User Agent List

Picking a user agent that does not get you blocked

The default user agent your HTTP library sends is the fastest way to get blocked. A header that reads python-requests/2.32.3 or Go-http-client/2.0 is not a browser and every anti bot layer knows it. Swapping in a real browser string is the first thing anyone doing automation should fix.

Where people go wrong is treating the user agent as the whole job. It is one header. If you claim to be Chrome 152 on Windows but you do not send the headers Chrome sends, in the order Chrome sends them, with a matching TLS handshake, the claim falls apart on the first check. Pick a string from the list above and then make everything else agree with it.

Rules that actually help

• Use current versions. Chrome 98 on Windows 7 does not exist in the wild any more. An old string is as suspicious as no string.
• Rotate per session, not per request. A session that is Chrome on request one and Safari on request two is obviously scripted. Keep an identity for the length of a session.
• Match the platform to the behaviour. If your user agent says iPhone, do not send a desktop viewport, a desktop Accept-Language and a desktop screen size to the JavaScript on the page.
• Pair it with the IP. Fifty different browser identities from one address is a pattern, not a disguise. Rotate through a proxy list so the addresses vary too.
• Do not invent strings. A version number that was never released is a perfect fingerprint. Copy a real one.

Using these strings in code

Python, with requests:

headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"}
requests.get(url, headers=headers, proxies=proxies, timeout=10)

curl:

curl -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" https://example.com

If you want the whole list in your script instead of copying one at a time, the text export gives you one per line: /export/user-agents.txt?source=latest for the curated set, or /export/user-agents.txt?browser=Chrome&device=desktop&limit=500 for a filtered slice of the collected table.

Where these come from

The curated section is maintained by hand against current browser releases, and the date at the top of the page tells you when it was last checked. The collected table is different. Those strings were sent to this site by real clients, deduplicated and parsed. That is why you will find odd ones in there, old Android builds, in app browsers, regional browsers you have never heard of and a healthy number of crawlers. That mix is closer to real traffic than any generated list.

We store the string only. It is not linked to an IP address or to any visitor record.

Common questions

What is the latest Chrome user agent?

On Windows, Chrome 152 sends Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36. The three zeros are deliberate. Chrome froze the minor version fields so the header leaks less.

Why do Windows 10 and Windows 11 look the same?

Both report Windows NT 10.0. Microsoft never bumped the token, so the user agent alone cannot tell them apart. The Sec-CH-UA-Platform-Version client hint can, if the browser sends it.

Why does Brave look like Chrome?

On purpose. Brave reports the plain Chrome string so that its users blend into the largest possible crowd. Adding a Brave token would make its users easier to single out, which is the opposite of what the browser is for.

Are the crawler strings safe to trust?

No. Anyone can send a header that says Googlebot. If you are deciding what to serve based on a crawler identity, verify it with a reverse DNS lookup on the request IP and then a forward lookup back, which is what Google and Bing both recommend.

Is there an API for this?

The text export is the API. It is a plain GET, no key needed, and it accepts the same filters as the table. If you need proxies alongside it, we have a free proxy API as well.