User-Agent Client Hints: What Replaced the User-Agent String

For three decades, every browser has introduced itself to every website with a single line of text: the user-agent string. That line grew long and confusing, sites parsed it badly, and it handed out a lot of identifying detail to everyone. User-Agent Client Hints are the Chromium project's answer. The browser shares a few basic facts by default and the rest only when a site asks.

What was wrong with the user-agent string

A typical user-agent string is a pile of historical compatibility tokens. Chrome's version claims to be "Mozilla", "AppleWebKit", "KHTML, like Gecko" and "Safari", all at once. Websites parse it with regular expressions, often wrongly, and serve broken pages to browsers they misidentify.

It was also a privacy problem. The full string, with exact browser build, operating-system version and, on Android, the phone model, went out with every request to every server. That is passive fingerprinting surface: the server learns it without running any code, and the browser can't tell who used it.

User-agent reduction

Chromium-based browsers responded by freezing most of the string. The exact operating-system version, the device model and the minor browser version are replaced with fixed values:

• Windows NT 10.0; Win64; x64 on every version of Windows 10 and 11;
• Macintosh; Intel Mac OS X 10_15_7 on every Mac;
• Linux; Android 10; K on every Android device;
• 0.0.0 in place of the minor version, as in Chrome/143.0.0.0.

The major version is still real. Safari has frozen the macOS version in its string too. Firefox has not adopted Client Hints and still sends its own, comparatively short, string.

How Client Hints work

Client Hints come in two tiers.

Low-entropy hints are sent with every request as headers, and are available to scripts through navigator.userAgentData:

Sec-CH-UA: "Chromium";v="143", "Google Chrome";v="143", "Not)A;Brand";v="8"
Sec-CH-UA-Mobile: ?0
Sec-CH-UA-Platform: "Windows"

High-entropy hints are only provided on request. A server asks for them with an Accept-CH response header, and the browser includes them in later requests to that site. A script asks with getHighEntropyValues():

const hints = await navigator.userAgentData.getHighEntropyValues([
  "platformVersion", "architecture", "bitness", "model", "fullVersionList",
]);

The available high-entropy values are architecture, bitness, form factors, full version list, model, platform version and WoW64. The odd "Not)A;Brand" entry is called GREASE. The specification requires browsers to include an arbitrary extra brand, so that sites don't hard-code an exact list.

Why the split matters for privacy

The detailed values haven't disappeared. A site that wants them can still get them. What changed is that a site has to ask. Asking is visible: in a server's Accept-CH header, or in a script call that browser tools and researchers can observe. That turns passive fingerprinting into active fingerprinting, which the W3C's fingerprinting guidance treats as preferable because it can be detected and limited.

Browsers can also decide what to return. From Chrome 144, the high-entropy values can be restricted through Permissions-Policy, so a site can stop embedded third parties from receiving them.

What developers gain

Some questions can only be answered with Client Hints. Microsoft documents that Windows 11 is distinguishable from Windows 10 only through the platform version hint, which is 13 or higher on Windows 11. CPU architecture and bitness let a download page offer the right installer for an ARM laptop.

Because Firefox and Safari don't implement Client Hints, sites still need a sensible fallback. Feature detection, rather than browser detection, remains the more robust approach for most purposes.

See your own values

The Client Hints test shows the low- and high-entropy values your browser returns, and which ones it withholds. The What Is My Browser page shows the reduced user-agent string next to them.