Introduction
A user agent switcher changes one line of text: the User-Agent string your browser sends with its requests. Websites that check for user agent spoofing do not take that line on trust. The browser answers the same question in several other places, and a switcher rarely changes all of them. When the answers disagree, the site has caught a spoof. That is what "user agent switcher detected" means. If you get flagged without ever installing a switcher, look for an extension that rewrites the user agent as a side feature, as some privacy add-ons do, or for device emulation left switched on in the developer tools.
Chrome, for example, describes itself twice in every page request over HTTPS: once in the User-Agent header and again in the User-Agent Client Hints, a set of Sec-CH-UA headers carrying the brand, the major version and the operating system. JavaScript can read both, along with navigator.platform, the number of touch points the screen supports, and features that only one browser engine has. Switch the User-Agent to an iPhone on a Windows laptop and the other answers still say Windows, still say Chrome, and still say there is no touchscreen.
The mismatch is easier to spot in 2026 than it used to be. Chrome froze most of the User-Agent string in 2022 and 2023, and the detailed answers moved into Client Hints, which a simple switcher leaves alone. The Device Integrity card on packet.guru runs these comparisons on your own browser.
User-Agent Spoofing, in One Paragraph
The User-Agent is a header every browser sends, a string such as Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 that names the browser, its engine and the operating system. User agent spoofing, the simplest form of browser spoofing, means sending a different string, through a browser extension, a hidden preference, the developer tools, or a script that copies a "fake user agent" from a list. The string is easy to change because it is plain text, and that is also why detection ignores what it says in isolation and checks whether it agrees with everything else the browser reveals. A real browser keeps those answers in step automatically. A spoof has to keep them in step by hand, and usually misses some.
Where a Browser States Its Identity
User-Agent Reduction: The String Frozen on Purpose
Over the decades the User-Agent string grew into a long list of tokens that sites used, and misused, to guess what a browser could do. It also handed every site a precise description of the device. Chrome's answer was User-Agent Reduction, rolled out in phases. Chrome 101 replaced the minor, build and patch numbers with zeros. Chrome 107 froze the platform part on desktop, and Chrome 110 did the same on Android. Since Chrome 113 sites can no longer opt back into the full string.
Chrome's reduced string says less, and in places it says something untrue on purpose:
- Every Windows machine reports
Windows NT 10.0; Win64; x64, whether it runs Windows 10, Windows 11 or an older version. - Every Mac reports
Intel Mac OS X 10_15_7, Macs with Apple silicon included. - Chrome on Android reports
Android 10; K. The real Android version and the phone model are gone. - The version always ends in
.0.0.0.
Safari went the same way. On iOS 26 and iPadOS 26 it reports a frozen iOS 18 version, as macOS Safari has done with the Mac version for years. Since Safari 13, Safari on iPad presents a Mac User-Agent most of the time, so that sites serve it the desktop layout.
Microsoft's Edge documentation says plainly that User-Agent strings won't be updated to tell Windows 11 from Windows 10, or one CPU architecture from another. Sites that need those details have to ask for them separately.
User-Agent Client Hints
User-Agent Client Hints (UA-CH) are the replacement, specified as a WICG draft and switched on by default in Chrome since version 89. Instead of one string, the browser sends separate headers. Three go out by default on HTTPS requests:
Sec-CH-UA, the brand list with major versions, for example Chromium and Google Chrome with the same number.Sec-CH-UA-Mobile, which says whether the browser wants a mobile experience.Sec-CH-UA-Platform, the operating system name.
A site that needs more replies with an Accept-CH header, and the browser then adds high-entropy hints: the full version list, the platform version, the CPU architecture and bitness, the device model. That is how a site tells Windows 11 from Windows 10 today, through the platform version hint. You can see whether a site asks for these by looking for Accept-CH in its response with the HTTP Headers tool. JavaScript gets the same data through navigator.userAgentData (Chrome 90 and later), with the detailed fields behind its getHighEntropyValues() method. Both the headers and the object exist only on secure, HTTPS pages.
The spec also requires a decoy: an arbitrary extra brand in the list, in an order that changes over time. This is called GREASE, and it stops sites from matching the header text exactly. A check that reads "the first brand" breaks, while one that looks up the Chromium entry by name keeps working.
UA-CH exists only in Chromium-based browsers such as Chrome, Edge and Opera. Firefox and Safari send no Sec-CH-UA headers and have no navigator.userAgentData. Several of the detections below rest on that one fact.
navigator.platform and the Rest of the Device
Some older properties never went away. navigator.platform returns a short platform name: Win32 on Windows, even 64-bit Windows, MacIntel on a Mac, Linux x86_64 on desktop Linux, and Linux armv81 in Chrome on Android. navigator.maxTouchPoints says how many simultaneous touches the screen supports, and it is zero on a machine without a touchscreen. Web Workers, scripts that run in the background of a page, have their own copy of the navigator object with their own userAgent, platform and, in Chromium, userAgentData.
Below the browser sit two more witnesses that no browser setting controls. The TLS handshake differs between Chrome, Firefox, Safari and scripting libraries, as covered in TLS fingerprinting with JA3 and JA4. The first TCP packet carries traits of the operating system's network stack, as covered in passive OS fingerprinting.
| Surface | Where a site reads it | Which browsers expose it |
|---|---|---|
| User-Agent header | HTTP request | All |
| navigator.userAgent | JavaScript on the page | All |
| Sec-CH-UA, -Mobile, -Platform | HTTPS request headers | Chromium-based, Chrome 89 and later |
| navigator.userAgentData | JavaScript on HTTPS pages | Chromium-based, Chrome 90 and later |
| navigator.platform | JavaScript | All |
| navigator.maxTouchPoints | JavaScript | All |
| Worker navigator | JavaScript inside a Web Worker | All, userAgentData only in Chromium |
| TLS and TCP handshakes | The network connection | Every client, browser or not |
How Websites Detect User Agent Spoofing
Each check below looks for a user agent mismatch between two answers that a real browser always keeps consistent.
Client Hints vs the User-Agent: The Sec-CH-UA Mismatch
The most direct check is a Sec-CH-UA mismatch: the User-Agent names one browser or version, and the Client Hints name another. A switcher in Chrome that claims to be Firefox still sends Sec-CH-UA with Google Chrome in the brand list, a header real Firefox never sends. The reverse fails as well. Firefox or Safari dressed up as Chrome sends a Chrome User-Agent over HTTPS with no Client Hints at all, which current Chrome does not do. Versions drift too. A string copied a few months ago names an older Chrome than the brand list, and the brand list reflects the engine that is actually running.
The Platform Against the Claimed OS
A User-Agent that says iPhone while navigator.platform says Win32 describes two different machines. So does a string that says macOS while Sec-CH-UA-Platform says Windows. Firefox keeps the platform value under its own preference, separate from the User-Agent override, so changing one leaves the other reporting the real system.
A Phone Without a Touchscreen
An Android or iPhone identity with maxTouchPoints at zero is a desktop in costume. This is the classic failure of picking a mobile user agent on a laptop.
Engine Features
navigator.userAgentData exists only in Chromium. A "Chrome" without it is probably Firefox or Safari underneath, and a "Firefox" or "Safari" with it is Chromium underneath. Sites can also probe JavaScript features that only one engine ships, though such checks age quickly as engines adopt each other's features.
Fake User Agents No Browser Sends
Because the reduced format is fixed, some fake user agents are wrong on their face. A desktop Chrome with a full build number instead of .0.0.0 is one, and so is a current Chrome on Windows NT 6.1. Others are a Chrome on Android that names the real Android version and phone model, or an iPhone string whose OS version is one Safari 26 no longer reports. A fake user agent copied from an old list or typed by hand can easily be one of these.
Two Navigators
A switcher that patches the page's navigator object has to patch the copy inside Web Workers separately. A page can start a worker, ask it for userAgent and platform, and compare the answers with the main page.
The Network Underneath
None of the above touches the connection. A Chrome User-Agent arriving over the TLS handshake of a scripting library, or a Windows claim over a TCP stack that looks like Linux, is a contradiction no browser setting can fix. Scripts that send a fake user agent without any browser are the easiest case of all. They send no Client Hints, run no JavaScript, and their handshake belongs to an HTTP library.
What Is Not a Contradiction
User-Agent Reduction makes some honest browsers look inconsistent to a careless check:
- A Mac with Apple silicon says Intel in the User-Agent and
MacIntelinnavigator.platform. - A Windows laptop with an ARM processor says
x64in the User-Agent, while the architecture hint says ARM. - Chrome's User-Agent ends in
.0.0.0, while the full version hint carries the real build number. - An iPad says Macintosh but reports a touchscreen.
A detector that compares the full version or the architecture between the string and the Client Hints flags every stock Chrome. A sound check knows which differences User-Agent Reduction creates on purpose and leaves them alone.
Why Your User Agent Switcher Is Not Working
People searching for "user agent switcher not working" usually run into one of these:
- The site reads Client Hints.
Sec-CH-UA-MobileandSec-CH-UA-Platformstill describe your real browser, and a site that uses them to pick a layout or a download ignores the string you changed. - Responsive pages choose their layout from the width of the viewport. A wide desktop window gets the desktop page whatever the User-Agent says.
- The extension changed the header but not
navigator.platform,navigator.userAgentDataor the touch points, and the page's scripts read those instead. - The site noticed the mismatch. That tends to end in extra verification, which is why switchers and endless CAPTCHAs so often travel together.
A switcher also makes you easier to single out. The reduced Chrome string is shared by everyone on the same Chrome version and OS family. A hand-picked string is shared by far fewer people, and a contradictory one is rarer still.
What the Device Integrity Card Checks
The Device Integrity card in the Privacy & Trust scan runs several of these comparisons in your browser. Each check appears as a line in the card's analysis, marked ALERT for a contradiction, WARN for a supporting sign and OK for a pass, with the values it compared.
| Check | What it compares | What a failure usually means |
|---|---|---|
| Automation | The browser's own automation flag | Automation software is driving the browser |
| Operating system | The OS named in the User-Agent against the platform the browser reports elsewhere | A user agent switcher or an OS spoof |
| Device type | A phone or tablet identity against the touch points | A desktop posing as a mobile device |
| Browser version | The browser version in the User-Agent against the version in Client Hints | A pinned or copied user agent on a newer engine |
| Engine | The claimed browser family against what the engine itself supports | A Chrome identity on Firefox or Safari, or the reverse |
| Engine markers | Objects a real Chromium browser adds to every page | Stripped by a privacy browser or by an anti-detect tool |
| Removed automation flag | Signs that the automation flag was tampered with | An anti-detect tool hiding automation, or a hardened browser |
Privacy browsers and hardening setups sometimes strip the engine markers or the automation flag as well, so the card does not treat that alone as spoofing. The card also knows the honest exceptions described above, such as an iPad in desktop mode.
Some contradictions are visible to two cards. If the TCP/OS Fingerprint or TLS / JA4 Fingerprint card has already caught the same lie from your connection, the Device Integrity line says so and the finding is counted once, on that card. A contradiction that reveals your real OS or engine also lowers the Privacy score, since it gives away what the spoof was meant to hide. Tampering that goes beyond the user agent, such as rewritten browser functions or impossible graphics cards, belongs to the separate Tamper Detection card, explained in how sites catch bots and anti-detect browsers.
To compare the raw values yourself, open the Connection Fingerprint section of the same page. It shows the User-Agent your browser reports to scripts next to the Sec-CH-UA headers the server actually received. The Browser & Device section lists the platform and the touch points.
How to Stop Getting Flagged
- Drop the switcher unless you need it daily. The reduced Chrome string already says little: a frozen OS version, no phone model, no build number.
- For a mobile layout, use a real phone or the site's own mobile option. For testing, use the device emulation in the developer tools and fill in the Client Hints as well, since Chrome treats the user agent and its Client Hints as separate settings. The TCP and TLS handshakes will still come from your desktop.
- For privacy, pick a browser that makes its users look alike. Tor Browser and Mullvad Browser try to give all their users the same answers, which hides more than one invented identity can.
- If you run automation, say so. A bot that admits it is a bot is easier to allow than one caught pretending, and signed agents with Web Bot Auth are the newer way to prove it.
- After any change, run the scan again and read the Device Integrity lines.
FAQ
Q: Can websites detect a user agent switcher?
A: Yes, most of the time. The switcher changes the User-Agent, but the browser also reports its brand, version and OS in Client Hints, its platform in navigator.platform and its touch support in navigator.maxTouchPoints. A site compares them, and any disagreement points to spoofing.
Q: What is a Sec-CH-UA mismatch?
A: The Sec-CH-UA Client Hints header and the User-Agent string describe different browsers or versions. A Chromium-based browser keeps the two in step by itself, so a mismatch almost always means something rewrote the User-Agent afterwards: an extension, a developer-tools override, a proxy or a script.
Q: Why is my user agent switcher not working?
A: The site probably decides from something else: the Client Hints headers, the window width, or JavaScript properties the extension did not change. Switching the string does not change your screen, your engine or your connection.
Q: Does Firefox send Sec-CH-UA headers?
A: No. Firefox and Safari do not implement User-Agent Client Hints, so they send no Sec-CH-UA headers and have no navigator.userAgentData. That is also why a Chrome user agent arriving over HTTPS without those headers looks suspicious.
Q: Does a VPN change your user agent?
A: No. A VPN changes the IP address a site sees. The User-Agent, the Client Hints and everything the browser reports to JavaScript pass through the tunnel unchanged.
Sources
- User-Agent Reduction, The Chromium Projects.
- User-Agent Client Hints, WICG Draft Community Group Report.
- Improving user privacy and developer experience with User-Agent Client Hints, Chrome for Developers.
- Detect Windows 11 and CPU architecture using User-Agent Client Hints, Microsoft Learn.
Does your browser tell one story?
Run the Privacy & Trust scan and open the Device Integrity card to see which identity checks your browser passes and the values behind each one.