User Agent and Client Hints, explained

The short version

Every time you open a web page, your browser introduces itself with a line of text called the User Agent — roughly "I'm Chrome on Windows." It's normal and mostly harmless. Newer browsers also send extra details on request, called Client Hints. The surprising part: trying to fake your User Agent usually makes you more trackable, not less. This guide explains what's shared and what actually helps.

What's actually happening

Think of the User Agent as a name tag your browser wears to every site: "Hi, I'm Chrome version 141 on Windows." Sites use it to serve the right version of a page — the mobile layout for phones, for example. That's genuinely useful and not sinister by itself.

The concern is detail. Older name tags listed a lot (exact versions, device hints), which helped trackers tell people apart. Browser makers have been trimming the tag so it says less. Chrome now rounds off the fine detail and will only hand over extras — like your exact operating-system version — if a site specifically asks, through the newer Client Hints system.

Why it matters to you

• A very detailed name tag helps trackers single out your device from the crowd.
• A fake or unusual name tag can make you stand out even more — like wearing a disguise nobody else wears.
• Mismatches (a tag that says iPhone while everything else says Windows) are easy for sites to spot and are themselves a red flag.

How to fix it

For almost everyone, the honest answer is: don't hand-edit your User Agent. The best privacy comes from using a mainstream browser at its default, so your name tag looks like millions of others. Here's the current state per browser and the one safe adjustment.

Chrome and Edge

1. Leave the User Agent alone. Modern Chrome and Edge already send a reduced name tag — the fine version numbers are zeroed out and the OS detail is generalized.
2. Don't install "User Agent switcher" extensions for privacy. They typically make you more unique and can break sites.

Firefox

1. Default Firefox already sends a fairly generic tag and does not send Chrome's extra Client Hints.
2. If you want it standardized further, turning on Resist Fingerprinting (about:config → privacy.resistFingerprinting = true) pins your tag to a common value — but it has side effects (wrong clock, forced English). Most people don't need this.

Safari (Mac and iPhone)

1. Leave it as-is. Safari keeps a deliberately plain tag, doesn't send Chrome's Client Hints, and on recent iPhones even freezes the reported OS version so everyone looks alike.

The one genuinely private option

Tor Browser gives every user the same User Agent on purpose, so your name tag is identical to everyone else's. If this test is what you care about most, that's the gold standard — at the cost of speed and some convenience.

How to check it worked

Run this site's test and look at the User Agent it reports. On a default Chrome/Edge it should show zeroed version digits and a generalized OS. On Tor it should match the standard Tor value. The thing to avoid is an inconsistent result — for example a Windows tag alongside Mac-only details — which signals spoofing.

If your result was already good

If you scored an A or B, your browser's defaults are already doing the right thing. Don't "improve" it with a User Agent switcher — that usually lowers the grade in real-world tracking. Just keep your browser updated.

Want to go further?

The Advanced version covers the reduced UA string, the Sec-CH-UA Client Hints headers (low- vs high-entropy), navigator.userAgentData, and why consistency beats disguise.

What the User Agent and Client Hints actually are

The User-Agent request header (mirrored in JS as navigator.userAgent) is a legacy free-text string identifying browser, engine, and platform. Historically it carried high entropy: exact browser build, OS version, device model, and a pile of backward-compatibility tokens. User-Agent Client Hints (UA-CH) are the Chromium replacement: a structured set of request headers (Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform) sent by default as low-entropy hints, plus high-entropy hints (Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Arch, Sec-CH-UA-Bitness) delivered only when a site explicitly requests them via the Accept-CH response header. The JS mirror is navigator.userAgentData, with getHighEntropyValues() gating the detailed fields.

Where UA reduction stands

• Chrome's User-Agent Reduction is fully shipped. The UA string and navigator.userAgent/appVersion/platform return reduced values; minor/build/patch are pinned to 0.0.0; the platform OS version is frozen to a fixed token (e.g., "Windows NT 10.0", "Android 10"). Only the major version meaningfully varies between releases. The deprecation origin trial that preserved the full string ended in late 2023.
• Edge follows Chromium and behaves the same.
• Firefox and Safari do not implement UA-CH and send no Sec-CH-UA-* headers; they keep comparatively generic UA strings. Safari (recent versions) also freezes the reported OS version on iOS/iPadOS so it stops leaking point releases.

Why it matters

A detailed UA/UA-CH set adds bits to a composite fingerprint — OS version, CPU architecture, and device model are each discriminating. But UA data is also a classic case where defensive spoofing backfires: because UA-CH, navigator.platform, and the JS environment must all agree, a mismatched or rare value is both detectable and more unique than the honest default. Trackers actively cross-check UA against TLS fingerprint, feature detection, and platform APIs; inconsistency is a signal.

What actually helps

Chrome / Edge

1. Stay on defaults. Reduction already strips most entropy. Sites get high-entropy hints only if they request them, and you can't usefully reduce further without creating inconsistencies.
2. Avoid UA-switcher extensions: they rewrite navigator.userAgent but typically not userAgentData, Sec-CH-UA headers, and platform APIs consistently — a glaring mismatch.

Firefox

1. Default is already generic and sends no UA-CH. privacy.resistFingerprinting=true pins the UA to a standardized value (a fixed Windows Firefox ESR string) to join the RFP cohort — accept the side effects (UTC, en-US, letterboxing) and note the cohort is only as anonymizing as it is large.
2. Do not set general.useragent.override for privacy; it desyncs from other signals.

Safari

1. Minimal UA, no UA-CH, frozen OS version on current iOS — leave it.

Tor Browser

1. All users share one UA string per platform class by design; the strongest option, since your UA carries essentially zero individual entropy.

Verify properly

• Inspect the raw string and hints at browserleaks.com/client-hints and whatismybrowser.com, plus this site's test.
• Confirm: Chrome shows 0.0.0 version segments and a frozen platform; Sec-CH-UA present, high-entropy hints absent unless requested. Firefox/Safari: no Sec-CH-UA. Tor: the standard Tor UA.
• Critically, check for internal consistency across navigator.userAgent, navigator.userAgentData, navigator.platform, and feature detection — disagreement is the real tell.

Trade-offs & gotchas

• Spoofing raises uniqueness in the common case; blending into a default cohort beats a custom disguise.
• UA-CH high-entropy hints are opt-in by site but persist via Accept-CH caching — a visited site can keep requesting them; there is no per-visit "deny" in the UI beyond blocking the site.
• Edge cases of reduction: some device-targeting still works via Sec-CH-UA-Model on mobile when requested; reduction limits passive leakage, not consented hints.
• Firefox RFP UA pinning can break sites that gate features by version and can place Linux/Mac users into a Windows-labeled cohort.
• All of this is software and configuration — no hardware involved.