Understanding User-Agent strings

Every HTTP request from a browser includes a User-Agent header, a string that describes the browser, its rendering engine, the operating system and sometimes the device. Developers parse it for analytics, to debug "it only breaks on my phone" reports, and to spot bots in logs. This guide explains how to read a User-Agent string, why it looks so strange, and why you shouldn't rely on it for feature decisions.

Reading a real User-Agent string

text
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Piece by piece:

• Mozilla/5.0 is a historical token that almost every browser sends. It carries no information today.
• (Windows NT 10.0; Win64; x64) is the platform: Windows 10 or 11 (both report 10.0), on 64-bit x86.
• AppleWebKit/537.36 (KHTML, like Gecko) names the rendering engine lineage. Chrome's engine, Blink, forked from WebKit, which forked from KHTML.
• Chrome/131.0.0.0 is the actual browser and its major version.
• Safari/537.36 is another compatibility token.

Why User-Agents are so confusing

In the 1990s, websites served better pages to browsers whose User-Agent said "Mozilla". Every new browser copied tokens from the one before it to avoid getting the worse version. The result is that nearly every browser claims to be several other browsers. A few patterns to remember:

• Microsoft Edge looks like Chrome plus an Edg/ token.
• Opera looks like Chrome plus OPR/.
• Chrome on iOS uses Apple's WebKit engine, like all iOS browsers, and reports CriOS/ instead of Chrome/.
• Safari contains Version/17.4 Safari/605.1.15, where Version is the Safari version.

Order of checks matters: test for Edg/ and OPR/ before Chrome/, and for Chrome/ before Safari/. That's why a maintained parsing library beats hand-written regular expressions.

User-Agent reduction

Browsers now deliberately reduce the detail in User-Agent strings to limit fingerprinting:

• Chrome freezes the OS version and minor browser version. All Windows 10 and 11 machines report Windows NT 10.0, and the version shows as 131.0.0.0.
• On Android, Chrome reports a generic device model (K) instead of the real phone model.
• Safari on macOS reports Mac OS X 10_15_7 regardless of the actual macOS version.

If you need precise details, Chromium-based browsers offer User-Agent Client Hints. A server can request headers such as Sec-CH-UA-Platform-Version and Sec-CH-UA-Model, and pages can call navigator.userAgentData.getHighEntropyValues(). Firefox and Safari don't currently support Client Hints.

Bots and crawlers

Search engines and tools identify themselves too:

text
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)

Anyone can send that string, though. To verify that a request really comes from Googlebot, do a reverse DNS lookup on the IP address and check that it resolves to googlebot.com or google.com, then a forward lookup to confirm it maps back to the same IP.

Good and bad uses

Good uses:

• Analytics: which browsers and operating systems your users have.
• Debugging: reproducing a bug report on the right browser and version.
• Log analysis: separating bot traffic from human traffic.

Bad uses:

• Feature detection. Don't serve different code because a string says "Safari". Check for the feature itself ('IntersectionObserver' in window, or CSS @supports). User-Agents lie, change and get frozen.
• Security decisions. The header is fully controlled by the client.

Parse User-Agents

Paste one or more User-Agent strings, one per line, into the User Agent Parser. It shows the browser, engine, operating system, device and CPU for each, and you can sort a list by browser. It opens with your own browser's User-Agent. You can also upload a .txt, .csv or .json file of strings from your logs. In code, maintained libraries such as ua-parser-js (JavaScript) and ua-parser (Python) handle the edge cases for you.