User-Agent Parser

Every web browser, crawler, and API client sends an HTTP User-Agent header identifying its software version, operating system, and hardware architecture. This free client-side parser decodes any User-Agent string in real time—extracting the browser, OS version, device form factor, rendering engine, bot status, and token anatomy. Everything runs directly inside your browser: no data is ever uploaded, logged, or sent across the network.

Understanding the HTTP User-Agent Header

Whenever a web browser, mobile application, crawler, or CLI utility requests a resource over HTTP or HTTPS, it transmits request headers containing contextual metadata. Among the most historically significant headers is User-Agent. Defined originally in RFC 1945 (HTTP/1.0) and refined in RFC 9110 (HTTP Semantics), the header's primary purpose is to allow network protocol peers to identify the application type, operating system, software vendor, and release version of the requesting client.

Web servers utilize this diagnostic data for multiple core functions: serving responsive desktop versus mobile layout configurations, enforcing software compatibility fallbacks, tailoring video codecs, detecting malicious scrapers, and compiling traffic analytics. However, because client-side User-Agent strings grew increasingly convoluted over decades of commercial browser rivalries, extracting accurate device facts requires understanding both the string's historical lineage and modern standardization efforts.

The Bizarre History of User-Agent Sniffing

If you inspect almost any modern web browser's User-Agent string today, you will encounter a curious string of seemingly contradictory tokens: Google Chrome claims to be Mozilla/5.0, mentions AppleWebKit/537.36, asserts it is like Gecko, and ends with Chrome/124.0.0.0 Safari/537.36. This bizarre token layering reflects the history of browser sniffing and web compatibility:

• 1993 — NCSA Mosaic and Netscape Navigator: Netscape was code-named Mozilla (Mosaic Killer). Its User-Agent was Mozilla/1.0 (Windows NT...). Web developers built rich features like frames specifically for Netscape, checking whether the User-Agent started with Mozilla/.
• 1995 — Microsoft Internet Explorer: When Microsoft introduced Internet Explorer, servers configured for Netscape denied IE users advanced layouts. To circumvent this arbitrary lockout, Microsoft changed IE's User-Agent to Mozilla/1.22 (compatible; MSIE 2.0; Windows 95), declaring itself "compatible" with Mozilla.
• 2003 — Apple Safari & KHTML: Apple created Safari using Konqueror's open-source KHTML rendering engine. Because servers blocked KHTML, Apple added AppleWebKit/x (KHTML, like Gecko) to inform servers that WebKit rendered pages identically to Mozilla's Gecko engine, while also appending Safari/x.
• 2008 — Google Chrome & Blink: When Google launched Chrome, they needed Safari-optimized websites to render properly without rewriting server sniffer logic. Chrome thus adopted the entire WebKit/Safari header, appending Chrome/x while retaining Safari/x.
• 2020 — Microsoft Edge (Chromium): Moving away from EdgeHTML, Microsoft rebuilt Edge on Google's Chromium engine. Edge now carries Mozilla, AppleWebKit, Chrome, Safari, and its own Edg/x identifier.

Anatomy of a Modern User-Agent String

Despite its historical quirks, standard RFC 9110 User-Agent strings adhere to a predictable five-part structural syntax:

Segment Name	Example Token	Technical & Historical Purpose
Compatibility Lead	Mozilla/5.0	Declared by virtually all graphical browsers since Netscape 5.0 to bypass legacy server gates.
Platform Comment	(Windows NT 10.0; Win64; x64)	Enclosed in parentheses. Reveals the underlying operating system kernel, device hardware, and processor architecture.
Engine Token	AppleWebKit/537.36	Specifies the HTML/CSS layout engine build. Blink-based browsers freeze this value at 537.36.
Engine Compatibility	(KHTML, like Gecko)	Asserts that the browser's rendering model supports standard Gecko DOM and CSS features.
Product & Fallbacks	Chrome/124.0.0.0 Safari/537.36	Declares the primary browser brand followed by legacy compatibility tokens for web application servers.

Bot, Crawler, and AI Agent Identification

In addition to consumer web browsers, automated crawlers traverse the internet millions of times per second. Server administrators and SEO engineers rely on User-Agent detection to manage bot access, budget crawl capacity, and block unauthorized data scrapers:

1. Search Engine Spiders: Crawlers like Googlebot, bingbot, and Baiduspider index web pages for search results. They declare unique identification strings and documentation URLs (e.g., +http://www.google.com/bot.html) in their platform comments.
2. AI Training & Assistant Scrapers: Generative AI crawlers including OpenAI's GPTBot, Anthropic's ClaudeBot, Perplexity's PerplexityBot, and Common Crawl's CCBot scrape public web content to train foundation models. Webmasters frequently block or rate-limit these tokens in robots.txt.
3. Social Media Link Previewers: When users share URLs on platforms such as Slack, Discord, Facebook, or Twitter/X, specialized preview bots (e.g., facebookexternalhit/1.1, Twitterbot/1.0, Slackbot-LinkExpanding) fetch OpenGraph tags to render thumbnail cards.
4. SEO Audit Monitors: Services like Ahrefs (AhrefsBot) and Semrush (SemrushBot) crawl backlink structures and technical site health.
5. Developer CLI Utilities: Automation scripts written with curl, Wget, PostmanRuntime, or Python's python-requests announce their library name by default unless explicitly customized.

The Evolution of User-Agent Reduction and Client Hints

Historically, aggressive User-Agent parsing allowed advertising networks and malicious actors to fingerprint users across the web without cookies. By analyzing granular CPU models, exact OS patch builds, and micro-versions, trackers could generate a persistent digital fingerprint. To safeguard user privacy, browser vendors introduced two fundamental shifts:

1. User-Agent Reduction

Both Chromium and Apple Safari deliberately freeze or mask high-entropy User-Agent tokens:

• Frozen Minor Versions: Chrome freezes minor, build, and patch numbers to zeros (e.g., Chrome/124.0.0.0).
• macOS Platform Freeze: Chrome and Safari lock the reported macOS version to Mac OS X 10_15_7 regardless of whether the user is running macOS Big Sur, Monterey, Ventura, or Sonoma.
• Windows NT 10.0: Windows 11 deliberately identifies as Windows NT 10.0 in the User-Agent string to prevent breaking legacy enterprise software.

2. User-Agent Client Hints (UA-CH)

In place of passive string sniffing, modern web standards specify User-Agent Client Hints (defined in W3C and IETF drafts). Rather than sending all hardware facts upfront, the browser transmits lightweight, low-entropy headers by default (Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform). If a web server genuinely requires granular information—such as distinguishing Windows 11 from Windows 10 or inspecting ARM64 architecture—it must explicitly send an Accept-CH: Sec-CH-UA-Platform-Version, Sec-CH-UA-Model response header over a secure HTTPS connection.

Best Practices for Developers

When developing web applications, avoid relying solely on brittle User-Agent string matching. Follow these industry standards:

• Prioritize Feature Detection: Never check for a specific browser to determine API support. Use native JavaScript feature queries like if ('serviceWorker' in navigator) or CSS @supports (display: grid).
• Adopt Client Hints on the Server: For server-side rendering (SSR) and analytics, transition backend middleware from User-Agent string parsing libraries to structured Sec-CH-UA headers.
• Verify Bots via DNS: Anyone can spoof a User-Agent header using curl -A "Googlebot". Never grant administrative access or bypass rate limits based on the User-Agent string alone. Always perform a forward-confirmed reverse DNS lookup (FCrDNS) to verify genuine crawler IP addresses.

Frequently Asked Questions

Can a User-Agent string be forged or spoofed?

Yes. The HTTP User-Agent header is set entirely on the client side. Any command-line tool, browser extension, proxy, or bot script can transmit an arbitrary string. Consequently, User-Agent parsing should only ever be used for content optimization, layout formatting, and analytics—never as an authorization mechanism or security boundary.

Why does Google Chrome include "Safari" in its User-Agent string?

When Google launched Chrome in 2008, Safari had already popularized the WebKit rendering engine. Many websites were hardcoded to serve WebKit-optimized styles only if the word Safari was present in the request header. Chrome included both AppleWebKit and Safari so early web applications would not reject Chrome users.

How can I tell Windows 11 apart from Windows 10?

You cannot differentiate Windows 11 from Windows 10 using traditional User-Agent strings alone because both declare Windows NT 10.0. To detect Windows 11, you must use Client Hints: on the server, request Sec-CH-UA-Platform-Version (Windows 11 reports versions ≥ 13.0.0); on the client, call navigator.userAgentData.getHighEntropyValues(['platformVersion']).

Do third-party browsers on iOS use their own rendering engines?

Historically, Apple's iOS App Store Review Guidelines mandated that all third-party browsers (including Google Chrome, Firefox, and Microsoft Edge) use iOS WebKit rather than their native Blink or Gecko engines. While the European Union's Digital Markets Act (DMA) has created a path for alternative browser engines in specific regions, the vast majority of iOS web traffic continues to run on WebKit.

What does "like Gecko" mean in a User-Agent header?

The phrase (KHTML, like Gecko) was introduced by Apple in 2003 when developing Safari. At the time, web developers frequently targeted Mozilla's Gecko layout engine. Adding "like Gecko" signaled to server scripts that the browser supported equivalent DOM standards and CSS rendering capabilities.

Does this User-Agent parser log or transmit my browser information?

No. This tool operates entirely inside your local web browser session using client-side JavaScript. No network requests, cookies, tracking scripts, or server-side logging mechanisms are utilized. Any User-Agent string entered into or detected by this tool remains completely private on your local device.

Related Developer & Security Tools

Explore our companion utilities for network debugging, protocol verification, and marketing automation:

• Regex Tester & Explainer — Test and debug regular expressions with token explanations.
• Cron Expression Explainer — Translate complex 5-field cron schedules into plain English.
• HTTP Header Analyzer — Inspect security headers, caching directives, and server configurations.
• Robots.txt Generator — Build crawler directives and manage bot access for search engines and AI scrapers.
• Deliverability Risk Scanner — Audit outbound email formatting, technical records, and spam triggers.
• Free Web & Marketing Tools Hub — Access our complete suite of client-side developer and marketing utilities.