What Is a User Agent String? Format, Examples, and Its Limits

A user agent string is a piece of text an HTTP client sends with every request, identifying the software making it — browser name and version, operating system, rendering engine, and for bots, often a name and a link to documentation. It's a self-declared identity: the server has to trust that the string is accurate, which is exactly why it's a weak signal on its own for anything security-sensitive.

What Is a User Agent String?

A user agent string is text sent in the User-Agent HTTP header with every request a browser, script, or bot makes, telling the receiving server what software is making that request. Servers use this information to decide what content to return, whether to apply bot protections, and how to enforce API access rules.

There's no single standardized format across the ecosystem — browsers, bots, and automation tools each structure their string somewhat differently, and modern browser strings in particular carry significant historical baggage, often still referencing older engine names for backward compatibility with content-negotiation logic that predates the current browser entirely.

Common Formats

A well-behaved crawler's string typically includes a compatible flag signaling it's a bot rather than a regular browser, the bot's name and version, and a documentation URL where a site owner can learn more or find contact information. Not every bot follows this convention — some use minimal identifiers, and a few deliberately mimic full browser strings to blend in with regular traffic.

Where User Agent Strings Are Used

Servers read the user agent to serve device-appropriate content, apply browser-specific compatibility fixes, enforce bot-management rules, and decide which robots.txt group applies to an incoming crawler — the bot-name portion of the string is specifically what robots.txt User-agent lines match against. On the scraping side, setting a request's user agent to match a known browser or a documented crawler is a common and often necessary practice, since many servers reject requests carrying no user agent or an obviously unfamiliar one outright.

User Agent String vs. Adjacent Concepts

The user agent string is a self-declared, application-layer identity — the client simply states what it is, and nothing forces that statement to be true. This is fundamentally different from TLS fingerprinting or TCP/IP fingerprinting, which infer client identity from how a connection actually behaves at the network level, independent of what the client claims about itself. A mismatch between a stated user agent (say, claiming to be Chrome) and the underlying TLS or TCP behavior (which doesn't match Chrome's known implementation) is one of the more reliable signals detection systems use, precisely because the user agent alone is so easy to fake.

Limits

A user agent string represents a self-declared identity and nothing more — verifying its consistency against other fingerprinting signals is a useful first step in catching spoofing, but it's far from sufficient on its own. An attacker who truthfully reports their real browser and OS leaves no inconsistency to detect at all, which is exactly why serious bot-detection systems combine the user agent with behavioral analysis, network-level fingerprinting, and other contextual signals rather than relying on it as a standalone check. Browsers are also gradually reducing how much the traditional string reveals, shifting some of that information to Client Hints headers instead, which changes what's available going forward but doesn't eliminate the string itself.

Conclusion

A user agent string tells a server what a client claims to be — useful for content negotiation and basic bot identification, but weak as a security control on its own since it's self-declared and trivially spoofed. Real bot management increasingly checks it for consistency against deeper signals like TLS and TCP/IP fingerprints rather than trusting it in isolation.

For scraping workflows that need consistent, believable client identity across the full request — not just the user agent header — evaluate Nstdata Crawl against your target sites.

FAQ