What a User Agent String Reveals About a Visitor
Every browser sends a user agent string with each request, identifying itself. It is also the most misleading header on the web, because browsers have spent thirty years pretending to be each other. The User Agent Parser breaks one into browser, operating system and device.
Why it is such a mess
Early sites checked the user agent to decide which version of a page to serve, and a browser that was excluded by the check pretended to be the one that was not. Every browser did it, to everyone else, for decades.
The residue is still there. Nearly every browser still begins its string with Mozilla/5.0, which refers to a product discontinued in 2003. Chrome identifies itself as Safari as well as Chrome, because sites checked for Safari. Edge identifies as Chrome and Safari. The string is a sedimentary record of old compatibility checks rather than a description.
So the parsing is not straightforward: the last name in the string is often the real browser, and the earlier names are what it is pretending to be. Getting it right means knowing the order of precedence, which is what a parser is for.
What you can reasonably read
The browser family and its major version, the operating system family, and whether the device is roughly a phone, a tablet or a desktop. That is genuinely useful for analytics and for deciding which browsers your audience actually uses - which is a better basis for support decisions than guessing.
What you cannot read reliably: the exact device, the screen size, the real operating system version on recent systems that deliberately freeze it, or whether the visitor is a person. Mobile Safari on an iPad reports itself as a Mac if desktop mode is on. And the string is trivially editable - a header anyone can set to anything.
Never make a decision on it
Two rules. Do not use it to decide whether a feature is available - test for the feature itself, which is accurate and does not go stale the moment a browser updates. And do not use it for security or access control, because an attacker sets it to whatever passes.
It is fine for counting, for logging, and for a message suggesting someone try a different browser. It is not fine as a gate.
Common questions
Why does Chrome say Safari?
Because sites once checked for Safari, and Chrome needed those checks to pass. The habit outlived the reason.
Can I detect a bot from it?
The honest ones say so - Googlebot identifies itself clearly. The dishonest ones copy a real browser exactly, so the string alone cannot tell you.
Is the user agent going away?
It is being reduced. Browsers now freeze parts of it and offer a separate mechanism for the detail, specifically because it was so widely misused.
Does it tell me the screen size?
No. Measure the viewport in the browser instead, where you get the real number.
Got a string to decode?