What a user agent is
A user agent string is a line of text your browser sends with every request to say what it is.
It travels in the User-Agent HTTP header, and scripts on a page can read the same text. Sites use it to choose between mobile and desktop layouts, to work around bugs in particular browsers, to count which browsers their visitors use, and to spot crawlers. It describes software, not a person. There is no name, account or address in it.
Why every string starts with Mozilla/5.0
In the 1990s many sites checked for Netscape, whose code name was Mozilla, and sent simpler pages to everyone else. Internet Explorer answered by calling itself Mozilla too. Browsers since then have copied the names of the ones before them so they would not be locked out: Safari says it is like Gecko, Chrome says it is Safari, and Edge says it is Chrome. The result is a string in which only one or two words are true. Here is Chrome on Windows, piece by piece:
| Piece | What it really says |
|---|---|
| Mozilla/5.0 | A leftover. Every browser sends it so that old sites do not turn it away. |
| (Windows NT 10.0; Win64; x64) | The system: Windows 10 or 11 on a 64-bit processor. |
| AppleWebKit/537.36 (KHTML, like Gecko) | Compatibility claims inherited from Safari. The number has not changed in years. |
| Chrome/126.0.0.0 | The real browser and its major version. |
| Safari/537.36 | Another inherited claim, from the days when Chrome used Safari's engine. |
User agent reduction and client hints
Detailed strings made visitors easier to tell apart, so browsers now send less. Chrome-based browsers report only the major version, say Android 10 and model K on every Android device, and freeze the macOS version at 10.15.7. Safari and Firefox freeze the macOS version too. Windows 11 identifies itself as Windows NT 10.0, which is why the result above says Windows 10 or 11.
In exchange, Chrome-based browsers offer client hints. By default they send three low-detail values in headers named Sec-CH-UA, Sec-CH-UA-Mobile and Sec-CH-UA-Platform: the browser brands, whether the device is mobile, and the platform name. A site that wants more, such as the full version, the real system version or the device model, has to ask for it. Firefox and Safari do not support client hints, so those rows read "Not exposed by this browser" there.
Fingerprinting in plain words
No single value on this page identifies you. Combined, they can. A browser version, language list, timezone, screen size and processor count together form a pattern that few other visitors share, and a site can recognise that pattern again without setting a cookie. That is fingerprinting.
- Keep your browser up to date. The most common setup is the hardest to pick out of a crowd.
- Use built-in protection. Safari, Firefox and Brave limit or blur some of these values on purpose.
- Do not fake an unusual user agent. A rare string makes you stand out more, not less.
- Do not rely on private windows. Their main job is to forget cookies and history when you close them. Most of the values above stay the same.