跳至內容
DevTools / User Agent 解析器

User Agent 解析器

The User-Agent header is a forty-year-old string that has accumulated cruft from every browser war since, and it still decides what your analytics records, what your feature detection concludes and whether a crawler is treated as a visitor. This parser breaks a UA string into structured fields — browser and version, rendering engine, operating system, device type, vendor and model, CPU architecture and bot status — and shows the token-by-token breakdown so you can see how the conclusion was reached rather than trusting a black box.

完全在瀏覽器本機執行——不會上傳任何內容。

運作原理

A user agent is a space-separated list of product tokens, each optionally followed by a slash and a version, with parenthesised comments carrying platform details. The first token is conventionally Mozilla/5.0, which has been a lie since 1993: it survives because sites once sniffed for it and browsers that did not send it were served broken pages, and the practice has never been undone. Modern Chrome sends Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36, which names three rendering engines and is accurate about one.

That last example shows why order matters. Safari and Chrome both claim AppleWebKit, and both claim Safari, so a parser looking for the substring Safari will classify Chrome as Safari. The convention is to scan for the most specific token first — Edge, then Opera, then Chrome, then Safari — which is the origin of the Chromium-based browsers adding their own tokens such as Edg/ and OPR/. A parser that gets the order wrong misattributes Chrome's entire market share to Safari, and this has happened in shipped analytics products.

Client Hints were introduced because the UA string is both too long and too coarse. Chrome freezes the minor version, reports a reduced platform string, and expects sites to request high-entropy details such as the exact model and platform version through the Sec-CH-UA headers instead. The consequence is that UA parsing increasingly yields approximate results for Chromium browsers, and any feature detection that depends on an exact version is fragile by design. Feature detection through the platform APIs is more durable than version sniffing.

Bot detection is a separate problem and a heuristic one. Most crawlers, monitors and libraries announce themselves — Googlebot, bingbot, curl, python-requests, Go-http-client — but any client can set the header to anything, so a UA claiming to be Googlebot proves nothing. Real verification requires a reverse DNS lookup confirming the source address belongs to the claimed operator, which is a server-side operation. Use the bot flag for analytics segmentation, never for access control, and never for security decisions.

常見應用情境

  • Diagnose a bug report by confirming which browser and version the reporter is actually using.
  • Segment analytics to exclude bot traffic from conversion figures.
  • Check whether a crawler is passing through your site and which one.
  • Confirm which device class a mobile-only or desktop-only redirect is seeing.
  • Investigate a request log full of unfamiliar UA strings to identify a scanner.
  • Verify that your own client library is sending the header you think it is.

最後更新: 2026-10-14 — 正文以英文顯示，介面已完成翻譯。

常見問題解答

Can I rely on the User-Agent for feature detection?

No, and it has become less reliable every year. Chrome freezes the version it reports, so the exact number is deliberately uninformative, and any client can send any string it likes. Detect features by testing for the API: check that typeof createImageBitmap is a function rather than inferring it from a version number. Version sniffing still has a legitimate use for analytics and for identifying a specific known browser when writing a workaround, but it should not gate whether a feature is enabled.

Why does every browser say Mozilla?

Historical accident. In the 1990s sites sniffed for Mozilla to decide whether to serve modern markup, so browsers that were not Mozilla began claiming to be. Internet Explorer claimed Mozilla and added MSIE; Chrome claims Mozilla, AppleWebKit and Safari; the pattern propagated because breaking it would break sites. It carries no information today and is best read as a fixed prefix that exists for compatibility.

Can I use the UA to detect bots?

For analytics, yes with care. For security, no. A UA string is a self-declaration: a scraper that wants to avoid detection will claim to be Chrome, and one that wants to be allowed will claim to be Googlebot. Verifying a claimed identity requires a reverse DNS lookup on the source IP confirming it belongs to the claimed operator's published ranges, combined with a forward lookup matching back. Anything based on the string alone is trivially bypassed.

Why is the reported browser version sometimes wrong?

Because of version freezing in Chromium-based browsers. Chrome reports a major version that matches reality but a minor version fixed at 0.0.0 in the UA string, precisely to reduce the ability to fingerprint users. The real version is available through the Sec-CH-UA user-agent client hints headers if the server requests them. For any browser released in the last several years, treat the UA version as a lower bound rather than an exact figure.

相關工具