Utility

User Agent Parser

Parse a User-Agent string into browser, engine, operating system and device. Explains why UA strings are unreliable and what to use instead.

Last reviewed by the Radiatus Cloud team

Your browser is sending
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)

Need this done properly for your business?

Radiatus delivers secure cloud, DevOps & compliance engineering.

Book a free consult

Why User-Agent strings look absurd

A modern Chrome UA string claims to be Mozilla, Safari and Chrome simultaneously. This is the residue of decades of compatibility workarounds. Sites in the 1990s served better markup to Netscape, identified as Mozilla, so competitors began claiming to be Mozilla too. Later, sites detected Safari's WebKit to enable features, so Chrome added Safari to its string. Nothing was ever removed, because removing a token broke sites that sniffed for it. The result is a string that is largely archaeology.

The string is unreliable by design

Google has been actively reducing the information in User-Agent strings. Chrome now freezes the browser minor version and reports a reduced, sometimes deliberately inaccurate, platform version. Firefox and Safari do similar things to limit fingerprinting. iPadOS reports itself as macOS by default. Privacy tools and many browsers let users spoof the string entirely. Any parser, including this one, is therefore making an educated guess from a string that may be intentionally misleading.

Do not use it for feature detection

This is the important practical point. Detecting a browser and then assuming which features it supports has been wrong for twenty years and is worse now. Test for the capability directly: check whether the property, method or API exists, or use CSS @supports. Feature detection is correct on browsers that did not exist when you wrote the code; UA sniffing is not.

Client hints are the replacement

User-Agent Client Hints expose the same information as structured, individually-requestable headers such as Sec-CH-UA and Sec-CH-UA-Platform. High-entropy values like the full platform version must be explicitly requested, which limits passive fingerprinting. If you genuinely need device or platform information server-side, client hints are the current mechanism.

Where UA parsing is still legitimate

Analytics and log analysis, where approximate aggregate figures are fine. Bot identification, though a UA claiming to be Googlebot must be verified by reverse DNS before it is trusted. Debugging a specific reported problem. Serving a download link for the right platform, with a visible way to choose another.

Related tools

  • QR Code Generator — Generate QR codes for URLs, text, Wi-Fi and contact details. Adjustable error correction and size, produced entirely in your browser.
  • Credit Card Validator — Validate a card number with the Luhn algorithm and identify the issuing network from its prefix. Runs locally, nothing is transmitted.
  • Text Case Converter — Convert text between camelCase, PascalCase, snake_case, kebab-case, CONSTANT_CASE, Title Case and sentence case. Runs entirely in your browser.
  • Word & Character Counter — Count words, characters with and without spaces, sentences and paragraphs, with estimated reading time. Runs entirely in your browser.

Frequently Asked Questions

Why does Chrome claim to be Mozilla and Safari?

Historical compatibility. Sites served better content to Netscape, identified as Mozilla, so other browsers claimed it too. Later, sites detected Safari's WebKit, so Chrome added that as well. Tokens were never removed because removing one broke sites that sniffed for it.

Can I trust the User-Agent string?

Not for anything important. Browsers deliberately freeze or reduce parts of it to limit fingerprinting, iPadOS reports as macOS, and users can spoof it entirely. Treat parsed output as a best guess, useful in aggregate and unreliable per-request.

Should I use UA detection for features?

No. Test for the capability directly by checking whether the API exists, or use CSS @supports. Feature detection works correctly on browsers that did not exist when the code was written; UA sniffing does not.

What are User-Agent Client Hints?

Structured headers such as Sec-CH-UA and Sec-CH-UA-Platform that expose the same information in a requestable form. High-entropy values must be explicitly asked for, which limits passive fingerprinting. They are the modern replacement for parsing the UA string.

How do I verify a crawler claiming to be Googlebot?

By reverse DNS. Look up the connecting IP, confirm the hostname ends in googlebot.com or google.com, then forward-resolve that hostname and check it matches the original IP. The UA string alone is trivially forged.

Privacy & Security

Parsed locally in browser.

Data: None
Client-side-Side
Active
v1.0

About This Tool

This tool runs entirely in your browser. No data is sent to any server, ensuring complete privacy. Simply use the interface above to get started — no registration or login required.

Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.