User-agent parser
What is an User Agent Parser?
Every browser and HTTP client sends a User-Agent header that describes itself. The format is a historical mess of compatibility tokens: nearly every browser claims to be Mozilla, and Chrome claims to be Safari too. This parser decodes the string into clear fields: browser and version, rendering engine, operating system, CPU architecture and device type.
How to use it
- Your own user agent is shown by default.
- Paste any other user-agent string, for example from server logs or an analytics export, to parse it.
Example
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
- Browser: Chrome 130
- Engine: Blink (reported as AppleWebKit 537.36)
- OS: Windows 10 or 11 (both report NT 10.0)
- CPU: amd64
- Device: desktop
Why user agents are unreliable
- Reduced user agents: Chrome and Edge now freeze parts of the string, such as the minor version and the OS version, to limit fingerprinting. Windows 11 cannot be distinguished from Windows 10 by the UA alone.
- Spoofing: any client can send any user agent, including bots pretending to be Googlebot.
- Client Hints: modern Chromium browsers expose accurate details through
Sec-CH-UAheaders andnavigator.userAgentDatainstead.
Best practice
Use user-agent parsing for analytics and debugging, not for deciding which features to serve. For features, use feature detection, such as checking whether an API exists. To verify a search engine crawler, use a reverse DNS lookup on its IP address.
Frequently Asked Questions
What is a user-agent string?
A header sent by browsers and HTTP clients describing the software, operating system and device making the request.
Why does Chrome's user agent mention Safari and Mozilla?
For historical compatibility. Websites once served features based on those names, so browsers kept them.
Can I detect Windows 11 from the user agent?
No. Windows 10 and 11 both report Windows NT 10.0. Use User-Agent Client Hints to tell them apart.
Can user agents be faked?
Yes. Any client can send any string, so never rely on it for security decisions.