String breakdown
Paste any User-Agent string — from your logs, an antidetect browser, a scraper config — and see what a site reads out of it. The field starts with your own.
A User-Agent string is one of the least logical things a browser sends, and it reads as gibberish for a historical reason: browsers spent thirty years claiming to be each other in order to get past server checks written for a competitor. That is why almost every desktop string still begins with Mozilla/5.0, why Chrome carries AppleWebKit and Safari tokens it does not need, and why Edge appends its own Edg/ token at the very end rather than at the front.
The parser splits the string into the parts a server actually acts on: the browser and its version, the rendering engine (Blink, Gecko or WebKit), the operating system and version, the device class — desktop, mobile, tablet — and whether the string belongs to a known crawler. The last one matters more than it looks: Googlebot, Bingbot and the AI crawlers identify themselves here, and so does anything pretending to be them.
Your own string is filled in on the server from the request header rather than read from navigator.userAgent in an effect, so the field is populated on the first paint and the page works with JavaScript turned off. Editing the field and parsing again happens in the browser, so the strings you experiment with are never sent anywhere.
Less than it used to be, and a site that only reads it is an easy site. Modern browsers freeze parts of the string and move the truth into client hints (Sec-CH-UA), which the browser sets and page scripts cannot forge — you can see yours among your HTTP headers. This is precisely why a rewritten User-Agent draws attention rather than deflecting it: the string says Safari on Windows, the hints say Chrome, and the contradiction is the signal. If you need plausible strings for testing, build them with the generator, which refuses impossible combinations instead of inventing them.
Because of a compatibility arms race that started in the 1990s: servers gated features on the User-Agent, so each new browser copied its competitor’s tokens to avoid being served a worse page. Nobody can drop the prefix now without breaking sniffing code that still exists.
Trivially — it is a header the client chooses. That is why it is treated as a claim rather than a fact, and why sites cross-check it against client hints, the rendering behaviour of the engine and the rest of the header set.
On its own, no: millions of people share the same common string. A rare one is a different matter — an unusual browser build or an exotic system narrows the crowd considerably and becomes a strong component of a fingerprint.
Not from the string, which anyone can copy. Check the IP: the major crawlers publish their address ranges and support reverse DNS that resolves back to their own domain. You can check the reverse record with the IP lookup tool.
They are separate Sec-CH-UA headers carrying the same information in a structured form, set by the browser itself. They are gradually replacing the string because a server can request only the parts it needs, and because they are harder to contradict quietly.
You have “desktop site” enabled, which makes the browser send a desktop string on purpose. It is the intended behaviour, though it produces exactly the sort of internal contradiction a bot filter looks for.