH-UA-Mobile and Sec-CH-UA-Platform with every request. For the device model, the full version, the architecture and the platform version the server has to request them with an Accept-CH header. The same values are reachable from JavaScript through navigator.userAgentData; the high-entropy ones need a getHighEntropyValues call that returns a promise.

You can see the practical result at the top of this page: Windows 10 and Windows 11 cannot be told apart from the classic string, but they can from the Client Hints platform version. Chrome's full version, likewise, now lives only on the hints side. Firefox and Safari never implemented the API, so on those browsers the classic string is all there is.