1. [Home](https://www.toolcomb.com/) 2. [Security Tools](https://www.toolcomb.com/security-tools) 3. User-Agent Parser # User-Agent Parser - Browser, OS & Device From UA String Parse User-Agent strings into browser, OS, device, and engine fields with lightweight heuristics. Defaults to your browser UA; copy JSON - free, client-side, no UA library. ### User-Agent string _Mozilla/5.0 …_ ### Parsed fields Copy JSON BrowserUnknown OSUnknown DeviceDesktop EngineUnknown MobileNo Likely botNo ### JSON ``` { "browser": "Unknown", "browserVersion": "", "os": "Unknown", "osVersion": "", "device": "Desktop", "engine": "Unknown", "engineVersion": "", "mobile": false, "bot": false, "raw": "" } ``` ## What is a user-agent parser? The User-Agent request header identifies the client software making an HTTP request: browser name and version, operating system, device class, and rendering engine. Servers, analytics pipelines, and feature flags sometimes read UA strings to tailor responses, though modern privacy guidance pushes toward Client Hints and reduced fingerprinting instead of brittle sniffing. UA strings are chaotic historical documents. Chrome sends Mozilla/5.0 compatibility tokens; Safari and WebKit versions diverge; in-app WebViews append app-specific markers. Regex-heavy server libraries age quickly when vendors ship new patterns. A lightweight heuristic parser helps developers debug what their own browser sends and compare staging vs production access logs without deploying server code. Device detection from UA alone misclassifies desktop sites in mobile emulation, iPadOS requesting desktop sites, and privacy browsers spoofing generic strings. Treat parsed output as hints for logging and support tickets, not as authoritative security controls - use feature detection on the client and authenticated session metadata on the server. Bots and crawlers announce themselves with Googlebot, bingbot, or custom spider tokens, though malicious bots can forge headers. The bot flag here uses common substring heuristics; verify crawler identity with reverse DNS or official verification tools before whitelisting SEO crawlers. Engine vs browser distinction matters for bug triage: a site may work in Chrome but fail in Safari because WebKit handles a CSS rule differently even when both list Chrome-like tokens in compatibility mode. Parsing engine name helps reproduce WebKit-specific tickets. ToolComb’s user-agent parser defaults to navigator.userAgent on load so you instantly see your current browser profile. Paste any string from nginx access logs or Sentry events to extract structured JSON for Jira fields. Processing is entirely client-side. This tool deliberately avoids shipping a multi-megabyte UA database. It covers mainstream desktop and mobile browsers plus common OS families. Obscure smart TVs, embedded consoles, and regional browsers may remain Unknown - paste the raw string into issue trackers when that happens. Google’s User-Agent reduction phases freeze detailed OS and version tokens in favor of static strings plus Client Hints. If your parsed OS shows Unknown while Chrome version looks accurate, check whether the browser is on the reduced UA experiment - your server logs will look different from blog posts written in 2019. Selenium and Playwright tests set custom User-Agent strings to simulate devices. CI logs containing those tokens confuse analysts unless documented. Parsing the automation UA clarifies that HeadlessChrome is not a malicious bot but your nightly regression job. CDN bot management scores requests using UA plus behavioral signals. False positives block legitimate API clients using generic Java HTTP user agents. Parsing helps you write descriptive, stable product tokens (MyApp/2.1 + contact URL) that fit vendor allowlist policies. Privacy regulations treat persistent device identifiers carefully. Hashing UA with IP was once used for analytics fingerprinting; today prefer consent-based IDs. If you log UA for debugging, rotate retention and avoid combining fields into surrogate identifiers without legal review. WebView embeds in Slack, LinkedIn, and email clients append proprietary markers. Support teams compare in-app browser UA against standalone Safari to reproduce CSS bugs that only appear inside social WebViews. Accessibility tools and screen readers may not advertise distinct UA substrings; capability detection remains essential for adaptive UI. Parsing UA never replaces aria and prefers-reduced-motion checks. Enterprise browsers and managed Chrome profiles may append policy tokens or strip version detail entirely. If parsed browser version looks frozen while users report auto-update, compare against enterprise release notes rather than assuming the parser failed. HTTP/2 and HTTP/3 do not change User-Agent header semantics - the same string travels in pseudo-headers on some implementations but remains a single text token for analytics. Log aggregation pipelines normalizing case should not alter token content used for heuristics. Fraud teams correlate UA with geolocation and velocity; developers debugging false positives paste blocked UA strings here to see whether outdated bot heuristics misclassified a legitimate mobile WebView from a banking app. Progressive Web Apps installed to home screen often reuse the underlying browser engine UA with minor additions. Support engineers distinguish installed PWA from native wrapper apps by comparing UA plus Sec-CH-UA where available in raw log lines. ## How to parse a User-Agent string Paste a UA or use your browser default; structured fields update live. 1. **Load your UA** On first visit, your current navigator.userAgent appears automatically. 2. **Paste another string** Replace with a line from logs, curl -A, or HTTP request dumps. 3. **Read structured fields** Browser, OS, device class, engine, mobile, and bot flags summarize the string. 4. **Copy JSON** Copy JSON for analytics schema design or support ticket attachments. 5. **Prefer Client Hints in new code** For greenfield projects, use Sec-CH-UA-* headers instead of regex on User-Agent. ## Example: Chrome on Windows ### Before Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 ### After Browser Chrome 120, OS Windows 10/11, engine WebKit 537.36, device Desktop, mobile false. Safari on macOS includes both Version/ and Safari/ tokens - the parser prefers Version for browser number. ## User-agent parsing use cases ### 1. Access log triage Quickly classify visitor browser/OS when investigating compatibility bugs. ### 2. Support reproduction Customers paste UA; support maps to known issues. ### 3. Bot filtering review See why a request matched or missed bot heuristics. ### 4. Mobile vs desktop QA Confirm responsive breakpoints match real device classes. ### 5. WebView debugging Detect in-app browsers that behave differently from standalone Chrome. ### 6. Privacy audits Document how much fingerprinting surface your site logs. ### 7. Legacy IE compatibility tickets Rare but painful enterprise contracts still surface Trident tokens in intranet logs. Parsing confirms MSIE rv: patterns so teams know whether polyfills or sunset deadlines apply. ### 8. A/B test bucketing review Product teams verify that experiment bucketing does not accidentally key off brittle UA substrings that misclassify iPad as desktop, skewing experiment results. ### 9. API client identification Backend services require partners to send identifiable User-Agent values. Parsing sample partner strings ensures they include product name and version before enforcing 400 responses on generic Java defaults. ## User-Agent vs Client Hints Modern browsers freeze or reduce classic UA strings. | Approach | Pros | Cons | | --- | --- | --- | | User-Agent regex | Works in old logs | Fragile, privacy concerns | | Client Hints | Structured, negotiable | Requires HTTPS + opt-in | | Feature detection | Accurate capability | Not in HTTP logs | | This parser | Fast, offline | Heuristic only | Use parsing for debugging access logs and support tickets; use Client Hints and feature tests for product logic and responsive layout. When migrating off UA sniffing, log both UA and available Client Hints temporarily so you can compare classification drift before turning off regex-based server branches. ## Limits - Heuristic regex only - not equivalent to ua-parser-js, DeviceAtlas, or WURFL databases. - Forged User-Agent headers are trivial via curl -A; never use parsed output as authentication or authorization. - iPadOS requesting desktop site may report Mac OS X and Safari-like tokens without Mobile keyword. - Chrome User-Agent Reduction may freeze OS and device detail - expect Unknown for fields browsers intentionally freeze. - Does not parse Sec-CH-UA, Sec-CH-UA-Mobile, or Sec-CH-UA-Platform Client Hint headers. - Smart TV, console, and embedded browsers often fall through to Unknown browser name despite long tokens. - Version numbers reflect first matching pattern; secondary browser engines in WebView stacks may be hidden. - Opera, Vivaldi, and other Chromium forks may identify as Chrome in the browser field while differing in feature flags - confirm with vendor release notes when tickets cite Chrome version alone. ## Privacy User-Agent strings you paste are processed locally in JavaScript; they are not uploaded to ToolComb servers for parsing or storage. Default load uses navigator.userAgent from your current browser - only you see it until you share the screen. Copy JSON places the full string on your clipboard where other apps may read it; clear clipboard after handling sensitive corporate intranet UAs. Logging UA in your own products may implicate GDPR or CPRA if combined with other identifiers - this tool does not advise retention policy, only local inspection. No telemetry records parsed browser or OS fields from this page implementation. ## Frequently Asked Questions ### What is a User-Agent string? The User-Agent HTTP request header is a single text line identifying client software: browser name and version tokens, operating system hints, device class keywords, and compatibility history entries like Mozilla/5.0. Servers and analytics pipelines log it for debugging, not for strong identity. ### How accurate is this parser? Accuracy is heuristic. Mainstream Chrome, Firefox, Safari, Edge, and common Windows/macOS/Android/iOS patterns parse well. Obscure smart TVs, embedded browsers, and privacy-hardened generic strings may leave browser or OS as Unknown. It is not a substitute for commercial device detection databases. ### Does it detect bots and crawlers? A likely-bot flag matches substrings such as bot, crawl, spider, and HeadlessChrome. Malicious actors forge Googlebot tokens easily; SEO and security teams must verify crawlers with reverse DNS or vendor tools before allowlisting, never relying on UA alone. ### Why does Chrome User-Agent mention Safari? Historical compatibility: Chromium browsers include AppleWebKit and Safari tokens so legacy servers that sniff for Safari receive a familiar pattern. The parser prioritizes Chrome/Edg/Firefox product tokens over compatibility noise when detecting browser name. ### User-Agent vs Client Hints? Client Hints (Sec-CH-UA-Platform, Sec-CH-UA-Mobile, etc.) expose structured fields with user privacy controls and HTTPS requirements. User-Agent remains ubiquitous in access logs and older middleware. New feature detection should prefer Client Hints and capability APIs on the client. ### Is my User-Agent sent to ToolComb? No. Parsing executes entirely in your browser tab. The default string comes from your own navigator object locally; pasted log lines are not uploaded for analysis. ### Why does iPad sometimes look like macOS desktop? iPadOS desktop site mode and certain WebKit configurations send Mac-like platform tokens without Mobile. Device class may show Desktop or Tablet incorrectly - treat output as approximate and confirm with Client Hints or device lab hardware. ### Can I parse User-Agent from curl or wget? Yes. Paste the value passed to curl -A or the User-Agent column from nginx, Apache, or CloudFront access logs. Include the full unquoted string exactly as logged. ### How is mobile detection determined? Mobile flag uses regex on substrings like Mobile, iPhone, Android phone patterns, and excludes some tablet cases. Responsive CSS breakpoints should not depend solely on this flag - use matchMedia and Client Hints in production UI code. ### Is the User-Agent parser free? Yes. Unlimited local parsing without an account. ### Should I block or allow requests based on parsed browser? Generally no for security. Use authentication, rate limits, and WAF rules instead of UA blocking except for coarse bot management with verified crawlers. UA blocking breaks when strings change or users spoof headers. ### Does parsing work offline? After the page loads, editing and re-parsing work without network access because heuristics run in JavaScript with no external UA database fetch. ### What is the engine field versus browser? Browser names the product users recognize (Chrome, Firefox, Safari). Engine names the rendering core (WebKit, Gecko) that actually parses HTML and CSS. A CSS bug may be engine-specific even when the browser token says Chrome because Chromium embeds WebKit-derived Blink - knowing both fields speeds reproduction steps for front-end tickets. ## Related tools - [URL Parser](https://www.toolcomb.com/url-parser) - Inspect landing page query params. - [HTTP Status Codes](https://www.toolcomb.com/http-status-code-reference) - Debug CDN responses to bots. - [JWT Decoder](https://www.toolcomb.com/jwt-decoder) - Session tokens beside UA in logs. - [Hash Generator](https://www.toolcomb.com/hash-generator) - Hash UA for privacy-preserving analytics. ## Related Tools Discover more free tools that might help with your next task. [Base64 Encoder Encode and decode Base64 data Use Tool](https://www.toolcomb.com/base64-encoder) [URL Decoder Decode URL-encoded strings Use Tool](https://www.toolcomb.com/url-decoder) [HTML Encoder Encode and decode HTML entities Use Tool](https://www.toolcomb.com/html-encoder) [Hash Generator Generate MD5, SHA1, SHA256 hashes Use Tool](https://www.toolcomb.com/hash-generator) [UUID Generator Generate v1, v3, v4, and v5 UUIDs Use Tool](https://www.toolcomb.com/uuid-generator) [Password Generator Generate secure random passwords Use Tool](https://www.toolcomb.com/password-generator) ### Related guides Read the how-to, then come back to this tool when you are ready to run it locally. - [MIME Types and HTTP Status Codes - Quick Browser Reference Look up Content-Type suffixes, decode 4xx vs 5xx in logs, and parse URLs and user agents locally when debugging APIs without tab-hopping.](https://www.toolcomb.com/blog/mime-types-and-http-status-codes-quick-reference) [View All Tools](https://www.toolcomb.com/tools)