FakecreditcardHow a user agent string is built
Every browser sends a User-Agent header with each request. Take a current Chrome on Windows:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/157.0.0.0 Safari/537.36
Mozilla/5.0— a historical token every browser sends for compatibility.(Windows NT 10.0; Win64; x64)— the platform. Windows 11 also reports NT 10.0.AppleWebKit/537.36 (KHTML, like Gecko)— the engine lineage; Chrome’s Blink still reports WebKit 537.36.Chrome/157.0.0.0— the browser and its major version; the minor parts are always zero now.Safari/537.36— another compatibility token.
Edge appends Edg/ (EdgA/ on Android), Opera OPR/ and Samsung Internet SamsungBrowser/ to the same Chromium string, and on iPhone Chrome, Firefox and Edge identify as CriOS, FxiOS and EdgiOS on top of a Safari string — which is why a parser must check for them before it checks for Chrome or Safari, and why an iPad in desktop mode looks exactly like a Mac.
Frozen and reduced user agents
To limit fingerprinting, browsers stopped telling the truth about details. Chrome’s reduced user agent always reports Windows NT 10.0, Mac OS X 10_15_7 or Android 10; K and zeroes the minor version. Safari has reported macOS 10.15.7 for years, and on iPhone and iPad it now reports a frozen iOS 18 version instead of the real one (the strings here use OS 18_7). Firefox reports Mac OS X 10.15. The strings generated here follow these rules — a user agent claiming Chrome/157.0.7012.88 or a device model inside a Chrome Android string is one that no current Chrome sends, and that is easy to flag as fake.
The exact OS version, device model and full browser version are available in Chromium browsers through User-Agent Client Hints. Over HTTPS, Chromium browsers send the low-entropy hints Sec-CH-UA, Sec-CH-UA-Mobile and Sec-CH-UA-Platform with every request; choose HTTP headers + Client Hints to get them next to each user agent, consistent with it, plus an Accept-Language header in the language you pick. Detailed values such as Sec-CH-UA-Platform-Version are high-entropy hints: a server must ask for them with an Accept-CH header, or a script with navigator.userAgentData.getHighEntropyValues().
Using generated user agents in code
Pick cURL, Python (requests) or Playwright (Node.js) as the output and the generator writes ready-to-run code with your user agents. A few rules keep tests realistic:
- Keep headers consistent. A Chrome user agent with no
Sec-CH-UAheaders, or with a Firefox-style header order, stands out. Bot-detection services also compare the TLS and HTTP/2 fingerprint with the claimed browser, so a Python client with a Chrome user agent is still recognisable. - Don’t rotate within a session. Real users keep one browser for a whole visit; changing the user agent on every request is a classic bot signal.
- Weight like real traffic. The generator already favours Chrome on Android and Windows and Safari on iPhone, as real traffic does.
Spoofing a user agent doesn’t make automated access to someone else’s site acceptable: follow their terms of service and robots.txt, and keep request rates low.
Change your browser’s user agent
- Chrome and Edge: open DevTools, then More tools → Network conditions, untick Use browser default and paste a user agent. It applies while DevTools is open.
- Firefox: in
about:config, create the string preferencegeneral.useragent.overridewith the user agent; delete it to go back. - Safari: enable the Develop menu in Settings → Advanced, then choose Develop → User Agent.
Verifying real crawlers
Anyone can send a Googlebot user agent. To confirm a request really comes from Google or Bing, do a reverse DNS lookup on the IP — it must end in googlebot.com, google.com or, for some user-triggered Google fetchers, googleusercontent.com; Bingbot resolves to search.msn.com — then a forward lookup that returns the same IP. Google and Microsoft also publish their crawler IP ranges as JSON files. Never allow-list on the user agent alone.
Frequently asked questions
What is my user agent?
It is shown in the box above, together with the browser, version, operating system and device type we detect from it. It is read in your browser with navigator.userAgent; nothing is sent to us.
Are these user agents real and up to date?
They are built from the exact templates current browsers send, with versions taken from Google’s, Microsoft’s and Mozilla’s release feeds (Chrome 157, Edge 156, Firefox 159) and Safari 27.0. Choose Latest 3 or 6 major versions to mix in older releases, as real traffic does.
Why does every Windows user agent say Windows NT 10.0?
Because browsers froze the platform token: Windows 11 reports itself as NT 10.0 to avoid breaking old sniffing code and to reduce fingerprinting. Request the high-entropy Sec-CH-UA-Platform-Version client hint to tell Windows 10 and 11 apart: version 13 or higher means Windows 11.
Can I use these user agents for web scraping?
You can use them in your own tests and in scripts that respect each site’s terms and robots.txt. A realistic user agent alone won’t make a script look like a browser, and it never justifies getting around a site’s access controls.
Is changing my user agent illegal?
Generally not: changing the user agent your browser or script sends is common in development and testing. Depending on the country and the site’s terms, it can become a problem when it is used to get around access controls or to misrepresent who you are.