User Agent Parser

It is a header your browser sends with every request, identifying itself so a server can adapt what it returns. In practice it is a compatibility artifact: decades of sites sniffing for particular browsers pushed every vendor into copying everyone else's tokens, which is why a modern Chrome string still names Mozilla, KHTML and Safari. The parts that still carry information are the platform token and the browser name and version at the end.

They are a set of request headers, the Sec-CH-UA family, that carry the same facts as structured fields instead of one long string. A small low-entropy subset — brands, mobile flag, platform — is sent automatically, and the detailed values such as platform version, architecture and model are sent only if a site explicitly asks for them. The goal was to stop every visitor broadcasting a full hardware and OS profile to every site by default, and to make the requests for detail visible rather than implicit.

No, and on its own it usually makes you easier to pick out. The string is one of many things a page reads, and the rest do not move with it: Client Hints still report the real platform, the WebGL renderer still names a GPU and a graphics backend that imply an operating system, the installed fonts still belong to the real one, and the timezone stays put. A Windows string surrounded by macOS evidence is not anonymity, it is a contradiction — and contradictions are what detection systems score.

It is Chromium's ongoing effort to freeze and trim the string so it stops being a fingerprinting surface. Minor version numbers are reported as zeros, the macOS version is capped at 10_15_7, Windows NT stays at 10.0, and the Android device model is replaced with a generic value. The consequence for anyone parsing it is that a precise-looking version in a modern string may not be precise at all — the accurate figures moved into the high-entropy Client Hints, where a site has to ask for them.

History. Early sites gated features on the browser name, so each new browser added the tokens of the ones already supported, and none of them could ever be removed without breaking somebody's detection code. The practical effect is that the leading tokens carry no information at all — and that a string tidied up to remove them stands out, because no shipping browser sends a clean one.

All of the overlapping ones, because they come from the same build. The platform token has to agree with Sec-CH-UA-Platform, the device class with the mobile flag, and the brand list has to include the browser the string names with the same major version. If high-entropy hints are supplied, platform version, architecture, bitness, model and the full version list have to describe the same machine and the same build. There is no legitimate configuration in which a browser disagrees with itself about what it is.

It can read this browser's own string to prefill the box, and that is it. Parsing, hint generation and the comparison all happen on this page, nothing is uploaded and no result is stored. Worth remembering, though, that every site you visit already receives your user agent in the request itself — that is how HTTP works, and no tool can withhold it for you.