User Agent Guide
Every request your browser makes carries a User-Agent header — a single line of text that tells the server who you are. Here it is, live, on your own browser, with every token explained.
A user agent is a line of text your browser sends with every HTTP request. It tells the server which browser and version you use, which rendering engine powers it, and which operating system and device you are on. It's the ID card the web has used since 1993.
In 1993, NCSA Mosaic sent NCSA_Mosaic/2.0 . When Netscape launched, it wanted advanced features, so it used Mozilla/1.0 . Servers began gating rich HTML behind a "Mozilla" check.
When Internet Explorer arrived it pretended to be Mozilla so it wouldn't be locked out. Safari copied the trick to unlock content built for IE. Chrome copied Safari because it uses a WebKit-derived engine. Edge and Opera today identify as Chrome for the same reason. Every layer of that history is still visible in your UA above — the greyed-out tokens are what we call "legacy tokens" : historical artifacts servers still sniff for.
Every browser follows the same rough grammar — Mozilla/5.0 (platform) engine browser — but the pieces differ. This is the actual output each ships in 2026:
Note how the mobile Safari and Android Chrome rows carry Mobile , and how Googlebot skips the whole engine dance because it doesn't need to lie about being a browser.
Chrome, Edge, and Opera are gradually retiring the detailed UA in favor of User-Agent Client Hints — structured HTTP headers a server explicitly asks for. Instead of one messy string, the browser sends:
You can see the full set of headers your browser is sending right now on our HTTP headers checker .
Bottom line: swapping the UA is trivial, but the modern web has many more signals — Client Hints, TLS handshake fingerprints (JA3/JA4), canvas rendering, WebGL vendor strings. A serious fingerprinter compares the UA claim against those signals and flags the mismatches. See our fingerprint check to measure how much your setup actually reveals.
No — millions of people share the exact same UA. It's a device class, not an identity.
No — screen size, timezone, fonts, TLS handshake, and dozens of JS APIs are still identifying you. A spoofed UA that contradicts them makes you more conspicuous, not less.
Feature detection (checking whether an API exists) has been recommended since ~2010, but UA sniffing is still widespread — especially for iOS/Android split logic and analytics.
Only in Chromium browsers, and only slowly. Firefox and Safari haven't shipped Client Hints, so servers will read the classic UA for years yet.
A typical Chrome-on-Windows user agent is: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36. It bundles a legacy 'Mozilla' token, the platform in parentheses, the rendering engine, and the actual browser and version.
Historical compatibility. In the 1990s many sites only served advanced HTML to browsers whose UA contained 'Mozilla'. Every browser that came after copied the token so those old sites wouldn't block them. Every mainstream browser today still starts with 'Mozilla/5.0'.
Chrome uses the Blink engine, which was forked from Apple's WebKit. When Chrome launched, sites already sniffed for 'Safari' to enable WebKit features, so Chrome kept the token to inherit that behavior. Edge and Opera do the same because they are Chromium-based.
Yes. Chrome and Edge DevTools have a Network Conditions panel that overrides the UA per tab. Firefox exposes general.useragent.override in about:config. Extensions like User-Agent Switcher change it globally. It won't hide you though — servers can cross-check the UA against Client Hints and JS-detected features and flag mismatches.
On its own, no — millions of people share the exact same UA string. But combined with screen size, timezone, installed fonts, and canvas rendering, it typically contributes 5–10 bits of entropy to a browser fingerprint. See our browser fingerprint check to measure how identifiable your setup actually is.
Client Hints replace the monolithic UA string with structured, opt-in HTTP headers like Sec-CH-UA (browser brand), Sec-CH-UA-Platform (OS), and Sec-CH-UA-Mobile. Sites request only the fields they need, and by default Chrome sends a reduced UA. This is the direction the web is moving in.
Yes. Googlebot, Bingbot, and other legitimate crawlers advertise themselves clearly (for example 'Googlebot/2.1'). Malicious scrapers often copy popular browser UAs to blend in, which is why UA alone is a weak bot-detection signal.
'Request desktop site' in Chrome, Safari, and Firefox swaps the mobile UA for a desktop one so the server returns the desktop layout. Everything else (real screen size, touch support, DPR) still gives you away as a phone.