The User-Agent is an HTTP header field that accompanies every request to the server. Its original purpose: allow servers to adapt responses based on client capabilities. For example, send HTML5 to modern Chrome but a simplified version to Internet Explorer 6.
A typical User-Agent looks like: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36. That string encodes the OS (Windows 10 64-bit), rendering engine (AppleWebKit) and browser (Chrome 120).
The problem: that same header became a fingerprinting tool, enabling user tracking without cookies. Analytics sites and ad platforms combine it with other data (screen resolution, timezone, installed plugins) to create a unique profile.
When your browser makes an HTTP request, it automatically includes the User-Agent header. The server reads it and can:
- Serve optimized content: server-side responsive design, polyfills only for old browsers.
- Block bots: reject requests with known scraper User-Agents (though sophisticated bots spoof them).
- Collect statistics: Google Analytics uses User-Agent to report which browsers visit your site.
- Apply business rules: banks and fintechs block outdated browsers for security.
The format isn't strictly standardized. For historical reasons (the "browser wars"), everyone lies a bit: Chrome claims to be Safari, Safari claims to be Mozilla, Edge claims to be Chrome. This happened because sites blocked unrecognized browsers, forcing new ones to lie for compatibility.
Today libraries like ua-parser-js (JavaScript) or user_agents (Python) parse these strings and extract structured data: browser family, version, OS, whether mobile or desktop.
Use for:
- Supplementary feature detection: if you've already done client-side detection and need server confirmation.
- Logs and analytics: understanding which browsers your users run helps prioritize testing.
- Intelligent rate limiting: apply stricter limits to identified bots.
Don't use for:
- Critical rendering decisions: prefer feature detection with JavaScript (
'fetch' in window) instead of inferring capabilities from User-Agent. - Security: never trust User-Agent for authentication or authorization. It's trivial to spoof.
- Blocking legitimate users: many privacy-conscious users run extensions that randomize or modify User-Agent.
The modern trend (User-Agent Client Hints, part of HTTP/2 standard) seeks to replace the monolithic User-Agent with granular headers the server explicitly requests, improving privacy.
Since 2021, Chrome, Edge and other Chromium browsers progressively froze User-Agent to reduce fingerprinting. Now they all report generic versions: Chrome/110.0.0.0 instead of the exact build.
Safari went further: since iOS 13, all iPhones report the same User-Agent regardless of model. Firefox is evaluating similar measures.
If your app needs detailed client information, the recommendation is migrating to User-Agent Client Hints: headers like Sec-CH-UA-Platform, Sec-CH-UA-Mobile that the server explicitly requests via the Accept-CH header. This gives control to users: browsers can deny those hints in incognito mode or with strict privacy settings.
Examples
Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36curl/7.68.0Googlebot/2.1 (+http://www.google.com/bot.html)Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/121.0
FAQ
Can I spoof my User-Agent?
Yes. Extensions like User-Agent Switcher or tools like curl let you send any User-Agent. Servers can't verify authenticity, which is why it should never be used for security.
Why do all User-Agents say Mozilla?
Historical compatibility. In the 90s, sites rejected browsers that weren't Netscape (Mozilla). When IE, Opera and Chrome appeared, they all lied claiming to be Mozilla to avoid blocks. The practice persists for legacy reasons.
What are User-Agent Client Hints?
A modern standard replacing the monolithic User-Agent with granular headers the server explicitly requests. It improves privacy by giving users control over what information to share and reduces fingerprinting surface.