What’s in a User-Agent String?

Some people browse collections. I collect browsers. Mostly I just want to see what they’ll do to my web site, but I have a positively ridiculous number of web browsers installed on my Linux and Windows computers at work and at home, and I’ve installed a half-dozen extra browsers on our PowerBook.

One project I’ve worked on since my days at UCI was a script to identify a web browser. In theory this should be simple, since every browser sends its name along when it requests a page. In practice, it’s not, because there’s no standard way to describe that identity.

Actually, that’s not quite true. There is a standard (described in the specs for HTTP 1.0 and 1.1: RFC 1945 and RFC 2068), but for reasons I’ll get into later, it’s not adequate for more than the basics, and even those have been subverted. That standard says a browser (or, in the broader sense, a “user agent,” since search robots, downloaders, news readers, proxies, and other programs might access a site) should identify itself in the following format:

  • Name/version more-details

Additional details often include the operating system or platform the browser is running on, and sometimes the language.

Now here are some examples of what browsers call themselves: (If your browser supports the title attribute, you can hover the mouse cursor over each line to see what program it represents. Edit Aug. 19: rearranged list for clarity and added a few more. Edit Sep. 11: added the IE/WinXP SP2 example.)

  • Netscape Variations (non-Gecko)
    • Mozilla/4.7 [en] (WinNT; U)
    • Mozilla/4.72 [en] (X11; U; Linux 2.4.18 i686)
  • Internet Explorer Variations
    • Mozilla/4.0 (compatible; MSIE 5.01; Windows NT)
    • Mozilla/4.0 (compatible; MSIE 5.23; Mac_PowerPC)
    • Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
    • Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; T312461; .NET CLR 1.1.4322)
    • Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240×320)
    • Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 1.0.3705)
  • Opera Variations
    • Opera/6.0 (Macintosh; PPC Mac OS X; U) [en]
    • Opera/7.11 (Linux 2.4.20-18.9 i686; U) [en]
    • Opera/7.50 (X11; Linux i686; U) [en]
    • Mozilla/4.0 (Windows NT 5.0;US) Opera 3.60 [en]
    • Mozilla/4.0 (compatible; MSIE 5.0; Windows NT 4.0) Opera 5.11 [en]
    • Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Opera 7.50 [en]
  • Gecko Browsers
    • Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.3.1) Gecko/20030524
    • Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20030208 Netscape/7.02
    • Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.0.1) Gecko/20030306 Camino/0.7
    • Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040612 Firefox/0.8
  • KHTML-Based
    • Mozilla/5.0 (compatible; Konqueror/3.1; Linux)
    • Mozilla/5.0 (compatible; Konqueror/3.2; Linux) (KHTML, like Gecko)
    • Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.2 (KHTML, like Gecko) Safari/125.8
  • Others
    • Lynx/2.8.4rel.1 libwww-FM/2.14 SSL-MM/1.4.1 OpenSSL/0.9.6h
    • IBrowse/2.2 (AmigaOS V45)
    • Dillo/0.8.1
    • NCSA Mosaic/3.0.0 (Windows x86)
    • Mozilla/4.5 (compatible; OmniWeb/4.2.1-v435.9; Mac_PowerPC)

The first thing you’ll probably notice is that most of these claim to be Mozilla. This is a holdover from the early days of the Browser Wars. Netscape was frustrated with what could be done with HTML 2, and started building its own extensions. Web sites would check to see if the browser was Netscape (they used Mozilla as their code name) in order to decide whether to send the enhanced page or the plain one. Microsoft, hoping to get in on the Web action, wanted all of these sites to send the enhanced pages to their browser, so they identified it as Mozilla with a “compatible” note, and the real name in the comments.

So now you see things like Mozilla/4.0 (compatible; MSIE 5.22; Mac_PowerPC) — which is not Netscape 4.0, as the basic version states, but is actually Internet Explorer 5.22.

Moving along, we find browsers like Opera, which used the same reasoning as IE, but a different format: Mozilla/4.0 (Windows NT 5.0;US) Opera 3.60 [en] So for Internet Explorer, you have to look inside the parentheses, right after the word “compatible.” But for Opera, you had to look after the parentheses.

At the height of the Browser Wars, Netscape decided to release the source code for version 5 under an open-source license, allowing anyone to look at the code, modify their own copy, and suggest improvements or bug fixes. They called this code Mozilla, to distinguish it from the finished Netscape browser. This was problematic, though, because putting Mozilla at the beginning would simply look like another version of Netscape. If you had Mozilla version 0.1alpha, you didn’t want it to look like it was really Netscape 0.1, because then the server would assume you couldn’t handle things like JavaScript, frames, tables, plugins, etc. Netscape and Mozilla.org went through a number of different plans, finally settling on using Mozilla/5.0 to start, putting the “real” Mozilla version at the end of the parentheses, then putting detailed build information and any “official” browser names (like Netscape, Beonex, Camino, Firefox, etc.) after the parentheses. So you end up with an ID like Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20030208 Netscape/7.02 for Netscape 7.

Meanwhile, Netscape was losing ground to Microsoft. Netscape 4 and IE 4 were comparable, and Microsoft was bringing the full weight of marketing to promote their free-as-in-beer alternative. More importantly, Microsoft was relying on a basic human trait to do their work for them: laziness. By tying IE to Windows and making it the default web browser, they virtually guaranteed that the vast majority of people buying a new PC would start using IE. (This is not conjecture, this is fact: Microsoft was convicted of abusing their near-monopoly on the desktop to gain a monopoly on the web.) And with Netscape 5 delayed by rebuilding their code from scratch, IE 5 easily surpassed Netscape 4 both in technology and market share.

So at the end of the decade, Internet Explorer had become the prevalent web browser. People stopped testing pages in anything but Internet Explorer. Some of them were amateurs who didn’t know better, some were professionals who were frustrated by Netscape 4’s limitations or limited by deadlines or funding, and it became easier to just discount the shrinking Netscape market. Smaller projects, such as Opera (now the #3 browser) realized they needed a way to get into sites that blocked non-IE browsers. As a result, the default identification for Opera 7.5 is Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) Opera 7.50 [en] — identifying itself simultaneously as Netscape 4, IE 6, and Opera 7. (Fortunately, Opera does allow you to set it to “do the right thing” and identify itself with the more sensible Opera/7.50 (Windows NT 5.0; U) [en].

But wait, it gets even better!

Enter Apple. Prudently realizing they might not want to rely on Microsoft for the default browser on the Macintosh, and also noticing that there were several high-quality rendering engines available to use as the basis of a new program, they settled on KHTML, the code used by KDE’s Konqueror browser. KHTML, like Mozilla, had standards compliance as one of its goals, so they decided to leverage all the post-Mozilla 1.0 articles which recommended checking for the phrase “Gecko” to determine whether you could rely on the browser being able to handle advanced features that IE ignores. So their beta called itself Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/60 (like Gecko) Safari/60. People were appalled. Mozilla aficionados, already upset that Apple had chosen another program, complained that they were diluting the meaning of Gecko by using it on a browser that didn’t behave in exactly the same way. KDE fans complained that Konqueror would be further marginalized because people would start looking for “AppleWebKit” or “Safari.” They eventually compromised by changing the wording to “KHTML, like Gecko” with the KDE people adding “KHTML” to Konqueror’s ID. Strangely, even now Safari doesn’t use its actual version number. Going by what it reports, you’d think it was Safari 125.2.

So now there are at least four major places browsers put their real names:

  • Name/version
  • Mozilla/x (compatible; name/version)
  • Mozilla/x (details; version)
  • Mozilla/x (details) more details name/version

You’d think these would be enough, right? Wrong. I’ve seen browsers use all of the following:

  • Mozilla/5.0 (X11; U; Linux i686; en-US; SkipStone 0.8.1) Gecko/20020417
  • Mozilla/5.0 (X11; U; Galeon; en-US; 0.11.3)
  • Mozilla/5.0 (X11; U; Linux i686; en-US; Galeon) Gecko/20010701
  • Mozilla/4.61 [en] (X11; U; ) – BrowseX (2.0.0 Linux 2.4.9-31)
  • Links (0.96; CYGWIN_NT-5.0 1.3.22(0.78/3/2) i686)

Does the real name go in the middle of the parentheses? At the end? Before? After? Is the version number put after a slash or a space? Is it put in the parentheses instead? Is it even there? What were these people smoking?

So you can see, just figuring out the real name and version number of a browser is far from easy.

Now, suppose you want to identify what operating system it’s running. (Insert maniacal laughter.) Let’s assume for the moment that you know where to look. Some of them are easy, like Windows NT 4.0 or PPC Mac OS X or Linux i686 — or are they?

Somewhere around version 4, Netscape started identifying all Unix-like OSes as X11 (since the program ran under the X windowing system), with another field to identify SunOS, BSD, Linux, etc. So for those, you need to look in two places. (And then there’s trying to pick out Solaris versions from SunOS…)

Then there’s Windows. You can spot Windows NT or Windows 98 but some of them are truly bizarre. Windows 2000 claims to be NT 5.0. Windows XP claims to be NT 5.1. And Windows Me first claims to be Windows 98, then adds an extra field identifying itself as Win 9x 4.90 — really!

If you want to figure out whether the browser is running on a Mac, it might be in the form Mac_PowerPC, PPC Mac OS X, or PPC Mac OS X Mach-O (those are all from the same computer, by the way, using IE 5.2, Safari, and Camino).

If all you need to know is whether your audience is using Windows, Macs, or something Unix-like, your best bet is to just look for Win, Mac or X11. Don’t look for PPC or PowerPC by itself, because you’ll catch people running Yellow Dog Linux or MorphOS. (Edit Aug. 19: Or, it seems, Windows CE. See comments for more info.)

And trying to guess capabilities based on the browser’s (supposed) name is just asking for trouble. You’re better off testing based on actual capabilities. Want to support browsers that don’t have JavaScript? Use a <noscript> block. Want to send XHTML to browsers that can handle it and HTML to browsers that can’t? Check the Accept header. Worried about what what DHTML methods to use? Have your JavaScript check what’s available.

Unfortunately, trying to read the User-Agent name is like trying to read a map with no key. You need to know what you’re looking for.

(Whew — finally posted that! I started writing it a year ago, and found it in my Drafts folder today.)

View Kelson Vibber's LinkedIn profileView Kelson Vibber's profile on LinkedIn

29 thoughts on “What’s in a User-Agent String?

  1. Fran

    Thanks man, I really can’t stand this crap with browser wars making it just that much harder for a developer to do his thing. Why don’t they just come up with a standard way 2 find out exactly which browser your code is executing on?
    AAARGH!!!

  2. Gobelet

    Hello,

    Actually, if you watch closely in Windows “About…” screen, on XP it says “Windows NT 5.1″ and on Windows 2000 it says “Windows NT 5.0″, since the two OSes are based on NT code. Every Windows OSes are now based on NT code, like Windows 2003 Server (Windows NT 5.2) and future codenamed Longhorn OS (Windows NT 6.0). And Windows 98 Third Edition was subbed Windows Millenium, that’s why Windows Millenium version il Win9x 4.90.

    I hope I clarified the situation :)

  3. Kelson Post author

    Thanks for the background. Anyone wondering why there’s a disconnect between the internal and marketing names, here’s your answer! (And thanks for the info about Windows Server 2003 — I haven’t worked with it yet, so I wasn’t aware of its “real” version number.)

    One more thing: to clarify the point I made about Windows Me, it doesn’t just call itself Win9x 4.90 (at least, not in IE). Here’s the complete UA string I collected from IE6 on Windows Me:

    Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)

    It actually identifies the operating system twice — first as Windows 98, then as Win 9x 4.90. Thankfully, Mozilla-based browsers just pick one.

  4. Kelson Post author

    Interesting discovery in the server log:

    Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320)

    I don’t know whether this means there are WinCE devices based on the PowerPC architecture, or whether it’s an abbreviation for PocketPC and they’re just ignoring the previous use of the acronym. Something to look up…

  5. Kelson Post author

    One more thing: it looks like Opera on Windows Me actually identifies itself as being on Windows ME, even with UA spoofing enabled:

    Opera/7.54 (Windows ME; U) [en]
    Mozilla/4.0 (compatible; MSIE 6.0; Windows ME) Opera 7.54 [en]

  6. Wim

    This thing:
    Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320)
    is from a IPaq for sure. So they probably mean PocketPC by it.

  7. Kelson Post author

    Well, WinXP SP2 adds another item to IE: SV1, standing for “Security Version 1,” which appears right after the Windows version. The example given is Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 1.0.3705).

    Supposedly this will be added as they backport the security features to other versions of Windows. I’m not convinced of the label’s usefulness, but one of the comments refers to some problems with Acrobat and the new security features, so it may be good for something other than malicious sites deciding which exploit to try.

  8. David

    “Windows XP claims to be NT 5.1″. I just wonder if both XP Professional and XP Home Edition identify themselves the same way? What I know Pro-version is build on NT, while Home-version is “like a new” ME (or 9x).

  9. Kelson Post author

    No, Win XP Home is also based on NT. They finally ditched the Win95/98/Me code. XP Home Edition is just stripped down so it doesn’t have all the features of XP Pro.

  10. mark

    just need to mention that i also have difficulties. created a stats site but the damn browsers make life hard! perhaps i better show which renderer one uses instead of the browser.

    bah

  11. Domi

    I recently got this “Warning” when i opened my Opera browser(7.23): Your Web browser is Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Opera 7.23 [en] and that i have a bug and that i have to do something about it, dunno sure what i was supouse to do….so whats all about, is it a bug, should i do something or just mind my own busines? 10x.

  12. Kelson Post author

    Domi: It’s hard to guess without seeing the actual warning, but I would suggest you upgrade to a newer version. Opera is at version 7.54 right now, and I know there have been some security fixes since 7.23. If you’re registered, it’ll still be valid, and if you’re not, well, it’s still free! But go straight to http://www.opera.com — don’t click on a link if the warning gives you one, just in case it’s spoofed.

    If you’re still not sure, ask around the support forums at the Opera website. Someone there will probably have a better idea than I do.

    Mark: Speaking as a web developer, I can say I’d definitely find stats-by-renderer useful! When it comes down to it, browser stats are useful for two things: tailoring the page to display correctly for as many viewers as possible, and targeting the audience. With so many browsers reusing code or components — various browsers that just embed Internet Explorer, all the browsers based on Gecko, the new crop of Mac browsers built on Webcore — the underlying engine is the most important for us.

    Of course, people trying to gauge an audience will want to know other things, so it’s good to have the market share info as well. One thing I’ve found frustrating about Webalizer is that all the options for browser statistics are either too detailed or too loose. I want to know the Win/Mac/Linux breakdown, but I don’t want separate entries for IE 6.0 on Win2k, Win98, WinXP, etc., just one number for IE 6.0. AWStats is somewhat better, since it breaks it down several ways in the same report, but if I want to piece together the number or percentage of people using Netscape 4.x, I still have to add up a dozen rows of stats.

  13. Domi

    10q Kelson, i already did that and yes the register was still valid, now i have another problem, its seams that i have a trojan, wich my Kaspersky AV does not detect, its called Win32.Keenval or something, i got the warning from Internet Explorer Browser(weird), my question is, do i have it or it was a trick of some hacker or whats going on? I am counfused. Do u have any sugestion of a anti spyware tool or software that i should install? Grisoft had one but i cant seeam to find it anymore over the internet, pls help, 10q. Oh!.. i almost forgot…wich one of the anti virus on the market is the best? as i said i have Kaspersky and in the war against viruses it has his wins but it has his losts too, so…what do u sugest? 10 anticipated.

  14. Domi

    hi again, i just went to Home Page of Opera and a pop up came saying: Errors in your computer’s registry database, if present, could case slow performance, slow startup, or erratic operation including system freezes and crashes.

    To ensure that your system is operating correctly, we recommend that you run Registry Cleaner now, which will scan for and correct up to 20 different registry errors that could be causing slow performance.

    Click OK to download Registry Cleaner which will scan for and correct any system for registry errors now.
    I think this is how i found out about that Keenval virus too, i forgot how, i didnt downloaded the soft that was cleaning my Registry cuz it was also saying that : This file has been independantly cerified as a virus, spyware or something, what do u think it is and should i do?? 10x again.

  15. Kelson Post author

    As far as I know, Opera’s home page doesn’t have any pop-ups. They’re probably being generated by a piece of adware on your computer.

    Just remember: never install something advertised in a pop-up!

    Anyway, I’m not the person to ask about how to clean out your computer. I know that recent versions of Norton Antivirus will detect adware. I don’t know if Kaspersky will do the same. Of course, the most sure-fire way to clean it is to back up your files, reformat your hard drive, and reinstall Windows.

  16. mark

    i’ll make sure my free version will search for renderers instead of browsers. i had enough UA’s that do display the renderer (mostly gecko) but not the browsername.

    tricky stuff when not all parties follow an exactly defined standard.

  17. Domi

    Hey Kelson, i am sorry that i insist with the “problem” but look what i got again when i was surfing the net(i was on http://www.amazon.com) again:
    Browser Bug?
    Attention: There appears to be a bug in the web browser you are currently using. Here are some ways to get around the problem:
    To return to the page you were previously on: –click the BACK button on your browser’s navigation bar until you reach the desired page.
    To checkout –click on the shopping cart icon at the top of the page and proceed through the checkout process using the standard server (instead of the secure server). You can phone or fax the credit card information to us.
    Your Web browser is Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Opera 7.54 [en].
    Go to home page now.

    this happened befor i was using 7.54 and now after….what do u think?

  18. Kelson Post author

    Domi: I’m sorry, this is not a tech support forum. It is a post on my personal weblog dealing with how to identify web browsers. I can’t debug your computer remotely, and if I could, this wouldn’t be the place to do it.

    If you have a problem with Opera, go to the Opera support forums. If you have a problem with Amazon, go to Amazon’s support page. They are more likely than I am to be able to identify your specific problem.

  19. Kelson Post author

    I found one today that looks like Longhorn: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0; SV2; .NET CLR 2.0.1078

    * It calls itself Mozilla/5.0, catching up to the competition. :)
    * It does indeed consider itself to be NT 6.0.
    * It is apparently Security Version 2.
    * Apparently betas of IE 7 exist somewhere.

    I also found that some installations of Opera will use the public Windows version (Windows XP) instead of the technical name (Windows NT 5.1). Whenever I’ve tested it, it’s followed the same pattern as IE. Either that or there’s a UA spoofer out there that isn’t quite accurate.

  20. Pingback: Trusted Site, Untrusted Browser | K-Squared Ramblings

  21. Pingback: Simple Browser Categorization | K-Squared Ramblings

  22. les griffiths

    Full Browser Version is:mozilla/4.0 (compatible; msie 6.0; windows nt 5.1; sv1; .net clr 1.1.4322)Media Player Version is:unknown click here to test the reload script

    this is what I am getting cant play some music sites on Ntl Broadband plus can you suggest something

  23. Kelson Post author

    Les: This is not a tech support forum, it’s a post on my personal blog describing how to identify web browsers based on the UA string they send to the server.

  24. Abu

    Kelson: This may be slightly off the subject of your blog, but your opinion would be appreciated even if only breif. I am currently developing a program which identifies user agents, user agent versions, operating sytems and operating systems versions using regular expressions and php. I have a list of about 13,500 sample user agent strings which I have tested it against with about 99% accuracy. I have so far built it to detect the main browser types and operating systems only, but adding others is easy. I have built as part of my own web site program which I intend to market as a package. But I am wondering if you think my browser detection program would be a viable product within itself to market?
    Anyone?

  25. udi

    it would be good to see some standard web development happening that is browser independent. to this end, changing the user agent string to something generic would be useful. does anybody know how to achieve this in IE. i already have an extention for firefox.

  26. sbt

    hmmm april 2006.

    “changing the user agent string… does anybody know how to achieve this in IE”

    proxomitron (you choose from among various ua filters)

    for ie only, search fiddler tool

  27. Pingback: No, They Don’t Read | K-Squared Ramblings

Comments are closed.