User-Agent String Parser
Break down a User-Agent string into OS, browser, and version — and flag common automated-client patterns.
User-Agent strings are a small archaeology exhibit — nearly every browser claims to be several others for compatibility reasons dating back decades. Reading them matters in log analysis, where the User-Agent is often the first thing that marks a request as automated.
How to use it
- Paste a User-Agent string.
- Read the parsed browser, engine and platform.
What to take away
Almost every string starts with Mozilla/5.0
A historical compatibility hack that stuck. It tells you nothing; ignore it and read what follows.
It is self-reported and trivially forged
Anyone can send any User-Agent. Treat it as a hint during triage, never as an access control or an identity.
Default tool strings are gifts
python-requests, curl, sqlmap and similar defaults appear constantly in logs from unsophisticated automation. Attackers who change them are telling you something too.
Frequently asked questions
Can I block attacks by User-Agent?
Only the laziest ones, and only until they change one line. It is useful for filtering noise in logs, not for defence.
Why does Chrome claim to be Safari and Mozilla?
Layers of compatibility sniffing over thirty years. Sites checked for competitors' strings to serve better pages, so every browser added them, and now none can safely remove them.
What is User-Agent Client Hints?
A newer, structured replacement that sends less by default and more on request, intended to reduce fingerprinting. The old header is being frozen rather than removed.
Where this fits in the course
This security tool pairs with Path 12 — Network Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Log Grep / Filter Playground — Filter a block of log lines with a regex — the exact "find the signal in the noise" skill IR work depends on.
- Log Analysis / IR Lab — A messy auth.log dump from a compromised box. Reconstruct the timeline and find the breach — blue-team skills, not exploitation.
- Raw HTTP Request Builder — Build a raw HTTP request from method, path, headers, and body — see exactly what goes over the wire.
- Email Header Analyzer — Paste raw email headers and get flagged for From/Return-Path mismatches, SPF failures, and missing DKIM.