The Agent That Acts for You
The term is broader than "browser." A user agent is any software that acts on a person's behalf to fetch things from the web. Your browser is the obvious example, but a search engine's crawler, a link-preview bot, a podcast app downloading episodes, and a command-line tool fetching a file are all user agents too. The name captures the role: the program is your agent, making requests so you do not have to speak HTTP yourself.
Whenever a user agent makes a request, it includes a User-Agent header announcing what it is. Servers read it for legitimate reasons — serving a mobile layout to a phone, logging which browsers visit, or letting a crawler identify itself so a site can treat it appropriately. It is one of the oldest request headers and is sent on virtually every request you make.
Reading the String
A typical desktop User-Agent string looks like an unbroken wall of tokens. Pulled apart, it has a recognisable structure:
Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/120.0.0.0 Safari/537.36Read piece by piece, it claims: a Mozilla-compatible browser, on 64-bit Windows, using the AppleWebKit engine, behaving "like Gecko" (another engine), as a specific Chrome version, also compatible with Safari. Almost none of that is literally true at face value — and that is not a bug, it is decades of accumulated compatibility theatre. Each token was added so that some server, somewhere, would not refuse to serve the browser. The result is a string that lists half the browser world precisely so it offends no one.
Why Everything Pretends to Be Mozilla
The single most asked question about user agents is why they all start with Mozilla/5.0, even browsers with no connection to Mozilla. The answer is a chain reaction from the 1990s browser wars. Early servers sniffed for "Mozilla" to decide whether a browser was capable enough to receive a rich, frame-based page rather than a stripped-down fallback. A competing browser that wanted the good version had to claim to be Mozilla — so it did. The next browser, to avoid being treated as inferior to that one, copied the claim. And so on, each generation inheriting the previous one's disguise, until "Mozilla/5.0" became a meaningless but mandatory prefix that nobody dares remove for fear of breaking sites that still check for it. The User-Agent string is, in effect, a fossil record of every compatibility hack the web ever needed.
The User Agent Lies — and That Matters
Because the User-Agent is simply a header the client chooses to send, it can be set to anything. Browsers include a developer-tools option to spoof it; automated tools impersonate real browsers as a matter of routine; privacy tools deliberately generalise it. The practical consequence is firm: a server must never trust the User-Agent as proof of who or what is connecting. Using it to gate access, enforce security, or block bots is trivially defeated — anything determined will simply claim to be a normal browser. It is a hint for adapting content, not a credential.
There is a privacy dimension too. Taken together with other passively shared details — screen size, fonts, language, time zone — a detailed User-Agent contributes to browser fingerprinting, the technique of identifying a visitor without cookies by the unique combination of their device's characteristics. The more a browser reveals up front, the easier it is to single out, which is exactly the problem the next generation of this system aims to fix.
What Is Replacing It: Client Hints
The modern direction is to retire the bloated, always-broadcast string in favour of User-Agent Client Hints. The idea inverts the default. Instead of shouting full device details to every site whether they need them or not, the browser sends only a minimal summary — roughly the browser brand and major version — and reveals specifics like the exact version or platform only when a site explicitly requests them. A site with a real reason to know can still ask; a site with no reason gets very little. This trims passive fingerprinting while preserving the genuine use cases, and it gradually moves the web away from a single overloaded line of text that tries, and largely fails, to be honest. For the bigger picture of how a request reaches a server in the first place, see how HTTP works.
Frequently Asked Questions
What is a user agent?
Any software that acts on a user's behalf to access the web — most often a browser, but also crawlers, bots, and apps that make HTTP requests. It identifies itself with a User-Agent header describing the browser, engine, and operating system.
What is a User-Agent string?
The value of the User-Agent header — a line of text sent with every request. It lists tokens for the browser, its rendering engine, and the operating system. Servers and analytics tools read it to detect the device and browser.
Why does every browser's user agent start with Mozilla?
A historical relic. In the 1990s, servers checked for "Mozilla" to decide whether a browser could handle modern pages, so rival browsers claimed to be Mozilla to avoid a downgraded version. Every major browser inherited the habit, so strings still begin with Mozilla/5.0 today.
Can a user agent be faked?
Yes, easily. The User-Agent is just a header the client sets, so any browser or tool can send any value. Browsers even offer a built-in override. A server should never treat it as proof of identity or as a security control.
What are user-agent client hints?
A newer, more private replacement. Instead of broadcasting full device details to every site, the browser sends a minimal default and reveals specifics only when a site explicitly asks. This reduces passive fingerprinting while still letting sites adapt when they have a genuine reason.