Request Inspector guide
How to read a User-Agent string with XGM Request Inspector, why the strings look so strange, how client hints change things and why UA sniffing is fragile.
What a User-Agent string is
Every HTTP request from a browser carries a User-Agent header (RFC 9110 §10.1.5) describing the software that sent it. Servers use it for statistics, for serving different downloads per operating system, and sometimes, less wisely, for deciding which features a browser supports. Crawlers and scripts send their own strings, such as curl/8.5.0 or a search engine bot name.
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36The string above belongs to Chrome, even though it mentions Mozilla, AppleWebKit, KHTML, Gecko and Safari. Browsers added those tokens over decades so that sites checking for a competitor's name would still serve them the full site. The result is that the meaningful information hides among compatibility tokens, which is why a parser helps.
How to use Request Inspector
- Open the Request Inspector. It starts with your own browser's User-Agent string.
- Read the browser, operating system, engine, device type and whether the string looks like a bot or script.
- Paste another string, for example from a server log, to parse it instead.
- Copy or export the result for a bug report.
Your string is read from the browser itself and parsed in the page; it is not sent to XGM for this tool. When reporting a website bug, the parsed browser and OS versions are often the most useful details to include.
What the parser reports
| Field | Examples | Notes |
|---|---|---|
| Browser | Chrome 140, Firefox 143, Safari 18, Edge 140 | Identified from product tokens; Edge and Opera mark themselves on top of Chrome's |
| Operating system | Windows, macOS, Android, iOS, Linux | Versions may be frozen or approximate |
| Engine | Blink, Gecko, WebKit | Determines rendering and web platform behaviour |
| Device type | Desktop, mobile, tablet | Based on mobile and tablet tokens |
| Bot or script | Yes for crawler names, curl, wget, HTTP libraries | Only self-declared bots are detected |
Frozen and reduced strings
User-Agent Client Hints
Because the old string reveals a lot and is hard to parse, Chromium browsers introduced User-Agent Client Hints. By default they send short headers such as Sec-CH-UA with brand and major version, Sec-CH-UA-Mobile and Sec-CH-UA-Platform. Servers that need more detail, such as the full version or device model, must ask for it with an Accept-CH response header.
Sec-CH-UA: "Chromium";v="140", "Google Chrome";v="140", "Not.A/Brand";v="99"
Sec-CH-UA-Mobile: ?0
Sec-CH-UA-Platform: "Windows"Firefox and Safari do not send these headers, so servers still need the classic string for them. In JavaScript, navigator.userAgentData exposes the same information in supporting browsers.
Bots and fake user agents
Well-behaved crawlers identify themselves, for example with names that include "bot" and a URL explaining the crawler. Scripts and libraries send defaults such as curl/8.5.0 or python-requests/2.32.3 unless configured otherwise. The parser flags such strings as bots or scripts.
Anyone can send any User-Agent string, so a string claiming to be a search engine crawler proves nothing. Large search engines document how to verify their crawlers, typically by a reverse DNS lookup of the IP address followed by a forward lookup of the returned name. The Reverse DNS tool performs the first step.
dig +short -x 192.0.2.66
crawl-192-0-2-66.bot.example.com.
dig +short crawl-192-0-2-66.bot.example.com A
192.0.2.66 # must match the original IPUser agents in logs and analytics
Server logs record the User-Agent of every request, which makes them useful for spotting unusual traffic. A sudden flood of requests with a library default such as python-requests, or with an outdated browser version that almost nobody uses any more, often points to scraping or automated attacks. Real browsers update frequently, so very old versions in large numbers are suspicious.
awk -F'"' '{print $6}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20In analytics, User-Agent data is increasingly coarse because of the reductions described above. Use it for broad questions, such as the share of mobile visitors or which browser families to test, rather than for exact OS or device versions.
Why user agent sniffing is fragile
Deciding behaviour by browser name breaks when browsers change, when a new browser appears or when a user changes the string. MDN and browser vendors recommend feature detection instead: check whether an API exists before using it, and use CSS @supports for styling. Keep User-Agent parsing for analytics, logs and support diagnostics.
| Instead of | Use |
|---|---|
| Checking for "Safari" to disable a feature | if ('share' in navigator) or similar feature checks |
| Serving a mobile site by user agent | Responsive design with CSS media queries |
| Blocking "bots" by string | Rate limiting and behaviour-based detection |
| Detecting the OS for a download | Offer all downloads, preselect based on client hints or the string |
FAQ
What is my user agent?
The parser shows it when you open the page, read directly from your browser.
Why does Chrome's string mention Safari and Mozilla?
Compatibility. Browsers copied tokens from older browsers so sites that checked for those names would not block them.
Can a website trust the user agent?
No. Any client can send any string. Use it as a hint for statistics and diagnostics, not for security decisions.
Why is my macOS or Android version wrong?
Browsers reduce and freeze parts of the string for privacy. Detailed versions are available through client hints only when a site requests them.
How are bots detected?
By known crawler names and common script and library tokens. Bots that pretend to be browsers are not detected by the string alone.
What are client hints?
Headers such as Sec-CH-UA and Sec-CH-UA-Platform that Chromium browsers send with structured browser information, replacing parts of the User-Agent string.
Is my user agent uploaded?
Not by this tool; it is parsed in the page. Like every website, the XGM server receives the header as part of normal requests.
Should I change my user agent for privacy?
Changing it can make you more unique rather than less, and can break sites. Browser privacy features and tracker blocking usually help more.
Why does an iPad report itself as a Mac?
Safari on iPad requests desktop websites by default and sends a macOS-style User-Agent string. Touch support checks in JavaScript tell the two apart better than the string.
Do mobile apps send user agents?
Yes. Apps usually send their HTTP library's default or a custom string with the app name and version, which is useful to recognise app traffic in logs.
How do I set a user agent in curl?
Use -A, for example curl -A "my-monitor/1.0 (+https://example.com/bot)" https://example.com. Identify your scripts honestly so site owners can contact you.