What is a User Agent?
What user agent strings are, how browsers identify themselves, and how to parse them in code.
What is a user agent?
A user agent is a string that a browser (or any HTTP client) sends with every request to identify itself to the server. It tells the server what browser, browser version, operating system, and device type is making the request.
Servers use this information to serve appropriate content — redirecting mobile users to a mobile-optimized version, logging browser statistics, or blocking known bots.
What a user agent string looks like
Chrome on Windows: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Safari on iPhone: Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1 Firefox on macOS: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0
Every browser starts with Mozilla/5.0 for historical compatibility reasons, even though most aren't Mozilla products. This is a quirk inherited from the browser wars of the 1990s.
Why user agents look so messy
The bizarre structure of modern user agent strings is a product of historical compatibility hacks:
- —Netscape was dominant in the 1990s, so sites checked for "Mozilla" to serve advanced features
- —Internet Explorer pretended to be "Mozilla/4.0 compatible" to get those features
- —Other browsers copied the pattern to avoid being served degraded content
- —The result: every browser claims to be Mozilla, Gecko, and WebKit simultaneously
Reading the user agent in code
JavaScript (browser)
navigator.userAgent // → "Mozilla/5.0 (Windows NT 10.0; Win64; x64)..."
JavaScript (Node.js / server)
const ua = req.headers['user-agent']
Python
# Flask
ua = request.headers.get('User-Agent')Frequently asked questions
- Can user agents be spoofed?
- Yes, trivially. Any HTTP client can send any user agent string — there is no verification. Developers and bots routinely spoof user agents to appear as a different browser or bypass bot detection. Never use the user agent for security-critical decisions.
- Should I use user agent detection for responsive design?
- No — use CSS media queries instead. User agent detection for layout decisions is fragile, prone to breaking as new devices appear, and harder to maintain. Reserve server-side user agent parsing for analytics and logging.
- What is the User-Agent Client Hints API?
- A newer, privacy-preserving alternative to user agent strings. Instead of sending a full UA string with every request, browsers send minimal hints and servers can request additional details if needed. Chrome started reducing UA string detail in 2021 as part of this transition. The full UA string will eventually be frozen.