User-Agent String Parser

What Is a User-Agent String?

A user-agent string is an HTTP header browsers send with every request, identifying themselves to servers. It contains browser name, version, rendering engine, operating system, and sometimes device info. The format dates to early 1990s and is famously chaotic — modern user-agents include misleading historical tokens because some servers used them to deliver browser-specific content. A 2025 Chrome on Windows might say Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 — name-checking Mozilla, Apple WebKit, KHTML, Gecko, and Safari, even though it's only Chrome.

Why User-Agent Strings Are a Mess

Each token in a modern UA is a historical artifact:

• "Mozilla/5.0": originally Netscape 5.0 (never released). Every browser claims it because sites used to send modern HTML only to Mozilla-identified browsers.
• "AppleWebKit": Safari's engine. Chrome forked WebKit into Blink in 2013 but still claims AppleWebKit for compatibility.
• "KHTML, like Gecko": KDE's browser engine (predecessor of WebKit). The "like Gecko" part is for sites that checked for Mozilla's Gecko engine.
• "Chrome/...": the actual browser identifier. THIS is what matters.
• "Safari/...": appended because some sites required Safari to render correctly.

The result: parsing UA strings reliably requires regex matching against known browser fingerprints. UAParser.js and similar libraries maintain regularly-updated rules to extract real browser/OS info from this historical chaos.

User-Agent Use Cases (and Anti-Patterns)

• ✓ Analytics: classify visitors by browser / OS / device for reporting. Tolerable inaccuracy.
• ✓ Bug triage: a support ticket says "site broken" — UA tells you Safari 14 on iPhone 12, so you can reproduce.
• ✓ Bot detection: Googlebot, Bingbot, GPTBot, ClaudeBot all identify themselves in UA. Block bad bots, allow good ones.
• ✓ Marketing / SEO: distinguish search-engine crawlers from real users in logs.
• ✗ Feature gating: NEVER use UA to decide if a browser supports a feature. Use feature detection: if ('serviceWorker' in navigator) .... UA-based feature flags break when browsers change.
• ✗ Security decisions: UA is trivially spoofed. Curl --user-agent, browser dev tools, every scraper sends fake UAs. Never authenticate or authorize based on UA.
• ✗ Mobile / desktop UI switching: use CSS media queries / viewport size, not UA. UA can't tell "iPad in landscape" from "laptop with small browser window."
• ✗ Bot blocking based on UA only: attackers spoof; legitimate tools (curl, automation) get blocked. Pair UA with behavioral analysis.

Common Bots and Their User-Agents

Block AI training bots in robots.txt if you don't want your content used for LLM training: User-agent: GPTBot / Disallow: /.

Client Hints: The UA Replacement

Google's User-Agent Client Hints (UA-CH) is the modern replacement for parsing UA strings. Instead of a single long UA string, browsers send structured headers: Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, etc. These are explicitly intended to provide accurate browser metadata while reducing fingerprinting surface. Chrome started reducing UA detail in 2023 — the new structured hints are the long-term solution. For server-side parsing, support both the legacy UA string and the new Client Hints. For client-side, prefer feature detection.

UA Spoofing and Privacy

Any user can change their browser's user-agent string. Reasons people do it:

• Bypass mobile-only restrictions: get desktop UI on phone
• Test responsive design: browser dev tools include UA spoofing
• Privacy / anti-fingerprinting: Tor Browser deliberately uses a generic UA
• Scraping / automation: headless browsers may spoof to look like real users
• Compatibility: dodge UA-based site restrictions (e.g., "Chrome only" sites that work fine in Firefox)

Implications: don't rely on UA for security or feature decisions. Use it for analytics / triage only, where some inaccuracy is tolerable.