User-Agent Client Hints: what replaced the User-Agent string
For years the User-Agent string told every site the exact browser version, operating system and often the device model. Chromium browsers have cut it down and moved those details into User-Agent Client Hints: a set of HTTP headers and a JavaScript API that reveal less by default and more only on request.
Check your browser right now
Checking your browser…
Why the User-Agent was reduced
The full User-Agent string was a ready-made fingerprint, sent with every request whether a site needed it or not. Chrome finished reducing it in 2023: the minor version numbers are now zeros, the Windows version is always shown as Windows NT 10.0, and Android device models are hidden. The details did not disappear; they moved to Client Hints, where a site has to ask for them.
What is sent by default
Without being asked, Chromium browsers send three low-entropy hints with every request:
- Sec-CH-UA: the list of brands and major versions, for example Google Chrome and Chromium.
- Sec-CH-UA-Mobile: ?1 on phones, ?0 elsewhere.
- Sec-CH-UA-Platform: the operating system name, such as "Windows" or "Android".
The brand list also contains a deliberately odd entry such as "Not(A:Brand". It changes between versions so that sites parse the list properly instead of matching fixed strings.
High-entropy hints
More detail is available on request: the exact platform version, CPU architecture and bitness, device model and the full version of each brand. A server asks for them with the Accept-CH response header and receives them on later requests; a script gets them from navigator.userAgentData.getHighEntropyValues(). This is, for example, the reliable way to tell Windows 11 from Windows 10: the platform version starts at 13 on Windows 11.
Which browsers support them
Chrome, Edge, Opera, Brave and other Chromium-based browsers. Firefox and Safari do not implement Client Hints, so for them sites still have to read the User-Agent string. A missing hint is therefore normal for Firefox and Safari and says nothing about spoofing.
Why Client Hints help detect spoofing
The same facts now exist in several places: the User-Agent header, the Sec-CH-UA headers, navigator.userAgent and navigator.userAgentData in the page, and the same values inside a Web Worker. A real browser keeps them in agreement. Spoofing tools often change the User-Agent string and forget the hints, or change the JavaScript values but not the headers.
The SpoofLens check compares all of these: the browser version in the User-Agent and in Client Hints, the platform named by each, whether both agree on mobile or desktop, and whether the Sec-CH-UA-Platform header matches what JavaScript reports. Each mismatch is shown with an explanation.
For website owners
- Read Client Hints for Chromium browsers and fall back to the User-Agent string for the rest.
- Request only the high-entropy hints you really use; each one adds identifying detail.
- Do not treat missing hints as suspicious in Firefox or Safari.
- Treat a disagreement between the User-Agent and the hints as a risk signal, not as proof.
Frequently asked questions
- Can I see my own Client Hints?
- Yes. The full SpoofLens browser check shows the Client Hints your browser sent and the values JavaScript reports, side by side.
- Do Client Hints make fingerprinting harder?
- Somewhat: less is sent by default, and asking for more is visible. But a site that requests every high-entropy hint still gets detailed data.
- Is the User-Agent string going away?
- No. It is still sent, only with less detail in Chromium browsers. Many sites and tools still rely on it.