User Agent Parser — Complete Guide

Published August 2026 · 6 min read

What Is a User Agent String?

A user agent (UA) string is a short text header that your browser sends to every web server with each request. It identifies the browser, its version, the operating system, and often the device type. Think of it as the digital ID card your browser flashes every time it loads a page — servers read it to tailor what they send back.

A typical desktop Chrome UA looks like this:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Anatomy of a User Agent String

That long string is not random — every token has a job:

Mobile UAs add more clues: Mobile, Android, or iPhone tokens let you distinguish a phone from a desktop without any other signal.

Common User Agent Examples

Recognizing UAs by sight gets easier with practice. Here are a few recognizable patterns:

Notice the pattern: the platform sits in parentheses, the engine follows, and the browser identity comes last. Spoofed UAs are usually easy to spot because the pieces don't match — a "Chrome" UA claiming a version that doesn't exist, for example.

Why Parsing User Agents Matters

Server-side UA parsing powers three common features:

Note the word "first" — UA strings are hints, not proof. They are trivially spoofable with a single browser extension or curl -A, so never use them alone for security decisions.

Parsing User Agents in Code

You can read your own UA in any browser console right now:

// Browser: read your own UA
const ua = navigator.userAgent;
console.log(ua);

// Quick checks with regex
const isChrome  = /Chrome\/\d+/.test(ua) && !/Edg\//.test(ua);
const isFirefox = /Firefox\/\d+/.test(ua);
const isMobile  = /Mobi|Android/i.test(ua);

On the server (Node.js), the UA arrives in the request headers:

const http = require('http');
http.createServer((req, res) => {
  console.log(req.headers['user-agent']);
  res.end('UA logged');
}).listen(3000);

For production parsing, don't hand-roll regexes — use a maintained library like ua-parser-js (JavaScript) or user-agents (Python). They handle edge cases, new browser versions, and the constant format drift that breaks naive patterns.

Limitations and Privacy

UA parsing has real limits. Strings are spoofable, browsers change format over time (Chrome 110+ sends a reduced UA by default), and some privacy browsers randomize them entirely. Insecure parsers that blindly trust the string are a classic source of analytics garbage — one malformed UA can pollute your dashboards.

There's also a privacy angle: combined with other headers, a UA contributes to browser fingerprinting, letting sites identify users without cookies. Modern browsers have started trimming UA detail and moving to the structured User-Agent Client Hints API, which lets sites request specific fields instead of receiving everything.

Try It Live

Paste any UA string into our free User Agent Parser to instantly see the browser, version, OS, and device — or grab your own browser's UA with one click. No sign-up, no data stored.

FAQ

Why do all user agents start with "Mozilla/5.0"?

It's a compatibility relic from the 1990s browser wars. Sites served modern pages only to Netscape (codenamed Mozilla), so other browsers added the prefix to avoid being served basic HTML — and it stuck.

Can a user agent string be faked?

Yes, trivially. Any HTTP client can send a custom User-Agent header — curl -A "Googlebot" is all it takes. Treat UA-based bot detection as a filter, never as a security boundary.

Is a mobile UA different from a desktop one?

Usually. Mobile UAs contain tokens like Mobile, Android, or iPhone, and may report a different WebKit version. Parsing those tokens is how sites decide which layout or download link to serve.

💜 Free tools. Help keep them free.

☕ Buy Me a Coffee