User Agent Parser

Paste one user-agent string, or a whole column of them out of a sign-in log, and read what each one claims to be.

Everything runs in your browser. Parsing happens entirely in this tab — nothing you paste is uploaded, and the page makes no network requests of any kind while it works.

A user-agent string is self-reported by the client, and nothing verifies it — any script, scanner or extension can send whatever it likes. Read what comes back here as a claim made by whatever sent the request, not a fact about the device behind it.

Modern browsers also say less than they used to: Chrome freezes its minor version and coarsens platform detail, and iPadOS sends a desktop-class string indistinguishable from a Mac. Where a parse runs into one of those limits this page says so inline, and a field the string doesn't carry is shown as an em dash rather than filled in with a plausible guess.

Reading UA strings out of logs

Entra ID sign-in logs, IIS cs(User-Agent) columns, and most firewall and proxy exports all carry the raw header. Paste the whole column: each line is parsed independently, blank lines are skipped, and the batch table can be exported back out as CSV to join against whatever you pulled it from. Lines longer than 1 KB are truncated before parsing — a UA that long is a wrapped or mangled log line, not a real header — and the row is marked so you know the parse saw only part of it.

Automated clients

Some strings are worth spotting immediately because they aren't a person at a browser. The list below is hand-written and matched literally — a row is tagged only when its string actually contains one of these. The tag is informational: a Googlebot hit on a public site is expected, and curl is how a great deal of monitoring works. It tells you what kind of thing made the request, not that anything is wrong.

  • Googlebot — Googlebot
  • bingbot — bingbot
  • curl/ — curl
  • Wget — Wget
  • python-requests — python-requests
  • Go-http-client — Go-http-client
  • okhttp — OkHttp
  • HeadlessChrome — Headless Chrome
  • PowerShell — PowerShell
  • axios — axios

Related

If the string came out of an email investigation rather than a sign-in log, the Email Header Analyzer reads the rest of the message source. For a token out of the same Entra log, JWT Decoder takes it apart the same way this page does — locally, with no network calls.