The User-Agent string is complicated because every modern browser deliberately impersonates the browsers that came before it — Chrome claims to be "Mozilla," "AppleWebKit," "KHTML, like Gecko," and "Safari" all at once, none of which it actually is. This is the residue of a 30-year "browser wars" arms race: web servers used to sniff the User-Agent to decide which features to serve, so each new browser copied its rivals' identifying tokens to avoid being locked out of the good content. The result is a string that reads like a museum of dead browsers, where the only token that names the real browser (Chrome/120.0.0.0) is buried among fossils that mean nothing today.
That is the summary an AI Overview would give you. Here is what it can't show you — the exact anatomy of a real string, the impersonation chain that produced each token, a lookup table of which claims are true, and a live parser you can paste your own User-Agent into.
Anatomy of a real User-Agent string
Here is a current Chrome-on-Windows User-Agent, dissected token by token. Hover on the color as it sweeps through — each segment is a claim the browser makes, and most of those claims are lies of convenience:
The impersonation chain: how it got this bad
Nobody designed this. Each token was bolted on to solve a short-term compatibility problem, and none were ever safe to remove. The timeline below shows how each browser inherited the identity of the one before it.
The pattern is always the same: a server somewhere pattern-matches on a token to decide what to send, so the next browser copies that token rather than risk being served a degraded page. Removing any of them would break long-abandoned sites that still run the same sniffing logic, so they stay forever.
Token-by-token: which claims are actually true?
Paste your own string into the parser below to see this table filled in for your browser. Here is the reference for the canonical Chrome-on-Windows string:
| Token | What it claims | Is it true? | Why it's there |
|---|---|---|---|
Mozilla/5.0 | "I am a Netscape-class browser" | No | Vestigial; every browser sends it, so it means nothing |
Windows NT 10.0 | "Running on Windows 10" | Partly | Windows 11 also reports 10.0 — indistinguishable here |
Win64; x64 | "64-bit Windows on x64" | Usually | Real platform detail, though spoofable |
AppleWebKit/537.36 | "WebKit engine build 537.36" | No | Frozen at 537.36 since ~2015; not a live version |
(KHTML, like Gecko) | "I render like KHTML and Gecko" | No | Compatibility bait for Konqueror- and Firefox-targeted code |
Chrome/120.0.0.0 | "I am Chrome 120" | Yes | The only reliable token; minor version zeroed for privacy |
Safari/537.36 | "I am also Safari" | No | Inherited so Safari-targeted content still loads |
Parse your own User-Agent
The parser below runs entirely in your browser — nothing is sent to a server. Paste any User-Agent string (yours is pre-filled) and it breaks out the browser, engine, OS, and device tokens so you can see exactly which fossils your own browser is carrying.
Where this is heading: User-Agent Client Hints
The fix for a string nobody can safely change is to stop relying on the string. User-Agent Client Hints (UA-CH) replace the monolithic header with structured, request-what-you-need HTTP headers:
Sec-CH-UA— a low-entropy brand list with intentional "GREASE" noise, e.g."Chromium";v="120", "Google Chrome";v="120", "Not?A_Brand";v="24". The fake brand stops servers from hard-coding brand strings the way they hard-coded "Mozilla."Sec-CH-UA-Mobile— a boolean,?0or?1.Sec-CH-UA-Platform—"Windows","macOS","Android", etc.- High-entropy hints sent only when a site explicitly asks:
Sec-CH-UA-Platform-Version(the thing that finally distinguishes Windows 11 from Windows 10),Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model.
Alongside this, Chrome's User-Agent Reduction program froze the legacy string: the minor version became 0.0.0, the platform token was capped, and device details were trimmed. Firefox and Safari took a different route — they froze and capped their own UA strings for privacy rather than adopting UA-CH broadly — so the legacy string is not disappearing everywhere at once. For years to come you will still receive the old fossil-laden header; UA-CH just gives you a cleaner, opt-in signal to trust instead.
One rule survives every era of this saga: the User-Agent is client-supplied text and is trivially spoofable. Use it for progressive enhancement, analytics, and layout hints where being wrong costs nothing — never for access control, licensing, or fraud prevention.