What Your User-Agent String Reveals, and Why It Shrinks

Most websites never ask who you are. They read it off the request line.

Every HTTP request your browser makes carries a short header called User-Agent, and that line has quietly described your browser, your operating system and sometimes your hardware for the better part of three decades. It is one of the oldest fingerprinting signals on the web, and one of the few that browsers are now actively shrinking.

A line written for a web that no longer exists

The modern user-agent string is a fossil record. It begins with Mozilla/5.0 because, in the late 1990s, sites sniffed for the Netscape browser name and served their best pages to it. Every browser since claimed to be Mozilla so that it would not be turned away. Then AppleWebKit/537.36, KHTML, like Gecko and Safari/537.36 were bolted on for the same reason: engines imitating one another so that sites written for a competitor would render correctly.

The result is a header where a third of the tokens are deliberate untruths kept for compatibility, and the genuinely useful information sits in a parenthetical aside.

Decoding a real string

Here is a typical one from a Windows machine running Chrome:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36

Read it as three parts. The platform block in brackets is the informative one: Windows NT 10.0 names the operating system, Win64 the architecture, and the trailing x64 the processor family. The engine tokens in the middle — AppleWebKit, KHTML, Gecko, Safari — are noise; they describe the lineage of the rendering engine rather than the browser in front of you. The product token at the end, Chrome/120.0.0.0, is your browser and version.

You can read your own header exactly as a server receives it with the what is my user agent tool, which prints the raw value rather than a summary.

What a server actually concludes

A server does not read the string the way you do. It matches patterns.

The practical consequence is blunt. A site can tell whether you are on a phone or a desktop, roughly which browser family you use, and which operating system generation you sit on. It cannot tell your exact build, your patch level, or — on Windows — which version of the operating system you actually run.

There is also a mismatch to watch for. Some extensions and privacy tools rewrite the user agent by hand, producing a string that claims one browser while the rendering engine tokens and the available APIs say another. That contradiction is itself a strong signal, and it is why fingerprinting tests often ask for the user agent alongside dozens of other values.

Why the string is shrinking

Chrome, Firefox and Safari have each moved to reduce what the header carries. The specifics differ, but the shape is the same: remove the fine-grained detail that made it a fingerprint, and freeze the rest so it changes rarely.

• Chrome/120.0.0.0 — the major version only, with the rest zeroed, so a browser on 120.0.6099.109 announces the same value.
• Firefox — its minor version fixed to zero in much the same way.
• Android 10 — the floor for Android, with Chrome reporting the major version only and no longer naming the device model.
• 10_15_7 — the macOS system version, frozen at that value whatever the machine actually runs.
• Windows NT 10.0 — reported for Windows 10 and Windows 11 alike, and set to stay that way.

The motive is direct: a header attached to every request — images and scripts included — is a passive fingerprinting channel that costs a tracker nothing to log. Narrowing its contents narrows that channel.

Reduction has limits, so the detail moved to a newer mechanism. JavaScript can read a structured object called navigator.userAgentData, which exposes the same information as named fields — platform, brands, mobile, architecture, model, platformVersion — and lets a site request the more specific ones explicitly rather than receiving everything by default. We explain that arrangement in client hints explained.

The honest summary is that a reduced user agent is less identifying than it used to be, but it is not silent. Your browser still announces a version, an OS family and an architecture on every request.

Two tools, one view

The genuine article is more useful than any example. Open the user agent tool and compare what it prints with the string decoded above. If your version is padded with zeros and the platform line is deliberately vague, reduction is working as intended — that is not a fault in your browser.