User Agent Parser

Why User-Agent strings look absurd

A modern Chrome UA string claims to be Mozilla, Safari and Chrome simultaneously. This is the residue of decades of compatibility workarounds. Sites in the 1990s served better markup to Netscape, identified as Mozilla, so competitors began claiming to be Mozilla too. Later, sites detected Safari's WebKit to enable features, so Chrome added Safari to its string. Nothing was ever removed, because removing a token broke sites that sniffed for it. The result is a string that is largely archaeology.

The string is unreliable by design

Google has been actively reducing the information in User-Agent strings. Chrome now freezes the browser minor version and reports a reduced, sometimes deliberately inaccurate, platform version. Firefox and Safari do similar things to limit fingerprinting. iPadOS reports itself as macOS by default. Privacy tools and many browsers let users spoof the string entirely. Any parser, including this one, is therefore making an educated guess from a string that may be intentionally misleading.

Do not use it for feature detection

This is the important practical point. Detecting a browser and then assuming which features it supports has been wrong for twenty years and is worse now. Test for the capability directly: check whether the property, method or API exists, or use CSS @supports. Feature detection is correct on browsers that did not exist when you wrote the code; UA sniffing is not.

Client hints are the replacement

User-Agent Client Hints expose the same information as structured, individually-requestable headers such as Sec-CH-UA and Sec-CH-UA-Platform. High-entropy values like the full platform version must be explicitly requested, which limits passive fingerprinting. If you genuinely need device or platform information server-side, client hints are the current mechanism.

Where UA parsing is still legitimate

Analytics and log analysis, where approximate aggregate figures are fine. Bot identification, though a UA claiming to be Googlebot must be verified by reverse DNS before it is trusted. Debugging a specific reported problem. Serving a download link for the right platform, with a visible way to choose another.