User Agent Parser

What is a User-Agent string?

Every browser and HTTP client sends a User-Agent (UA) string in the User-Agent request header. The server can read it to understand which browser, operating system, and device sent the request, and optionally tailor its response accordingly.

Anatomy of a UA string

A typical desktop Chrome UA looks like this:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

• Mozilla/5.0: legacy compatibility token present in virtually all modern browsers.
• (Windows NT 10.0; Win64; x64): OS and CPU architecture.
• AppleWebKit/537.36: rendering engine and version.
• Chrome/124.0.0.0: browser name and version.

What can you detect from a UA string?

• Browser: name and version (Chrome, Firefox, Safari, Edge, Opera…).
• Operating system: name and version (Windows, macOS, Linux, iOS, Android…).
• Device type: desktop, mobile, tablet, smart TV, wearable, XR headset.
• Device vendor and model: Apple iPhone, Samsung Galaxy, etc. (mobile/tablet only).
• Rendering engine: Blink, Gecko, WebKit, Trident…
• CPU architecture: amd64, arm64, ia32, etc.

Limitations of UA sniffing

UA strings are self-reported and can be spoofed by any client. Many browsers allow users to change their UA, and tools like developer-mode device emulation commonly switch it. For capability detection in web applications, prefer feature detection (e.g., checking for CSS.supports() or navigator.mediaDevices) over UA sniffing.

Additionally, the User-Agent Client Hints API (navigator.userAgentData) is the modern, privacy-preserving replacement for UA strings in Chromium-based browsers, providing structured data without the full UA string.

UA string freezing and Client Hints

Starting in 2021, Chrome began freezing portions of the UA string to reduce passive fingerprinting: the minor browser version, OS version, and device model are reported as fixed placeholder values instead of real data. The replacement API is User-Agent Client Hints, delivered via HTTP request headers:

• Sec-CH-UA: browser brand and major version
• Sec-CH-UA-Platform: OS name (e.g. “Windows”)
• Sec-CH-UA-Mobile: boolean mobile indicator
• Sec-CH-UA-Model: device model (high-entropy, must be requested)

Servers must explicitly request high-entropy hints via the Accept-CH response header. Client Hints are only available in Chromium-based browsers; Firefox and Safari continue to expose the traditional UA string.

Mobile detection accuracy

The UA string alone cannot reliably distinguish a tablet from a laptop with a touchscreen, or a foldable phone in desktop mode from a regular desktop. For responsive design decisions, prefer CSS media queries (pointer: coarse for touch, hover: none for touch-primary devices) over UA-based mobile detection. These reflect actual input capabilities rather than the reported device category.

Common bot and crawler user agents

Identifying crawler traffic is useful for writing accurate robots.txt rules and for segmenting server log analytics. Note that malicious bots often spoof popular crawler UA strings - verify Googlebot by reverse DNS lookup, not UA alone.