Spoofed UAs
UAs are user-controlled and can be faked.
Fix: Never use UA for security decisions — prefer capability detection.
Search tools and pages.
Parse a User-Agent string into browser, version, operating system, device type, and bot status
Output will appear here...
content bottom • up to 300x250
sidebar • 160x600
Written by Giorgos Kostas. Last reviewed:
User-Agent Parser inspects a User-Agent string and extracts the browser family and version, operating system, device type (desktop / mobile / tablet), and detects common bots and crawlers.
It's useful when auditing analytics, debugging feature-detection issues, or triaging abuse reports.
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15
Browser Safari 17.2 Operating system macOS 10.15.7 Device type Desktop Bot / crawler No Raw Mozilla/5.0 …
UAs are user-controlled and can be faked.
Fix: Never use UA for security decisions — prefer capability detection.
Niche browsers may report as Unknown.
Fix: Extend the pattern list or use a full UA database.
Chrome, Firefox, Safari, Edge, Opera, and bots / crawlers.
No — parsing is client-side.
Yes — GPTBot, Anthropic / Claude, Google-Extended, and Perplexity-Bot are flagged.
No — UA is trivially spoofed. Use real auth signals.
No — it covers common patterns. Use ua-parser-js for an exhaustive match.
Pair with HTTP header and networking tools. You can also browse the full Networking & DNS category for more options.
Paste response headers to audit HSTS, CSP, CORS, X-Powered-By disclosure, and Set-Cookie flags
Passive Access-Control-Allow-Origin matcher — paste a header value plus a list of origins to confirm wildcard, scheme, and subdomain rules
Parse a URL into scheme, host, port, path, query parameters, fragment, and origin — fully client-side
Decode JWTs, verify HMAC, RSA, and EC signatures (paste secret/PEM or fetch JWKS), inspect claims, and visualize the exp/nbf/iat timeline
Calculate network, broadcast, usable hosts, subnet mask, and wildcard for any IPv4 CIDR
Encode or decode Base64 strings
Searchable list of well-known TCP/UDP ports — filter by port number, service name, or description
Parse and pretty-print XML documents with automatic validation and indentation
Scan pasted HTML for missing alt text, labels, and aria attributes in common interactive elements
Detect a number in decimal, binary, octal, or hexadecimal form and output every other base side-by-side in one click.
Convert between angle units (deg, rad, grad, etc.)
Format Angular templates online with cleaner indentation and spacing for HTML, bindings, and interpolation blocks.