What are User-Agent Client Hints, and why is the User-Agent string shrinking?

The string that used to say everything

The User-Agent header, defined by RFC 9110 §10.1.5, lets a client identify the software making a request — in practice, a long string packed with the browser’s name and version, its rendering engine, and the operating system and version it runs on. AdminKit’s user agent tool parses exactly this string and shows what it reveals about your own current connection. Every server you ever requested a page from received the full string, in full detail, on every single request — nothing about reading it required any special permission or opt-in.

That convenience came at a cost the string’s original design never accounted for: a sufficiently detailed, always-present string is a passive fingerprinting signal, read silently by any server without the visitor ever knowing or agreeing to share that level of device detail. Google’s own documentation on User-Agent Reduction names this directly — “the granularity and abundance of detail can lead to user identification,” and its default availability on every request “can lead to covert tracking.”

What actually changed: a shorter string, plus an opt-in channel

Chromium-based browsers (Chrome, Edge and others) now send a deliberately generalized User-Agent string by default: browser brand, a major version number, broad device category (mobile vs. desktop) and platform name stay accurate, while precise OS build numbers, device model and minor browser version get reduced to fixed, generic values instead of the real figure. Nothing about RFC 9110 required this reduction — it’s a browser-vendor privacy decision layered on top of a header the RFC still defines the same way.

In place of the detail that’s now missing by default, the WICG’s User-Agent Client Hints specification defines a set of separate request headers — Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, and more — that a server has to explicitly ask for before receiving. The spec states its own goal plainly: to let “user agents be a bit more aggressive about removing entropy from the User-Agent string generally by giving servers that really need some specific details about the client the ability to opt-into receiving them.” Detail isn’t gone; it’s moved from “sent to everyone automatically” to “sent only to a server that asked.”

Low-entropy vs. high-entropy hints, and how Accept-CH works

Per MDN’s Client Hints documentation, these hints split into two tiers:

• Low-entropy hints — Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform (and the unrelated Save-Data hint) — carry little enough identifying detail on their own that browsers send them by default, the same way the reduced User-Agent string is sent by default.
• High-entropy hints — Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List and others — carry more identifying detail and are withheld until a server specifically asks for them.

A server asks by sending an Accept-CH response header listing the hints it wants:

Accept-CH: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version

The browser then includes those specific headers on its subsequent requests to that same origin. A server that never sends Accept-CH simply never receives the high-entropy hints — it only ever sees the low-entropy defaults, plus whatever the now-generalized User-Agent string still carries.

What this means if you’re reading request headers today

If you’re inspecting what a visitor’s browser actually sends — the same exercise behind what a User-Agent string reveals and verifying a crawler’s User-Agent claim with reverse DNS — a modern Chromium User-Agent string alone will tell you noticeably less than it used to about the exact OS build or device model, by design. If your own site or service genuinely depends on that level of detail (rather than just logging or analytics curiosity), the fix isn’t to keep relying on a string that’s intentionally being hollowed out — it’s to request the specific Sec-CH-UA-* hints you actually need via Accept-CH, and justify each one, since every additional high-entropy hint requested is itself a small step back toward the fingerprinting surface this whole mechanism exists to shrink. The same underlying tension — convenience and identifiability traded off against privacy by withholding detail until it’s explicitly needed — is why consumer operating systems moved to randomized MAC addresses for Wi-Fi by default; User-Agent Client Hints is the same idea applied to the browser’s own request headers.

This guide is general information, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.