What is my user agent?

Every Chrome 157 sends one of these, whatever the exact build, OS version or device: the rest is frozen. The Chrome user agent page has every platform, the Client Hints that go with them and a generator for other versions.

With it, on every request: Sec-CH-UA: "Not-A.Brand";v="99", "Google Chrome";v="157", "Chromium";v="157".

Three places, compared with each other. The request: our server reports back the User-Agent and Sec-CH-UA headers your browser sent it, because page scripts cannot read those; the page asks for the detailed Client Hints with an Accept-CH header, so they are included too. The page: navigator.userAgent, navigator.userAgentData and its high-entropy values. A worker: the same values read in a background thread, which overrides applied to the page often miss.

A real browser derives all of them from one version and one platform, so they agree. Each check above compares two of them and fails only on a contradiction; none of them looks your browser up in a list. The browser fingerprint test runs the same idea across a few hundred signals.

A user agent is the software that acts for you on the web, usually your browser, and the user agent string is the line of text it uses to introduce itself. It goes to every server in the User-Agent header and is readable by every page as navigator.userAgent. Sites use it to pick a layout or a download, to collect statistics, and to decide whether a visitor is a browser or a script.

It looks like a jumble because each part is history. Here is what the current Chrome on Windows sends, token by token:

Firefox sends a shorter, more honest string (Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:…) Gecko/20100101 Firefox/…), Safari its own, and HTTP libraries a one-word name and version. The Chrome user agent page lists every Chrome platform, and the random user agent generator produces current strings for Chrome, Edge and Firefox.

The User-Agent request header carries the string to the server with every request: the page, its images, its scripts and every API call. Because it said too much (the exact version, the operating system version, sometimes the device model), Chrome reduced it: the version is 157.0.0.0, Windows always reads Windows NT 10.0, every Mac Intel Mac OS X 10_15_7 and every Android phone Android 10; K.

The detail moved to User-Agent Client Hints. Chromium browsers send three of them with every request: Sec-CH-UA (the brands and major version), Sec-CH-UA-Mobile and Sec-CH-UA-Platform. A site that needs more asks with an Accept-CH response header and then also receives the full version, the platform version, the CPU architecture and the device model. Scripts read the same values with navigator.userAgentData.getHighEntropyValues(). Firefox and Safari do not send Client Hints. More in what User-Agent Client Hints are.

In the browser. In Chrome or Edge, open DevTools (F12), open the menu, choose More tools, then Network conditions, untick “Use browser default” and pick a device or type a string. It applies to that tab while DevTools is open. Extensions do the same permanently. In Firefox, general.useragent.override in about:config sets one for the whole browser.

In code, set the header on an HTTP client, or the user agent of a browser context:

curl -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/157.0.0.0 Safari/537.36" https://example.com

Changing the string changes only the string. A real browser still reports its own version and platform in the Client Hints, in workers and through its engine's features, and an HTTP library still has its own TLS handshake (see the JA4 fingerprint checker). The checks at the top of this page compare exactly those, so run them after you change anything.

Not every visitor is a browser. Crawlers and HTTP libraries send their own user agents. Version numbers below are examples; each one sends its own version.

A user agent is self-reported, so anyone can send Googlebot's. Google's own advice for checking a visit: run a reverse DNS lookup on the IP address, confirm the name ends in googlebot.com, google.com or googleusercontent.com, then look that name up again and make sure it resolves to the same IP. For many requests, compare the IPs with the ranges Google publishes as JSON instead. How sites tell good bots from bad ones is in what bot detection is.