Example
Input (User-Agent string)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15
Output
Browser: Safari 17.0 Engine: WebKit 605.1.15 OS: macOS 10.15.7 Device: Mac (Desktop)
Note
Almost every browser starts with `Mozilla/5.0` — a historical joke. A 90s compatibility hack that never went away.
Usage / FAQ
When to use
- Analyze User-Agent strings from server logs
- Decode unknown user agents in analytics (GA, Mixpanel)
- Distinguish bots from real users — Googlebot, GPTBot, etc.
- Identify the exact OS version of a specific device (iPhone 16 Pro, …)
- Investigate suspicious traffic — crawler vs headless browser?
FAQ
- Q.Why does every browser start with 'Mozilla'?
- A.In 1994, sites blocked browsers that didn't support frames by checking for 'Mozilla' (Netscape). IE added it to bypass the block. Every subsequent browser kept it for compatibility — still there today.
- Q.Can I trust the User-Agent?
- A.No. Clients can change it freely — never rely on it for security or authentication. Use it only as a hint for stats or UI branching. Chrome is gradually replacing it with User-Agent Client Hints.
- Q.How do I verify Googlebot?
- A.Just having 'Googlebot' in the UA isn't enough — anyone can spoof it. The real verification is reverse DNS: the IP must resolve to `*.googlebot.com`.
Fun facts
Strings like 'Mozilla/5.0 (...) Gecko/... Firefox/...' are a 30-year cargo cult that started with NCSA Mosaic's 'Mozilla' nickname in 1993. Every browser since has pretended to be 'Mozilla compatible' by impersonating others' UA strings — that's why IE, Chrome, and Safari all stuff 'Mozilla/5.0' into theirs.
WebAIM — UA historyA detailed enough UA + screen resolution + timezone + font combination is enough to uniquely identify a user (browser fingerprinting). That's why Apple froze the Safari UA in 2021 — to limit per-user tracking.
EFF — Browser fingerprintingUA-CH (User-Agent Client Hints) landed in Chrome 86 (2020). The unified UA is broken apart and individual pieces are requested via dedicated headers like `Sec-CH-UA-Platform` — a progressive replacement for the old cargo cult is in motion.
MDN — Client Hints
Related tools
- Base64 Encode / Decode
Encode text to Base64 or decode Base64 back to text. Runs entirely in your browser, no data sent to any server.
- URL Encode / Decode
Percent-encode text for safe use in URLs, or decode percent-encoded URLs back to text. Runs entirely in your browser.
- UUID / ULID Generator
Generate UUID v4 (random), UUID v7 (time-ordered, RFC 9562), or ULID identifiers — all client-side via crypto.
- JWT Decoder
Decode the header and payload of a JSON Web Token. Signature is not verified (a public key is required). The token is processed entirely in your browser.
- JWT Encoder (HMAC)
Generate a signed JSON Web Token with HS256/HS384/HS512 (HMAC-SHA). Payload and secret stay in your browser — Web Crypto API based.
- SHA Hash
Compute SHA-1, SHA-256, SHA-384, or SHA-512 hash of text. Uses the browser's Web Crypto API; no data is sent to any server.
- Hex Encode / Decode
Encode text to hexadecimal or decode hex back to text. Supports UTF-8 multi-byte characters and tolerates whitespace.
- HTML Entity Encode / Decode
Encode HTML special characters (&, <, >, ", ') to entities, or decode named/numeric entities back to text.
- Password Generator
Generate cryptographically strong passwords, tokens, random strings, and passphrases with entropy display.
- Number Base Converter
Convert numbers between bases (binary/octal/decimal/hex/base36) using BigInt for large integers. Auto-detects 0b/0o/0x prefixes.
- URL Parser
Decompose a URL into protocol, host, path, query parameters, and hash — read-only inspection.
- HMAC Generator
Compute HMAC (Hash-based Message Authentication Code) with SHA-1/256/384/512 using the Web Crypto API.
- HMAC Verify
Verify whether a given HMAC signature matches the message + secret. Constant-time comparison via Web Crypto API.
- MD5 Hash
Compute MD5 hash for text. Note: MD5 is broken for security — checksums and legacy compatibility only.
- Punycode (IDN)
Convert international domain names to/from Punycode (xn-- encoded ASCII). Uses native URL parser.
- HTTP Status Codes
Browse and search HTTP status codes (1xx-5xx) with descriptions and common usage.
- Bcrypt Hash
Hash passwords with Bcrypt or verify a plaintext against an existing hash. Configurable salt rounds.
- Cookie Parser
Parse Cookie or Set-Cookie strings into a table. Decode percent-encoded values. Supports Set-Cookie attributes (Path/Domain/Max-Age/SameSite/HttpOnly/Secure).
- IP / CIDR Calculator
Compute network address, broadcast, host range, mask, and host count from an IPv4 + CIDR.
- cURL Builder
Build cURL commands from URL/method/headers/body. Auto-detects JSON content-type.