Question 1

What is the HTTP User-Agent?

Accepted Answer

It is an HTTP header sent by the browser with every request, in the format: "BrowserName/Version (OS; Architecture) Compatibility/1.0 Engine/Version". The syntax is defined by RFC 7231 and was originally created so servers could adapt responses for different clients.

Question 2

Why do most browsers include 'Mozilla/5.0' in the UA?

Accepted Answer

For historical compatibility. When Netscape Navigator (Mozilla) was dominant, servers returned rich content only to UAs starting with Mozilla. Other browsers added this prefix to avoid being blocked, and the convention persists in virtually all modern browsers today.

Question 3

What is User-Agent Reduction?

Accepted Answer

It is a Google project to reduce the information exposed in Chrome's User-Agent, preserving only the major version, platform and device type (mobile/desktop). The goal is to reduce passive fingerprinting: the minor/build/patch version is frozen to zeros (e.g. Chrome/128.0.0.0), the Android device model becomes the generic placeholder "K" and the Android version shows up fixed at 10. The rollout started with Chrome 107 (2022) and finished with Chrome 116 (2023), when the reduced form became the only one sent by default.

Question 4

What are UA Client Hints?

Accepted Answer

User-Agent Client Hints (UA-CH) is an API meant to complement, and eventually replace, the traditional User-Agent: instead of exposing everything upfront, the server requests only the data it needs via the Accept-CH response header, and the browser replies with just that through request headers such as Sec-CH-UA, Sec-CH-UA-Platform and Sec-CH-UA-Mobile. In practice, only Chromium-based browsers (Chrome, Edge, Opera, Samsung Internet) implement UA-CH; Firefox and Safari have chosen not to adopt the API and keep reducing only the traditional User-Agent string.

Question 5

Is this parser reliable for production use?

Accepted Answer

This implementation covers the most common cases (Chrome, Firefox, Safari, Edge, Opera, Samsung Internet, iOS/Android) and is suitable for educational and diagnostic purposes. For production use, analytics, device-based redirects, use specialised libraries like ua-parser-js, bowser or your platform's server-side browser API.

Question 6

How do I identify whether a UA belongs to a bot?

Accepted Answer

Bots typically include identifying terms in the UA: bot, crawler, spider, scraper, and specific names like Googlebot, Bingbot, AhrefsBot, SemrushBot, curl, wget, python-requests, etc. This parser detects those patterns with a conservative regex.

Question 7

Why doesn't Safari expose the exact version?

Accepted Answer

Since Safari 11.1 (iOS 11.3 / macOS 10.13.4, in 2018), Apple always reports the engine as AppleWebKit/605.1.15 in the User-Agent, regardless of the actual engine version. More recently, starting with iOS 26 (2025), Apple went further and froze the OS version too: the UA always shows something like "CPU iPhone OS 18_6", even on newer iOS releases; on macOS this has been true for years, with the UA always reporting "Mac OS X 10_15_7". On iPads with iPadOS, the UA resembles macOS Safari to avoid content discrimination. The real Safari version still appears in the Version/ token, which is what this parser uses to identify the browser version.

Question 8

Can a User-Agent be faked?

Accepted Answer

Yes. The User-Agent is just an HTTP string, any client can send any value. Tools like curl, Postman, DevTools and browser extensions make it trivial to change the UA. Brave itself does something similar by default: it identifies as Chrome in the User-Agent to reduce fingerprinting, and can only be told apart via Client Hints (the "Brave" brand shows up in sec-ch-ua) or the navigator.brave API, never from the plain User-Agent string. Therefore, never use the UA alone as a security mechanism or access control; use it only for content adaptation and analytics.

User Agent Parser