{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

Source{{ sourceModeBadge }} Device{{ resultsReady ? deviceLabel : '—' }} Client{{ resultsReady ? botLabel : '—' }}

{{ summaryAnnouncement }}

User-Agent source and review controls
One value is parsed at a time. Auto mode reports whether it resolved a raw string or header block.
{{ sourceWarning || 'Parsing updates locally as the source and review controls change.' }}
{{ sourceResolutionHelp }}
{{ focusHelp }}
Use Broad for log triage; use Strict when reducing false positives matters most.
This display refinement does not change token matching or bot classification.
{{ tableExportStatus.profile }}
FieldValueEvidenceCopy
{{ row.field }}{{ row.value }}{{ row.evidence }}
{{ chartExportStatus }}

The chart renderer is unavailable. Exact token categories remain available in UA Token Map.

{{ tableExportStatus.tokens }}
PositionTokenTypeMeaningCopy
{{ row.position }}{{ row.token }}{{ row.type }}{{ row.meaning }}
{{ tableExportStatus.signals }}
SignalStatusEvidenceActionCopy
{{ row.signal }}{{ row.status }}{{ row.evidence }}{{ row.action }}
{{ tableExportStatus.hints }}
CheckStatusEvidenceCopy
{{ row.check }}{{ row.status }}{{ row.evidence }}
{{ tableExportStatus.guidance }}
UseRecommendationCopy
{{ row.use }}{{ row.recommendation }}

Introduction:

An HTTP request often carries a User-Agent field that names the software making the request. Browsers usually send a long string of product names, versions, platform comments, and compatibility tokens. Command-line clients, monitoring systems, preview services, and crawlers may send shorter identifiers. Servers use these clues for support, analytics, response tailoring, and traffic review.

The string is a claim made by the client, not a measurement taken by the server. A browser may reduce version or device detail for privacy, an automated client may copy a browser-looking value, and several modern browsers retain historical tokens for compatibility. Parsing can organize the evidence, but it cannot prove who sent the request or which hardware was used.

Useful User-Agent clues and their limits
Situation Useful clue What still needs checking
Support Browser family, engine, operating system, and version clues. Reproduce the issue and confirm the current browser when exact versions matter.
Analytics Broad browser, platform, device-class, and automation groupings. Reduced strings and unknown fields can make narrow segments unreliable.
Crawler review Named bot, preview, monitoring, or HTTP-client tokens. Verify network origin and behavior before allowing or blocking traffic.

Product tokens usually follow a name and optional version pattern, while parentheses contain comments about platform or compatibility. Their order and overlap matter. For example, a Chromium-based browser can contain Mozilla, AppleWebKit, Chrome, Safari, and its own browser token in one value. Reading the first familiar name as the answer is a common source of misclassification.

Client Hints can supply structured browser and platform clues when a browser exposes them, but they describe the browser making the current page request. They do not validate an unrelated string copied from a log or support ticket. Feature detection remains the safer basis for deciding whether a browser can use a web capability.

Treat a parsed profile as a compact evidence summary. It is useful for narrowing a support case, cleaning traffic categories, or deciding what to verify next. It is not suitable by itself for authentication, fraud decisions, crawler identity, or security policy.

How to Use This Tool:

Start with one raw value or one small request-header block, then choose the review settings that match the decision you need to make.

  1. Paste the value into User-agent source. Leave Mode on Auto detect for ordinary use, or pin raw-string or header-block mode when the source format is known.
  2. Choose Support, Analytics, or Bot review. This changes the final recommendations without changing the parsed browser, operating system, device, or token evidence.
  3. Select the Bot detection sensitivity. Strict recognizes named crawlers, Balanced also uses generic crawler and preview wording, and Broad adds common automation clients and HTTP libraries.
  4. Review Profile Snapshot first, then use UA Token Map or Bot & Compatibility when a field looks surprising. A missing User-Agent header in pinned header mode must be corrected before results appear.

Interpreting Results:

The parsed browser, operating system, engine, and device class are the best token matches available in the supplied string. Unknown means the expected token was absent or unsupported, not that the client has no browser, operating system, or device.

  • Browser/unknown means no selected bot rule matched. It does not prove a human browser sent the request.
  • Crawler or Automation identifies matching wording. Confirm important identities with source IP, forward-confirmed reverse DNS where the publisher recommends it, request cadence, and behavior.
  • Compare Client Hints only when Hint scope says Current browser. Hints from the page session do not belong to a pasted or sample User-Agent.

Technical Details:

RFC 9110 defines User-Agent as one or more product identifiers followed by optional comments. In real browser traffic, compatibility conventions make the sequence more complicated than a simple product list. Reliable triage therefore resolves the input shape first, matches specific product tokens before generic ones, and keeps the original token evidence beside every inferred label.

Transformation Core

The parser follows a deterministic sequence. The same source and settings produce the same profile and token categories.

User-Agent parsing transformation
Stage Rule Result
Resolve source Header mode requires a User-Agent: line. Auto mode uses that line when present; otherwise it reads the first non-empty line. One raw User-Agent value plus a source-shape note.
Match profile More specific browser families are checked before overlapping generic families. Platform, engine, device, model, and CPU clues are matched separately. Profile fields retain Unknown when no supported token matches.
Classify client Named crawler rules run first, followed by sensitivity-dependent generic and automation rules. Browser/unknown, Crawler, or Automation.
Build token map Whitespace-delimited products and parenthesized comment blocks are split and classified. Comment contents are also split on semicolons. Up to 80 ordered token rows grouped by type.
Compare hints Structured brand, platform, and mobile hints are compared only against the current page browser when its User-Agent exactly matches the parsed value. A scope warning prevents cross-session comparisons.

Rule Core

Bot sensitivity changes which token families can produce a match. The first matching rule supplies the label, while all matching rule names remain available as evidence.

Bot detection sensitivity rules
Sensitivity Included evidence Main tradeoff
Strict Named search, AI, social-preview, chat-preview, SEO, and performance clients. Fewer false positives, but unnamed automation remains unflagged.
Balanced Strict rules plus generic crawler, spider, preview, scanner, and monitoring terms. Broader triage with some ambiguous keyword matches.
Broad Balanced rules plus common command-line clients, HTTP libraries, API clients, and headless Chrome. Useful for log review, but automation is not the same as a malicious bot.

Version detail affects display only. Major-version mode shortens recognized browser, operating-system, and engine versions after matching; it does not alter the raw string, token map, or bot classification. Input is limited to 32,768 characters, and only one value is parsed at a time. In raw mode, later non-empty lines are ignored and reported.

Privacy and Accuracy Notes:

The supplied string is parsed in the current browser and is not transmitted for parsing. Client Hints, when available, come from the current browser session. User-Agent values can contain software, platform, and device clues that may be sensitive when combined with IP addresses, timestamps, account data, or other log fields.

  • Do not treat a token match as identity proof or an authorization signal.
  • Browser reduction, compatibility tokens, extensions, managed policies, and deliberate spoofing can make fields incomplete or misleading.
  • Use feature tests for web capability and publisher-documented network checks for important crawler claims.

Worked Examples:

Header block from an API log

A three-line block containing User-Agent: curl/8.5.0 resolves as an HTTP header block in Auto mode. Broad bot detection labels it as automation, while the profile remains unknown because the string carries no supported browser or operating-system token. The useful follow-up is to review source network and request behavior, not to assume the request is a browser or a crawler.

Current browser cross-check

Using the current browser's User-Agent allows the Client Hint Check to compare structured brands, platform, and mobile status with the parsed string. If a pasted ticket value is used instead, the hint scope reports that the hints belong to the page browser and should not be used to validate the ticket.

References: