User agent parser that names the fiction

Because in 1995 servers started checking for it. Netscape Navigator identified itself as Mozilla/2.0 and sites began serving frames only to that name, so when Internet Explorer wanted the same content it announced itself as Mozilla/4.0 (compatible; MSIE 4.0). Every browser since has inherited the prefix for the same defensive reason: the cost of dropping it is being handed a worse page by some server nobody has maintained since 2003. Mozilla/5.0 is now a fixed four-character apology at the front of a string that otherwise describes something else entirely.

For the same reason, one layer down. Safari was built on KHTML, so it announced AppleWebKit (KHTML, like Gecko) to inherit the content sites were already serving to Gecko. Chrome then shipped with WebKit, copied Safari's tokens to inherit what sites served Safari, and kept every one of them after switching to Blink in 2013 — including AppleWebKit/537.36, which is a build number frozen at the moment of the fork. The result is a Chrome string that names four rendering engines and runs a fifth.

Not from the User-Agent string. Both report Windows NT 10.0, because Microsoft never incremented the kernel version for Windows 11 and browsers report the kernel version. The only reliable signal is the Client Hint Sec-CH-UA-Platform-Version: Windows 11 reports 13.0.0 or higher, Windows 10 reports 1.0.0 to 10.0.0, and the mapping is Microsoft's own. That hint is high-entropy, so a site has to ask for it explicitly, and only Chromium browsers answer.

You mostly cannot, and that is deliberate. Since iPadOS 13, Safari on iPad defaults to Request Desktop Website, which makes it send a string identical to Safari on a Mac — Macintosh, Intel Mac OS X 10_15_7 and all. The accepted workaround is to combine the string with navigator.maxTouchPoints, since a Mac reports 0 and an iPad reports 5. Anything that depends on a substring match for iPad has been quietly mis-classifying tablets as desktops since 2019.

No — it is being frozen, which is a different and more awkward thing. Chrome's User-Agent Reduction shipped in stages between Chrome 101 and Chrome 113: the minor, build and patch numbers became 0.0.0, the desktop platform version stopped updating, and on Android the version was pinned to 10 with the device model replaced by K. The header itself still goes out on every request and will indefinitely, so parsing it is not obsolete — it is simply less informative than it looks, and the missing entropy moved into the Sec-CH-UA hints.

You can filter the polite ones, and only those. A User-Agent is a client-supplied string with no verification of any kind, so anything unwelcome can copy Chrome's string exactly and usually does — the crawlers that identify themselves as Googlebot or GPTBot are the ones cooperating with you. Google, Bing, OpenAI and Anthropic all publish IP ranges or support reverse-DNS verification for exactly this reason: match the name, then confirm the address, and treat the string alone as a hint rather than a fact.

Yes — the string never leaves this tab. Parsing is regular expressions running in your browser, so nothing is uploaded or recorded, which matters because a full User-Agent is a real fingerprinting surface: corporate builds append internal application names, and a rare combination of browser, platform and version can identify one person out of millions.