User-Agent Parser

The User-Agent request header is a string a client sends to describe itself — browser, engine, operating system, and sometimes device. It is a tangle of historical baggage (nearly every browser still claims to be "Mozilla/5.0" for compatibility reasons), so parsing it correctly means matching signatures in the right order. This tool extracts the browser and version, the OS, the device type, and recognizes common bots and programmatic clients.

Why the order matters. Edge and Opera both embed "Chrome" in their strings, and Chrome itself embeds "Safari," so a parser must check the most specific token first. This tool checks Edge and Opera before Chrome, and Chrome before Safari, to avoid the classic misidentification. It also detects crawlers (Googlebot, Bingbot, ClaudeBot, GPTBot) and tools like curl, wget, and python-requests.

How you'll use it. In log analysis and incident response, User-Agent is a quick triage signal: a burst of requests from python-requests or sqlmap against login endpoints reads very differently from ordinary browser traffic. In web development it helps you understand analytics and reproduce a client environment. Correlate the string with the source address — the IP address info tool — because a "Googlebot" User-Agent from a residential or cloud IP that does not reverse-resolve to Google is a classic impersonation.

A note on the modern replacement. Chromium-based browsers are freezing and shrinking the User-Agent string and moving detail into structured Client Hints (Sec-CH-UA headers) that a site must opt into. That means the version and platform you read from a raw User-Agent are increasingly coarse by design. Treat a parsed User-Agent as a best-effort hint whose precision is deliberately fading, not as a reliable inventory of the client.

The critical caveat. A User-Agent is entirely client-controlled and trivially spoofed — a single flag on curl or a browser extension changes it to anything. The tool says this explicitly because it is the most important point: never make a security or access-control decision based on the User-Agent. Attackers routinely forge it to impersonate Googlebot (to reach content or bypass rate limits) or a mobile browser (to hit a weaker mobile flow).

Defensive angle. Use User-Agent as one weak signal among many, never as authentication. If you must verify a claimed crawler like Googlebot, confirm it by reverse-and-forward DNS on the source IP — the IP address info tool builds the reverse-DNS pointer you would query — not by trusting the string. For bot management, combine behavioral signals, rate limits, and challenge mechanisms rather than allow/deny lists keyed on a forgeable header.