How to Parse User Agents

Problem

You have a User-Agent string and need to identify the browser, OS, and device type.

Prerequisites

• Understanding of HTTP headers
• Knowledge of User-Agent format

Steps

1. 1. Understand the User-Agent format

   User-Agent strings contain product tokens separated by spaces, each with a name and optional version. The order and content vary by browser. Modern browsers include compatibility tokens (like Mozilla/5.0) for historical reasons, making parsing complex.

   Input

   Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/118.0

   Output

   tokens identified

2. 2. Parse with a UA parser library

   Use a dedicated User-Agent parser rather than regex. UA strings are notoriously inconsistent and full of compatibility tokens. A maintained parser library (like ua-parser) uses pattern databases updated for new browsers and devices.

   Input

   UA string

   Output

   browser: Chrome 118, OS: Windows 10, device: desktop

3. 3. Use the results appropriately

   Use parsed data for analytics, compatibility decisions, or content negotiation. Be aware that User-Agents can be spoofed. Do not make security decisions based solely on UA parsing. Consider Client Hints as a more structured alternative.

   Input

   parsed UA

   Output

   used for analytics

Expected result

Browser, OS, and device information extracted from the User-Agent string.

Common errors

Parsing with regex misses new browsers

Use a maintained UA parser library with an updated pattern database. Regex-based parsing breaks on new UA formats.

Trusting UA for security decisions

User-Agents are client-controlled and can be spoofed. Never use UA alone for authentication or authorization.

Troubleshooting

• If parsing returns 'unknown', the UA may be from a bot, app, or new browser. Update the parser database.
• Client Hints (Sec-CH-UA) provide structured browser data and are more reliable than UA strings.

Security limits

• User-Agent strings are spoofable. Never rely on them for security. Use feature detection instead of UA sniffing for browser compatibility.