User Agent Parser
Paste one user-agent string, or a whole column of them out of a sign-in log, and read what each one claims to be.
Only the first 64 KB of what you pasted was read.
Modern browsers send a reduced, largely frozen user-agent string, so your own browser’s parse may be less specific than a full string pasted out of a log.
| # | Browser | Version | OS | Device | Client |
|---|
Select a row to see its full parse.
Parsed
Raw string
This line was longer than 1 KB and was cut before parsing.
What a user agent can and can't tell you
A user-agent string is self-reported by the client. Nothing verifies it — any script, scanner, or browser extension can send whatever it likes, and plenty do. Read what comes back here as a claim made by whatever sent the request, not as a fact about the device behind it. That matters most in exactly the place these strings usually come from: a sign-in log you are reading because something looked wrong.
Modern browsers also deliberately say less than they used to. Chrome freezes its minor version and coarsens platform detail; Safari has reported a near-static string for years; iPadOS sends a desktop-class user agent that is indistinguishable from a Mac. Where a parse runs into one of those limits, this page says so inline instead of printing a confident answer. A field the string doesn't carry is shown as an em dash — never as “Unknown”, and never filled in with a plausible guess.
Reading UA strings out of logs
Entra ID sign-in logs, IIS cs(User-Agent) columns, and most firewall and proxy
exports all carry the raw header. Paste the whole column: each line is parsed independently,
blank lines are skipped, and the batch table can be exported back out as CSV to join against
whatever you pulled it from. Lines longer than 1 KB are truncated before parsing — a UA that
long is a wrapped or mangled log line, not a real header — and the row is marked so you know
the parse saw only part of it.
Automated clients
Some strings are worth spotting immediately because they aren't a person at a browser. The list below is hand-written and matched literally — a row is tagged only when its string actually contains one of these. The tag is informational: a Googlebot hit on a public site is expected, and curl is how a great deal of monitoring works. It tells you what kind of thing made the request, not that anything is wrong.
Googlebot— Googlebotbingbot— bingbotcurl/— curlWget— Wgetpython-requests— python-requestsGo-http-client— Go-http-clientokhttp— OkHttpHeadlessChrome— Headless ChromePowerShell— PowerShellaxios— axios
Related
If the string came out of an email investigation rather than a sign-in log, the Email Header Analyzer reads the rest of the message source. For a token out of the same Entra log, JWT Decoder takes it apart the same way this page does — locally, with no network calls.