Agentic Data Engineering Resources

Resource

Firefox User Agent Explained: Structure, Examples, and When They Matter

Firefox user agents identify the browser, engine, and OS. Learn token structure, platform quirks, AI crawler formats, and bot detection limits.

Airbyte Engineering Team

June 16, 2026

Summarize with AI:

Most teams treat the Firefox user agent (UA) string as a near-cosmetic detail, but it is one of the cheapest signals a server can use to reject a request outright. A correctly formatted string passes basic validation; a fabricated or inconsistent one gets flagged before the rest of the session is even inspected.

That matters for engineers debugging programmatic requests, managing crawler access, and tracking browser-profile mismatches in production. This guide breaks down the canonical Firefox UA structure, the platform quirks that trip up parsers, how Firefox compares to Chrome and Safari, and why a believable UA header is no longer enough on its own.

TL;DR

Firefox user agent strings follow a stable legacy structure, with platform-specific quirks such as frozen macOS values and Android using Gecko/<version> instead of Gecko/20100101.
Correct Firefox UA formatting can matter for programmatic HTTP requests, but fabricated or inconsistent strings are easy for detection systems to flag.
AI crawlers use self-identifying UA strings, but reliable verification requires more than the UA header, including IP range checks and, where documented, reverse DNS with forward confirmation.
Modern bot detection relies on signals beyond UA strings, including Client Hints consistency, Transport Layer Security (TLS) fingerprints, and behavioral analysis.
For teams who would rather skip browser simulation entirely, Airbyte Agents offers authenticated retrieval as an alternative.

What Are Firefox User Agent Strings?

A Firefox user agent string is a single HTTP header that a Firefox browser sends with every request to identify itself to a server. It declares the browser family, the Gecko rendering engine, the operating system, and version details in a defined order. Servers and content delivery networks read this string to make decisions about content delivery, feature support, and bot filtering.

The format has changed little since Firefox 4, which makes it useful as a validation baseline but also easy to fabricate. Engineers usually encounter it in three main contexts: building Python or Node clients that send realistic headers, debugging requests blocked by a Web Application Firewall (WAF), and separating real Firefox traffic from automated crawlers when reviewing logs.

What Does a Firefox User Agent String Look Like?

Firefox UA strings follow a documented template, and each token within that template carries a specific piece of identity information. Understanding the canonical shape first, then breaking it down token by token, makes it much easier to recognize when a string has been malformed or fabricated.

Firefox Uses a Canonical Format

Every Firefox UA string follows a specific format:

Mozilla/5.0 (platform; rv:gecko-version) Gecko/gecko-trail Firefox/firefox-version

A representative Windows example is:

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:<version>) Gecko/20100101 Firefox/<version>

This format is sufficiently stable to serve as a validation baseline, which is why small deviations often stand out during request inspection.

Token-by-Token Breakdown

The main tokens each carry a different part of the browser identity. Looking at them separately makes it easier to spot malformed or fabricated strings.

Token	Meaning	Notes
Mozilla/5.0	Legacy compatibility prefix	Every major browser includes it; zero discriminating value
Platform comment	OS, architecture, and Gecko release version	rv: is the authoritative Gecko version identifier
Gecko/20100101	Rendering engine identifier	Fixed string, not a build date; Android uses the Firefox version instead
Firefox/<version>	Browser name and version	Absent in non-Firefox Gecko-based applications

Gecko/20100101 is a fixed constant. Mozilla replaced the real build date with this value starting in Firefox 4. Any automation that generates a Firefox UA with a different date, such as Gecko/20230101, can be detectable as fabricated. In practice, getting the syntax right is only the first layer of consistency checking.

What Are Firefox User Agent Strings Across Platforms?

The canonical template stays consistent across operating systems, but the platform comment and a handful of engine details shift depending on where Firefox runs. Those shifts are where parsers most often go wrong, so it helps to look at concrete examples alongside the platform-specific quirks that break brittle detection logic.

Desktop and Mobile Examples

The broad shape stays the same across platforms, but the platform comment and a few engine details change. Those differences are where parsers and bot rules usually fail.

Representative examples:

Platform	User Agent String
Windows	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:<version>) Gecko/20100101 Firefox/<version>
macOS	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:<version>) Gecko/20100101 Firefox/<version>
Linux x86_64	Mozilla/5.0 (X11; Linux x86_64; rv:<version>) Gecko/20100101 Firefox/<version>
Ubuntu x86_64	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:<version>) Gecko/20100101 Firefox/<version>
Android (mobile)	Mozilla/5.0 (Android <version>; Mobile; rv:<version>) Gecko/<version> Firefox/<version>
Firefox Extended Support Release (ESR), Windows	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:<major-version>.0) Gecko/20100101 Firefox/<major-version>.0

ESR point releases all produce identical UA strings because only the major version appears. These examples are useful as structural references.

Platform-Specific Quirks That Break Detection Logic

A few documented or commonly observed behaviors make Firefox UA strings behave differently than many parsers expect. These are the cases most likely to break brittle validation rules.

An Apple silicon Mac can produce the same UA string as an Intel Mac. This reduces the level of CPU architecture detail in the UA string.
On Android, the Gecko/ token carries the Firefox version number instead of the frozen desktop constant. That matters because user agent strings are often checked for structural consistency. Inconsistent Firefox/Android formatting can be detected.
On iOS, Apple's App Store has historically required browsers to use WebKit, though Apple now allows alternative browser engines for certain apps in the EU. Firefox for iOS sends a FxiOS/ token on iPhone, for example, FxiOS/<version>.

These edge cases are why production request handling should use UA parsing as a coarse signal rather than a final identity check.

How Does the Firefox User Agent String Differ From Chrome and Safari?

The three major browser families share a common opening token but diverge sharply thereafter, both in the engine identifier and in the side-channel signals they emit. Comparing them at the structural level is the fastest way to see why poorly faked strings stand out and why the divergence still matters for detection.

Element	Firefox	Chrome	Safari
Opening token	Mozilla/5.0	Mozilla/5.0	Mozilla/5.0
Engine token	Gecko/20100101	AppleWebKit/537.36	AppleWebKit/605.1.15
Compatibility token	(absent)	(KHTML, like Gecko)	(KHTML, like Gecko)
Browser identifier	Firefox/<version>	Chrome/<version>	Version/<version>
Safari token	(absent)	Safari/537.36	Safari/605.1.15
UA reduction	Traditional UA retained; some values frozen	Reduced UA detail; relies on UA-CH	None active
UA-CH support	Limited; Mozilla has raised concerns	Broad support; powers device detection	Not confirmed in major implementations
iOS behavior	WebKit UA + FxiOS/ token	WebKit UA + CriOS/ token	Native WebKit

Firefox retains the traditional UA string with version and platform information, though it has reduced some detail in that string. Teams that need authenticated access to business data often avoid browser profile spoofing altogether and instead use AI agents with authenticated retrieval paths.

The Gecko and rv: tokens inside the parenthetical comment block are the recommended detection targets for identifying Gecko-based browsers. In practice, reliable detection requires matching both Gecko and rv: tokens, because Chrome includes "like Gecko" in its UA string but never includes a standalone rv:. The browser family differences in this table are useful for filtering, but they are still only one layer of verification.

How Do AI Crawlers Use User Agent Strings?

Official AI crawlers generally use self-identifying UA strings so operators can identify each agent. The compatibility preamble still resembles a browser UA, but the crawler identifier is the part that matters for policy and verification.

AI Crawler	Provider	Purpose	Robots.txt Governed?
GPTBot	OpenAI	Training generative AI models	Yes
OAI-SearchBot	OpenAI	ChatGPT Search results	Yes
ChatGPT-User	OpenAI	User-initiated browsing in ChatGPT	May not apply
ClaudeBot	Anthropic	Training data collection	Yes
Claude-SearchBot	Anthropic	Retrieval and indexing	Yes
Bytespider	ByteDance	Training data collection	Not clearly documented

These documented examples use Mozilla/5.0 AppleWebKit/537.36 or a full Chrome-style browser profile as a legacy compatibility preamble. The self-identifying portion, such as GPTBot/<version> or ClaudeBot/<version>, appears after the compatibility tokens. If the goal is controlled access to internal systems rather than open web crawling, a managed Context Store shifts the problem from crawler identification to authenticated retrieval, and an MCP Gateway can broker the connections between AI agents and your governed data surfaces.

Why Is a User Agent String Not Enough for Bot Detection?

A plausible UA header is the easiest part of a request to fake, so modern bot detection rarely relies on it alone. Detection systems layer UA inspection with transport, browser, and behavioral signals, including the JA3 and JA4 fingerprints used by Cloudflare.

UA strings fall short because:

Client Hints expose mismatches: A Chrome UA without Sec-CH-UA-* headers is immediately detectable, whereas a Firefox UA without them still matches the expected pattern.
TLS fingerprints betray the client: Every Transport Layer Security (TLS) ClientHello produces a JA3 or JA4 fingerprint that a Python requests client cannot disguise as Firefox.
WebDriver flags leak automation: The W3C navigator.webdriver boolean is true by default in Selenium, Puppeteer, and Playwright, feeding behavioral scoring models.
IP and DNS checks verify bots: Vendors like OpenAI and Anthropic publish IP ranges, and Google documents reverse-plus-forward DNS verification.

Treat UA matching as a first-pass filter, then layer in these signals.

When Should Developers Care About Firefox User Agent Strings?

Firefox UA accuracy matters in specific operational moments where a malformed header can change whether a request succeeds, is flagged, or fails downstream. The scenarios below cover the cases that most often come up in production.

Pay attention to Firefox UA formatting when:

Writing Python or Node Clients that make direct HTTP requests and require a self-contained header that carries platform, architecture, and version details.
Mixing UA Strings With Client Hints, since adding Sec-CH-UA-* headers to a Firefox UA can contradict the claimed profile and create a detection signal.
Debugging Blocked Requests: robots.txt and WAF rules are independent layers; a 403 with a permissive robots.txt usually points to a WAF or access-control rule.
Building a Transparent Crawler, where including a product name, version, and documentation URL helps site operators write targeted allow rules instead of blanket blocks.

Accurate UA formatting still does not address TLS fingerprinting or behavioral analysis, so workflows that depend on browser-like behavior remain brittle in production.

Ready To Move Beyond Browser Simulation?

Accurate Firefox UA formatting is useful for programmatic requests and crawler debugging, but it does not solve the harder problem of getting AI agents stable, permission-aware access to business data. Airbyte Agents replaces browser simulation with an authenticated retrieval architecture built around three layers.

At the data layer, a Context Store ingests information from operational sources using stored credentials, indexes it for retrieval, and enforces permissions so agents only see what they are entitled to. At the protocol layer, Agent MCP exposes that context to any Model Context Protocol-compatible client, so an LLM can request data through a governed interface instead of scraping HTML pages and faking browser headers. At the interface layer, the Agent CLI lets developers configure, test, and run agents directly from the terminal, with the same auth and retrieval paths used in production.

These pieces let agents read from real systems, with audit trails and permission boundaries, without depending on Firefox UA strings, TLS fingerprints, or WebDriver flags to stay unblocked.

Get a demo to see how Airbyte Agents supports production AI agents with permission-aware data.

Can't wait? Try Airbyte Agents Now.

Frequently Asked Questions

How Can I Generate an Up-to-Date Firefox UA String for Testing?

The most reliable source is the running browser itself: open Firefox, visit about:support, and copy the value next to "User Agent". For automation, libraries that wrap recent UA datasets, or Mozilla's own release notes for each major version, give you current rv: and Firefox/ values to swap into the template.

Does Firefox Send the Same UA String in Private Browsing Mode?

Yes. Private browsing changes the behavior of storage and tracking protection, but Firefox sends the same UA string in both private and standard windows. Servers cannot distinguish a private session from the UA header alone, which is why fingerprinting protections operate at other layers.

How Often Does the Firefox UA String Change?

The structural template has been stable since Firefox 4, but the rv: and Firefox/ version numbers change with every major release on Firefox's rapid release cadence, roughly every four weeks. ESR builds updates less frequently, which is why an outdated Firefox/<version> token can be a useful signal that a client has not refreshed in a while.

Can I Block Traffic Purely by Matching on the Firefox UA String?

You can, but it is rarely a good idea in itself. Many legitimate tools spoof Firefox UAs, and many real Firefox users connect from contexts you might not want to block. Pairing the UA check with IP reputation, TLS fingerprints, and rate limits produces far fewer false positives than UA-only blocking.

What Is the Difference Between FxiOS and the Desktop Firefox UA?

FxiOS/ indicates Firefox running on iOS, where the underlying engine is WebKit rather than Gecko. The full string therefore looks much closer to Mobile Safari, with an FxiOS/<version> token appended, rather than carrying Gecko/20100101 and the desktop platform comment.

Try Airbyte Agents

Airbyte connects your agents to all of your data and assembles context before they run. Build agents that actually know your business.

Try it free Talk to sales

Firefox User Agent Explained: Structure, Examples, and When They Matter

Related posts

Try Airbyte Agents