# User-Agent entropy analyzer

> Paste a User-Agent string and see the identifying tokens it exposes, the distinguishing bits each contributes, and the Client Hints migration.

- Tool: https://ronutz.com/en/tools/user-agent-entropy-analyzer
- Family: Security & WAF

---

## What it does

Paste a User-Agent string and the tool breaks out the identifying tokens it carries - browser and version, rendering engine, operating system and version, device class, and CPU architecture - estimates the distinguishing bits each contributes, and flags whether the string is in the reduced, frozen form modern browsers now send.

## The point it makes

A User-Agent is a small pile of entropy. No single token identifies you, but together they narrow the field, and the more detailed the string, the more distinguishing it is. The tool shows that surface honestly. The bit figures are illustrative, drawn from published fingerprinting research, not a live measurement of any population - the goal is to make the shape of the surface visible, not to score you.

## Where the detail went

Modern browsers freeze the User-Agent: Chromium fixes the minor version to 0.0.0 and caps platform detail, and Safari long ago pinned much of its string. The detail did not disappear - it moved to User-Agent Client Hints (Sec-CH-UA and friends), which a site must actively request through the Accept-CH header. The consequence is that high-entropy collection is now visible in headers rather than implicit in one string. Decode/explain only: the input is a string you paste, nothing is read from your own browser and nothing is sent.

## Standards and references

- [MDN — User-Agent header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent) - UA token structure and product/version conventions
- [User-Agent Client Hints (W3C / WICG)](https://wicg.github.io/ua-client-hints/) - Sec-CH-UA hints, Accept-CH, the high-entropy request model
- [Chrome — User-Agent reduction](https://www.chromium.org/updates/ua-reduction/) - the frozen minor version and capped platform detail
- [EFF Cover Your Tracks — browser fingerprint entropy](https://coveryourtracks.eff.org/) - the distinguishing-bits framing this tool illustrates

## Related reading

- [Passive Fingerprinting: What You Emit Without Being Asked](https://ronutz.com/en/learn/passive-fingerprinting-what-you-emit.md): Every connection announces its stack before a byte of application data flows. How a TCP SYN, a User-Agent string, and the mere order of HTTP headers each identify a client - and why a mismatch between them is the classic proxy and bot tell.