User-Agent String Parser

User-Agent String Parser

A User-Agent (UA) string is a line of free-form text a browser sends with every HTTP request (the "User-Agent" header), originally meant for content negotiation — so a server could, in principle, serve a different page to Netscape than to a text-only browser. Decades of browsers each cramming in extra compatibility tokens turned the format into a historical curiosity: a UA string is a sequence of "product/version" tokens and parenthesized comments, not a clean structured format, and reading one by eye is genuinely confusing — a typical Chrome UA claims to be "Mozilla" first, mentions "AppleWebKit" and "KHTML, like Gecko" in the middle, and only says "Chrome" near the end.

That layering exists entirely for backward compatibility: sites that once checked for the token "Mozilla" (Netscape's old engine) or "Gecko" would otherwise misidentify newer browsers, so every subsequent browser engine kept including its predecessors' tokens rather than replacing them. This tool's parser therefore checks the MOST SPECIFIC token first — Edge before Chrome, Opera before Chrome, Chrome-on-iOS ("CriOS") before generic Safari — since Edge, Opera, Samsung Internet and Brave all legitimately contain both "Chrome" and "Safari" tokens for exactly this compatibility reason. Getting the check order wrong is the single most common bug in a hand-rolled UA parser.

More recently, browsers have started deliberately reducing or freezing the information in their UA string for privacy reasons — Chrome's "User-Agent Reduction" initiative, for example, no longer reveals the exact minor OS version by default, replacing it with a generic placeholder, and steers new integrations toward the opt-in User-Agent Client Hints API instead of the freeform string. That means even a completely honest, unmodified browser may report a deliberately vaguer UA today than the same browser did a few years ago — this parser reports exactly what the string says, not what a more detailed API might reveal if the site asked for it.

The most important thing to understand about a User-Agent string, honest or reduced, is that it's entirely self-reported: nothing stops a browser extension, a command-line tool like curl, a script using an HTTP library, or a manually edited devtools override from sending any string at all, true or not. A UA string is genuinely useful for analytics, responsive-design decisions, and picking sensible defaults — it is never proof of who or what is making a request, and must never be trusted as a security control (blocking or allowing something based on it, or treating it as reliable bot detection). Server-side signals that can't be freely overridden by the client are the right tool for anything security-sensitive.

Glossary

User-Agent string

A free-form line of text sent with every HTTP request identifying (in principle) the requesting browser, engine, OS and device.

Product token

A "Name/Version" segment inside a UA string (e.g. "Chrome/120.0.0.0") — a UA string is a sequence of these plus parenthesized comments, not a structured format.

Rendering engine

The underlying software that lays out and renders a page — Blink (Chrome and most Chromium-based browsers), Gecko (Firefox), or WebKit (Safari) — distinct from the browser's own brand name.

User-Agent Client Hints

A newer, opt-in API (separate HTTP headers a server must explicitly request) that some browsers are steering integrations toward, as they reduce the detail in the classic UA string.

Spoofing

Sending a UA string that doesn't match the actual client — trivial to do via devtools, curl, or a browser extension, which is exactly why a UA string is never a security signal.

Device type

This tool's coarse classification (desktop, mobile, tablet, or bot/crawler) inferred from tokens like "Mobi", "iPad" or known crawler names in the UA string.

API equivalent

This tool has no API equivalent in our service today — we don't expose a dedicated User-Agent-parsing endpoint, so there's nothing for our API to return here. The parsing above runs entirely on your device; nothing is ever sent anywhere. If you're looking for our IP-lookup API instead, it covers geolocation, ASN/network and threat/fraud data for an IP address:

Read the full API docs

Related tools

• All developer tools
• JWT Decoder
• Base64 Encoder / Decoder

Frequently asked questions

What is a User-Agent string?

A free-form line of text a browser sends with every HTTP request, in principle identifying the browser, its rendering engine, the operating system and the device type.

Can I trust the browser/OS this tool reports?

Only as a best-effort guess. Any client can send any User-Agent string it wants — this result is never proof of identity and must never be used as a security control.

Why do many User-Agent strings contain "Mozilla/5.0"?

Pure historical compatibility — decades ago, sites checked for that token to detect a "modern" browser, and every browser since has kept it rather than risk being misidentified as something older.

Is my User-Agent string sent to a server?

No — parsing happens entirely in your browser's JavaScript. This page makes no network request to parse a string, including when you use the "Use my own User-Agent" button.

Why did the parser return "Unknown" for some fields?

The string didn't match any of the known patterns this tool checks for — it may be a spoofed, obscure, or genuinely new browser/OS whose UA format this parser hasn't seen. This is an honest "don't know," not a crash.

Should a website use the User-Agent header for security decisions?

No — it's trivial to override from devtools, curl, or a browser extension. It's fine for analytics or picking a responsive-design default, but never as an access-control or bot-detection signal on its own.