What is a user agent, and what does yours say about you?

In web terms, a user agent is any program that fetches pages on a person's behalf: a browser, an app's built-in web view, a search engine crawler, a command-line tool like curl. The user agent string is the self-description that program sends in the User-Agent HTTP header with every request, and that it exposes to page scripts as navigator.userAgent. The two are normally identical.

Servers were meant to use it to send content a given client could handle. In the 1990s that meant checking for frames support; today it mostly means logging, analytics, blocking known bots, and occasionally serving a different layout to phones. It has never been authenticated. Anything can claim to be anything, which is why so much of the string is historical fiction.

The what is my user agent page shows the exact string your browser sent, decoded into browser, version, engine, operating system and device type. It reads the string twice, once from the header the server received and once from navigator.userAgent in the page, and flags any difference, which usually means a proxy, an extension or a privacy setting is rewriting one of them. You can also paste any user agent from a log file to decode it.

Take the string a current Chrome on Windows sends (the major version will be whatever you are running):

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36

Other browsers follow the same pattern of frozen tokens plus one real version:

• Firefox on Windows: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0. Gecko/20100101 is a fixed date; rv: and Firefox/ carry the version. On a Mac, Firefox reports macOS as 10.15 no matter which version is installed, and Apple silicon Macs report as Intel.
• Safari on a Mac: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15. The macOS token has been frozen at 10_15_7 for years; only Version/ moves.
• Safari on iPhone: Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1. Safari 26 reports the iOS token as 18_6 on iOS 26 devices, an intentional freeze; the Safari version is the honest part. iPads have reported as Macintosh since iPadOS 13.
• Chrome on Android: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36. Since Chrome 110 every Android phone claims to be a model called K running Android 10. The Mobile token is what distinguishes a phone from a tablet.

Because the string had become both useless (frozen) and privacy-sensitive (a few sites still extracted device models and exact OS builds), Chromium browsers replaced it with User-Agent Client Hints. By default a site now receives three small headers: Sec-CH-UA (browser brands with major versions), Sec-CH-UA-Mobile (phone or not) and Sec-CH-UA-Platform (operating system name). Everything with more detail, such as the full browser version, the platform version, the CPU architecture and the device model, is a high-entropy hint that the server must request with an Accept-CH response header, and the browser may decline.

The practical effect: a website can still tell Chrome 140 on Android from Safari on an iPhone, but it has to ask explicitly for a Pixel 9 versus a Galaxy S25, and that request is visible. Firefox and Safari have not adopted Client Hints; they rely on their own frozen strings instead. The user agent page shows the hints your browser sends and the high-entropy values it is willing to reveal.

Legitimate uses are mundane: analytics dashboards (what share of visitors use Safari), serving a mobile layout before CSS media queries existed, blocking or allowing crawlers, and warning users on browsers too old to run the site. The string is also one of the first things a fraud or bot-detection system looks at, because automated tools either forget to set it or set it badly.

Changing it (spoofing) is easy. Desktop browsers include a device-emulation mode in their developer tools; extensions switch strings per site; Safari's Request Desktop Website and Chrome's Desktop site checkbox on Android do it with one tap. Reasons people do it:

• Getting a desktop layout on a phone, or a lighter mobile layout on a desktop.
• Testing how a site behaves for other browsers.
• Working around a badly written compatibility check that blocks a perfectly capable browser.
• Making a scraper look like a person. This is the use that gets user agents blocked, and it rarely works on its own.

What spoofing does not do is hide you. The user agent is one of dozens of signals a page can read, and a Chrome string paired with Safari-only rendering quirks is more conspicuous than the real thing.

Your user agent is one line of a much longer description. Screen size, installed fonts, GPU model, time zone, language list, audio and canvas rendering quirks and dozens more properties combine into a browser fingerprint that can recognize a browser across sites without cookies. Freezing the user agent removed a few bits of that identifying information; it did not remove the rest. The browser fingerprint test shows how much your setup still reveals, and the what websites can see page puts the user agent next to everything else a site learns on the first request, starting with your IP address from the homepage.