toolhq.io

All posts
5 min readby Jameel Haider

Client Hints vs the user-agent string

For years the only way to learn about a visitor's browser was to parse the User-Agent string, a long and inconsistent line of text that every browser formats differently. User-Agent Client Hints are the modern replacement, and they change the model from "read one messy string" to "ask for the specific facts you need."

What Client Hints are

Client Hints are a set of request headers, prefixed Sec-CH-UA, that carry browser and platform information in a structured form. Instead of regexing a string, the server reads named values.

Sec-CH-UA: "Chromium";v="120", "Not(A:Brand";v="99"
Sec-CH-UA-Mobile: ?0
Sec-CH-UA-Platform: "macOS"

Each header holds one fact: the brand and major version, whether the device is mobile, the platform name. There is no ambiguity about where the version lives or how the platform is spelled.

The opt-in model

The important difference from the UA string is that most hints are not sent by default. The browser sends a small default set, and the server asks for more by advertising which hints it wants.

  • The server responds with an Accept-CH header listing the hints it needs.
  • On the next request to that origin, the browser includes those hints.
Accept-CH: Sec-CH-UA-Platform-Version, Sec-CH-UA-Model

This means the first request does not have everything, and a hint you never request never arrives. The model is deliberate: a site declares its need, and only then does the extra detail flow.

Low entropy and high entropy hints

Hints are split into two groups based on how much they help identify an individual.

  • Low entropy hints are sent by default because they reveal little on their own: the browser brand, whether it is mobile, and the broad platform. These are the Sec-CH-UA, Sec-CH-UA-Mobile, and Sec-CH-UA-Platform headers.
  • High entropy hints are withheld until requested because combined they can narrow down a device: the full platform version, the device model, the full browser version list, the CPU architecture and bitness.

The split keeps casual fingerprinting harder while still letting a server that genuinely needs the detail ask for it.

What this means in practice

If you serve different assets to mobile and desktop, the default low entropy hints already cover you with no extra request round trip for information. If you need the exact OS version, for example to work around a platform specific bug, you request the high entropy hint and accept that it arrives on the second request.

You can still inspect a raw UA string when you have one, and a parser remains the quickest way to understand what a given string reports. The User-Agent Parser breaks a string into browser, engine, OS, and device, all in your browser so the string never leaves your device. For the mechanics of reading the string itself, see reading a user-agent string.

Treat Client Hints as the direction of travel. Request only the hints you truly use, lean on the low entropy defaults for layout decisions, and reserve high entropy hints for specific needs. This pairs directly with the broader move to shrink the UA string, covered in user-agent reduction explained.