Home/SEO, Domain & Network Inspector Tools/Browser User-Agent Client Hints (UA-CH) Header Inspector

Browser User-Agent Client Hints (UA-CH) Header Inspector

Inspect live navigator.userAgentData client hints, test high-entropy values via getHighEntropyValues(), and generate production Accept-CH and Nginx rules.

Inspection & Emulation Engine

RFC 8942 / RFC 8941 Structured Headers Audit

Active Client Environment

Legacy User-Agent Only

Navigator User-Agent (Legacy String):

Detecting user agent...

Default Low-Entropy Signals (Immediate)

PlatformNot Reported

Mobile FormNo (?0)

Brands (Sec-CH-UA)

No Chromium brands detected (e.g. Firefox or Safari)

High-Entropy Hints Probe

Simulate how a remote server obtains deep hardware flags by executing client-side navigator.userAgentData.getHighEntropyValues().

Structured Client Hints Output

Entropy Tier

Low Entropy

Device Target

Desktop (?0)

Architecture

Not Requested (Requires Accept-CH)

Screen DPR

Client Request Headers (Outgoing HTTP / RFC 8942)

# Low-Entropy Client Hints (Transmitted by Default)
Sec-CH-UA: "Not Detected";v="0"
Sec-CH-UA-Mobile: ?0
Sec-CH-UA-Platform: "Unknown"

# High-Entropy Client Hints (Server must opt in via Accept-CH)
Sec-CH-UA-Platform-Version: "Not Requested (Requires Accept-CH)"
Sec-CH-UA-Arch: "Not Requested (Requires Accept-CH)"
Sec-CH-UA-Bitness: "Not Requested (Requires Accept-CH)"
Sec-CH-UA-Model: "Not Requested"
Sec-CH-UA-Full-Version-List: "Google Chrome";v="128.0.6613.114"
Sec-CH-Viewport-Width: 1280
Sec-CH-DPR: 1
Sec-CH-Prefers-Reduced-Data: ?0

Server-Side Opt-In Headers (Accept-CH & Critical-CH)

Accept-CH: Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-Viewport-Width, Sec-CH-DPR, Sec-CH-Prefers-Reduced-Data Critical-CH: Sec-CH-UA-Platform-Version, Sec-CH-UA-Model Permissions-Policy: ch-ua-platform-version=(self), ch-ua-model=(self), ch-ua-arch=(self)

Production Implementation Rule: High-entropy hints (Sec-CH-UA-Model, Sec-CH-UA-Platform-Version) are only transmitted over secure HTTPS connections and will never be sent to unverified origins or cross-site subresources without an explicit Permissions-Policy header.

The Architecture of RFC 8942: Transitioning from Monolithic UA to Client Hints

For nearly three decades, the traditional HTTP User-Agentheader was transmitted unconditionally with every web request. This string became an unmanageable catalog of legacy identifiers (“Mozilla/5.0”, “AppleWebKit/537.36”, “KHTML, like Gecko”) that simultaneously leaked invasive hardware telemetry to third parties. User-Agent Client Hints (UA-CH), standardized under RFC 8942 and RFC 8941 Structured Headers, replace this monolithic pattern with deliberate, privacy-preserving negotiation.

Privacy Budget & Anti-Fingerprinting

Passive cross-site browser fingerprinting is curtailed by restricting unprompted request headers to low-entropy attributes, eliminating passive profiling surfaces.

RFC 8941 Structured Headers

Hints utilize machine-parseable structured items: strings in double quotes ("macOS") and booleans formatted with leading question marks (?0 or ?1).

Explicit Server Opt-In

High-entropy hardware data is strictly withheld by the client browser until an authorized server requests it using the Accept-CH response header.

Client Hints Header Dictionary & Entropy Classifications

Header Name	Entropy Class	Syntax Example	Functional Purpose
Sec-CH-UA	Low Entropy	"Google Chrome"; v="128"	Brand identity and major version numbers with GREASE padding.
Sec-CH-UA-Mobile	Low Entropy	?0 or ?1	Boolean indicator whether the browser runs in mobile mode.
Sec-CH-UA-Platform	Low Entropy	"Windows", "Android"	Host operating system name without granular build version.
Sec-CH-UA-Platform-Version	High Entropy	"14.5.0"	Specific operating system kernel or marketing build version.
Sec-CH-UA-Arch	High Entropy	"arm", "x86"	Underlying processor instruction architecture.
Sec-CH-UA-Model	High Entropy	"Pixel 8 Pro"	Mobile hardware model identifier (empty string on desktop).
Sec-CH-UA-Full-Version-List	High Entropy	"Chromium"; v="128.0.6613.114"	Complete, un-truncated browser build version numbers.
Sec-CH-Viewport-Width	Responsive CH	1920	Client viewport layout width in CSS pixels for CDN image sizing.

Comparative Protocol Matrix: Legacy User-Agent vs. User-Agent Client Hints

Examine the core differences in performance, caching mechanics, and privacy between legacy HTTP identification and modern Client Hints:

Feature Dimension	Legacy User-Agent (RFC 7231)	UA Client Hints (RFC 8942)	Operational Impact
Data Format	Unstructured Free Text	RFC 8941 Structured Headers	Eliminates complex, fragile regular expressions in backends
Default Request Payload	~150–250 bytes per request	~40–70 bytes (Low Entropy)	Reduces header bloat across high-frequency HTTP/2 & HTTP/3 requests
Edge CDN Caching	Vary: User-Agent destroys cache hit ratios	Vary: Sec-CH-UA-Mobile	Enables high-efficiency edge caching split cleanly between mobile and desktop
Anti-Fingerprinting Audit	Passive / Untrackable Leak	Server logs must audit Accept-CH	Browser vendors can log and audit servers requesting sensitive hardware flags

Production Deployment Guide: Implementing Accept-CH and Critical-CH

To receive high-entropy client hints, your origin server or reverse proxy must negotiate with the browser during the initial HTTP handshake. Follow these four production rules:

Best Practice Configuration Steps

• Declare Accept-CH at Root: Publish Accept-CH: Sec-CH-UA-Platform-Version, Sec-CH-UA-Model on all HTML responses to establish origin preference for subsequent requests.
• Use Critical-CH for First-Paint Requirements: If server-side responsive rendering requires the device model immediately, declare Critical-CH: Sec-CH-UA-Model to trigger an automated initial HTTP retry with hints attached.
• Delegate via Permissions-Policy: To permit trusted third-party CDNs (e.g., Cloudflare, Fastly, or image resizers) to view hints, declare Permissions-Policy: ch-ua-model=(self "https://cdn.example.com").
• Tune CDN Cache Keys (Vary): Never set Vary: *. Only append the specific client hints your backend consumes, such as Vary: Sec-CH-UA-Mobile, Sec-CH-Width.

Critical Engineering Pitfalls

• Overusing Critical-CH: Marking too many hints as critical can force an extra network round-trip on first-time visitors, degrading Core Web Vitals (LCP/FCP).
• Insecure HTTP Transmission: Modern browsers strip all high-entropy Client Hints if the page is served over plain HTTP. TLS 1.3 encryption is mandatory.
• Ignoring GREASE Values: Failing to handle random brands like "Not;A=Brand" in backend parsers causes uncaught exceptions when parsing the Sec-CH-UA list.
• Assuming Universal Support: Safari and Firefox intentionally do not support high-entropy hints. Always include robust fallback paths based on modern CSS feature queries.

Frequently Asked Questions (FAQ)

What are User-Agent Client Hints (UA-CH) and why are they replacing the legacy User-Agent string?

User-Agent Client Hints (defined in RFC 8942 and the W3C draft) replace monolithic, privacy-invasive User-Agent header strings with granular, structured HTTP headers. By default, browsers only send low-entropy information (browser brand and major version, platform, and mobile status). Servers must explicitly request high-entropy values like device model, exact CPU architecture, and complete OS build version using the Accept-CH response header.

What is the difference between Low-Entropy and High-Entropy Client Hints?

Low-entropy hints (Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform) are sent with every outgoing HTTP request without requiring server opt-in because they do not permit unique passive user fingerprinting. High-entropy hints (Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-UA-Bitness) leak distinct hardware and OS build details, requiring servers to explicitly request them through Accept-CH and HTTPS connection negotiation.

How do Accept-CH and Critical-CH response headers function together?

Accept-CH tells the client which high-entropy headers the server desires for subsequent requests across that origin. Critical-CH designates a subset of hints as non-negotiable for initial page rendering; if the browser did not provide them on the first request, it immediately re-initiates the connection with the requested hints before content is painted.

Why do Sec-CH-UA headers feature bogus brand names like "Not;A=Brand"?

This practice is called GREASE (Generate Random Extensions And Sustain Extensibility). Chromium browsers intentionally inject arbitrary brand tags to prevent downstream web servers and edge proxies from writing rigid, fragile regex parsers that break whenever a new browser engine emerges.

Can client-side JavaScript access User-Agent Client Hints directly?

Yes. Browsers supporting the specification expose navigator.userAgentData. Synchronous access yields low-entropy attributes (brands, mobile, platform). High-entropy data requires calling navigator.userAgentData.getHighEntropyValues(['architecture', 'model', 'platformVersion', ...]), which returns an asynchronous Promise.

Are User-Agent Client Hints supported on Safari and Firefox?

Client Hints are fully standardized and operational across Chromium-based browsers (Google Chrome, Microsoft Edge, Brave, Opera, and Samsung Internet). Apple WebKit (Safari) and Mozilla Gecko (Firefox) currently treat high-entropy UA-CH with caution due to privacy and cross-site fingerprinting concerns, choosing alternative frozen User-Agent string heuristics.

Found this tool helpful? Share it with others!

Share on Facebook

Share on X

Share on LinkedIn

Copy URL