List of Mobile Browser User-Agent Strings

If you are still identifying mobile devices by reading the User-Agent string, a growing share of your traffic is already invisible to you. Chrome on Android stopped naming the device. Safari stopped reporting the iOS version. Both were deliberate, both are permanent, and between them they reach 22 of the 50 real strings on this page. Here is what each browser actually sends in 2026, and where the missing information went.

Contents

• What a User-Agent is, and what it tells you
• Mobile browser User-Agent strings
• User-Agent Client Hints (sec-ch-ua) for mobile browsers
• Apple froze the iOS version in Safari's User-Agent
• Why so many Android strings say "Android 10; K"
• Foldables send two different strings
• Tablet browser User-Agent strings
• Dalvik/2.1.0: the Android User-Agent that is not a browser
• Frequently asked questions

What a User-Agent is, and what it tells you

Every mobile browser sends a User-Agent string with each request, and reading one is less obvious than it looks. Here is a real request from Chrome on a Samsung phone:

GET /blog/mobile-browser-user-agent-strings HTTP/1.1
Host: deviceatlas.com
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36
Sec-CH-UA: "Chromium";v="152", "Not?A_Brand";v="24", "Google Chrome";v="152"
Sec-CH-UA-Mobile: ?1
Sec-CH-UA-Platform: "Android"
Sec-CH-UA-Model: "SM-S938B"

The request line and host are illustrative. The five headers are as we received them.

Three of those four Sec-CH headers are sent by default. The Client Hints specification keeps a low-entropy table of hints safe to send unasked, and Sec-CH-UA, Sec-CH-UA-Mobile and Sec-CH-UA-Platform are in it. A Chromium browser appends them to every request to a secure origin. Sec-CH-UA-Model is not in that table, and arrived only because the site asked for it with an Accept-CH response header.

The User-Agent says Android 10; K, which is neither this phone's Android version nor its model. Sec-CH-UA-Model on the same request says SM-S938B, a Galaxy S25 Ultra. Mobile near the end of the User-Agent and ?1 in Sec-CH-UA-Mobile say the same thing twice: this is a phone.

Most of the User-Agent is there for compatibility. Mozilla/5.0, AppleWebKit/537.36 (KHTML, like Gecko) and Safari/537.36 identify nothing, not even the engine. The browser is Chrome/152.

↑ Back to top

Mobile browser User-Agent strings

Twenty browsers. The three we see most come first; after that they are grouped by family, because the gap between one vendor's variants tells you more than the gap between two adjacent ranks. Each string is real. Where a browser sends a different string on iOS than on Android, both are here, because the two versions of the same browser often have nothing in common beyond the name.

Chrome on Android, and Chrome on iOS

Chrome

On iOS, Chrome is CriOS, and it is not Chrome underneath. Every iOS browser in this data runs on WebKit, so what you are looking at is Safari's engine wearing Google's name. Apple has allowed alternative engines in the EU since iOS 17.4, under an entitlement with conditions attached, and nothing shipping has taken it up in numbers we can see. CriOS does report the true iOS version, though, which Safari itself no longer does.

Safari on iPhone

Five strings arrive under Safari's name. Only the first two are the Safari browser.

Safari and the iOS WebKit family

The first is Safari on iOS 18.7. The second is also Safari, this time on iOS 26, reporting 18_7 anyway for reasons covered below.

The third is the one that actually dominates. It keeps Safari/604.1, drops Version/, and appends a bracketed block of its own: this is Facebook's in-app browser. That shape, Safari/ present and Version/ missing, is 65% of Safari-labeled phone visits, and Facebook and Instagram together account for more than half of everything arriving under the name.

The fourth has neither Version/ nor Safari/, and that combination means a bare WKWebView, a page opened inside somebody's app with no browser chrome around it.

The fifth is not a browser at all. It is an app making an HTTP request, and it happens to name an iPhone. DeviceAtlas still reports browserName=Safari for it.

Those shares are of the 536,836 phone visits DeviceAtlas labeled Safari in September 2026, robots excluded, not of iPhone traffic or of the web.

Samsung Internet (SamsungBrowser)

Samsung Internet

Two version numbers, and they disagree. SamsungBrowser/30.0 is Samsung Internet's own version. Chrome/143 is the Chromium underneath it, and since Chrome ships a major release roughly every four weeks, matching the wrong token reports a current browser as about eight months behind.

The OEM browsers: MIUI, HeyTap, Huawei and Vivo

Pre-installed, regionally large and absent from most published User-Agent lists. They also do something Chrome stopped doing: they send the real device model.

Xiaomi, Oppo/Realme/OnePlus, Huawei and Vivo

HMSCore is Huawei Mobile Services, and no other vendor sends it, though Huawei itself puts it on app and WebView strings too, not only the browser. HeyTap covers Oppo, Realme and OnePlus. Vivo's string reports Chrome 87, which was current in 2020.

Each of these sends a different string for almost every handset it runs on. Chrome is the opposite: one string per version, for every phone.

Phoenix and Hi Browser: Tecno, Infinix and itel

Both come from Transsion, which makes Tecno, Infinix and itel. Those phones are common across Africa and South Asia, and the browsers are on no other list we can find.

Transsion browsers

Hi Browser packs its version, language, country and locale into a single token, with semicolons between the fields. That is also how the platform section is delimited, so splitting on semicolons gets you nonsense. The channel/ at the end names the store the build came from: GooglePlay on most of them, and PalmStore, Transsion's own store, on the rest.

Opera: three products, three tokens

Opera Mobile, Opera GX and Opera Touch

OPR, OPX and OPT are three different Opera products, and a pattern looking for OPR finds exactly one of them.

Firefox and Edge

Firefox and Edge, both platforms

Firefox on Android sends the only browser string on this page that names its real engine: no AppleWebKit, no Safari, no Chrome, just Gecko. It still opens Mozilla/5.0, but so does every other browser string here, and none of them means it. On iOS it is FxiOS, and WebKit like everything else.

Edge is EdgA on Android and EdgiOS on iOS. One browser, two tokens, neither containing the word Edge.

UC Browser and Yandex

UC Browser and Yandex Browser

UC Browser reports Chrome 40, a release from January 2015. Its own U3 and U4 engine tokens reach well under 1% of the UC traffic we see, so matching on those finds almost nothing. Yandex adds an SA/ field.

DuckDuckGo, Brave, Ecosia and Aloha

The privacy and search-alternative browsers mostly take the same approach on iOS: a Safari string with their own name appended.

DuckDuckGo, Brave, Ecosia and Aloha

On iOS, Brave appends a bare Brave with no version. On Android it appends nothing at all, and the Client Hints table below is the only place it names itself. Ecosia puts its name in brackets at the end, which most parsers read as part of the platform section. DuckDuckGo is Ddg/ on iOS and DuckDuckGo/ on Android, and its Android string drops the model entirely.

What was on this list last time and is not now

IE Mobile and Opera Mini were both named on the previous version of this article. Neither is in the top twenty of what we see now. Opera Mini's Presto engine does still appear, just about, at 428 visits in September. It is the last of the dead engines: everything else on this page is Blink, WebKit or Gecko. Amazon Silk was here too, under Android, with a string that belongs to a Fire tablet; it has moved to the tablet section.

↑ Back to top

User-Agent Client Hints (sec-ch-ua) for mobile browsers

Chromium browsers also send much of this in a set of separate headers. These are Client Hints, and they arrive alongside the User-Agent, on the same request. Each row below is one such pair, as we received it.

Look at the first row. The User-Agent reads as Chrome, and two small things give it away: the ; wv in its platform section and the Version/4.0 token, both easy to miss in a string that long. The brand list says Android WebView outright. That is the in-app browser problem from the Safari section, solved in one field, on Android.

The last row is Brave on Android. Its User-Agent is Chrome's, character for character, and the brand list is the only place it names itself.

The deliberately mangled "Not?A_Brand" entry is called GREASE. Its name and version change between releases so that nobody can hardcode the list, the way everybody hardcoded Mozilla/5.0.

There are limits. Safari sends no brand list at all, and neither does any other browser running on iOS. In practice Client Hints are an Android signal. That gap doesn't look likely to close: WebKit's standards position on User-Agent Client Hints has been open since 2022, and privacy and interoperability concerns were still recorded against it in October 2026.

On Android, the brand list arrives unasked. The rest does not. Sec-CH-UA-Model and the other high-entropy hints come only if the site requests them with Accept-CH, and only reach a third-party detection service if the site delegates them as well. Plenty of sites do neither, so a missing model tells you about the site rather than the browser.

↑ Back to top

Apple froze the iOS version in Safari's User-Agent

Look again at two of the Safari strings:

On most of the Safari traffic we see, the iPhone OS token now reads 18_7 regardless of the actual iOS version, and the real version is only in Version/. WebKit did this deliberately and said so in its own source tree. A September 2025 commit moved the freezing logic into Quirks.cpp, to address "compatibility issues encountered when we attempted to report iOS 26 versioning", and a follow-up set the frozen value to 18.7.

The freeze is not Safari's alone. Brave, Opera Touch and DuckDuckGo inherit Safari's platform string and carry a frozen token too, while Chrome, Edge, Ecosia and Aloha build their own and report the real version.

↑ Back to top

Why so many Android strings say "Android 10; K"

Both halves are placeholders. K is where the device model used to be, and 10 is where the real Android version used to be. Chrome reduced the Android platform section on purpose, so the result is a string that identifies the browser precisely and the hardware not at all. Both arrived together in Chrome 110; the browser's own version had been flattened to MAJOR.0.0.0 nine releases earlier, in Chrome 101.

The model has not disappeared, though. It moved to Sec-CH-UA-Model, a high-entropy hint: ask for it with Accept-CH, delegate it to whatever does your detection, and the device is knowable again. Do neither and the string is all you get.

We have written about the frozen Android string in more detail in What is "Linux; Android 10; K"?

↑ Back to top

Foldables send two different strings

Chrome on a Galaxy Z Fold sends this when the phone is folded:

Galaxy Z Fold7, folded and unfolded

And the second when it is open. The only difference is the word Mobile. Because the reduced string carries no model, both come back as generic Android devices: the first a phone, the second a tablet. Sec-CH-UA-Model says SM-F966B in both cases, which is a Galaxy Z Fold7, an eight-inch phone. Pass that hint along with the User-Agent and DeviceAtlas resolves both requests to the Galaxy Z Fold7, a phone.

This is Chrome's doing rather than the handset's. But split phone traffic from tablet traffic on Chrome's User-Agent and one handset lands in both buckets, depending on how its owner happened to be holding it.

↑ Back to top

Tablet browser User-Agent strings

On an Android tablet, Chrome, Edge and Opera send their phone string with Mobile taken out and nothing else changed, which is exactly why the foldable case above causes trouble.

These are the ones that genuinely differ:

Tablet User-Agent strings

iPadOS uses iPad; CPU OS where iOS uses iPhone; CPU iPhone OS, and it still sends Mobile/15E148 on a tablet. Samsung tablets send the real model, SM-T550 here. Amazon's Fire tablets carry the KF prefix, and Silk is the only browser here that writes like Chrome/138.0.7204.244 where everything else writes Chrome/138.0.7204.244. The version is there; the like in front of it breaks any pattern expecting the number to follow the name directly.

No single token marks a tablet. The iPad still says Mobile, an Android tablet is identified by a token that is missing, and Chrome's reduced string carries no model at all. Telling a tablet from a phone means identifying the device itself, from the model in the string or, for Chrome, from the Sec-CH-UA-Model hint. That is what DeviceAtlas does, against a maintained database of devices rather than a list of tokens.

↑ Back to top

Dalvik/2.1.0: the Android User-Agent that is not a browser

Dalvik/2.1.0 is the User-Agent Android gives an app that never sets one of its own. Often that is all it is: an app fetching data, no page and no browser. But an app can also hand this string to the WebView it displays pages in, and then a real page renders behind a User-Agent that names no browser at all.

Dalvik User-Agent strings

Dalvik was Android's original runtime, and ART has been the default since Android 5.0. ART reports its version as 2.0.0 or higher, but the token kept the old name, so almost every request we see reads Dalvik/2.1.0. The 1.6.0 on the third row is from an Android 4.4 device, which predates the switch. The last row is the WebView case: the Dalvik string with a full WebView User-Agent appended to it, ; wv and all. Most arrive bare, with nothing appended.

Everything in the brackets is accurate: Android version, model and build. It looks like a phone because it is one, so most detection will read it as an ordinary phone visit. If you are counting browsers, check for the Dalvik/ prefix first.

↑ Back to top

Frequently asked questions

What is Chrome's User-Agent on Android?

Chrome on Android

The Android version and the model are both fixed values, not your device's.

Why does my iPhone report iOS 18 when it is running iOS 26?

Because Safari freezes the iPhone OS token at an iOS 18 value, usually 18_7. The real version is in the Version/ token on the same string.

What is Dalvik/2.1.0 in a User-Agent?

The User-Agent Android gives an app that never sets one of its own. Usually no browser is involved, though an app can also give this string to the WebView it shows pages in. Dalvik is the name of Android's original runtime, and 2.1.0 is the version its successor, ART, reports. The Android version and model in the brackets belong to the real device.

How do I tell an in-app browser from Safari?

Safari sends both a Version/ and a Safari/ token. Most in-app browsers break that pair, and the common case is Facebook's, Instagram's and the Google app's: Safari/604.1 kept, Version/ dropped. A bare WKWebView sends neither and ends at Mobile/15E148. A trailing token on its own proves nothing. TikTok's in-app browser adds its name after Safari/604.1, and so do Brave, DuckDuckGo, Ecosia and Opera Touch, which are real browsers. On Android the marker is ; wv in the platform section.

Do mobile browsers still send User-Agent strings?

Yes, all of them, and no removal is scheduled. What has changed is how much they put in them.

↑ Back to top

Learn more about User-Agents

• List of User-Agent strings: desktops, tablets, consoles, set-top boxes and bots
• List of Smart TV User-Agent Strings: Roku, Tizen, webOS, Android TV and Fire TV
• What is "Linux; Android 10; K"?: why Chrome's Android string names no device
• User-Agent parsing: how it works, and what it can tell you
• A regex approach to User-Agents: the pros and cons of pattern matching
• How to change the User-Agent: in a desktop browser, for testing