User-Agent Client Hints

The Sec-CH-UA header delivers the browser's branding and significant version in a structured, list-based format rather than a single opaque string. Each brand entry includes a v parameter for the major version, allowing servers to parse compatibility without regex guesswork.

• Format: Sec-CH-UA: "Chromium";v="124", "Google Chrome";v="124", "Not=A?Brand";v="99"
• GREASE Integration: The Not=A?Brand entry is a deliberate, randomized placeholder injected to prevent servers from hardcoding logic against specific browser strings, enforcing robust feature detection.
• Low Entropy: This header is sent by default on every request without explicit server prompting, providing basic identification while eliminating OS, minor version, and device model leakage.

The Sec-CH-UA-Platform header provides the operating system identifier, while Sec-CH-UA-Platform-Version supplies the specific OS version. These are low-entropy hints sent by default, but the platform version can be gated behind explicit server request.

• Platform String: "Windows", "macOS", "Linux", "Android", "Chrome OS"
• Version Granularity: The platform version reveals the exact OS build (e.g., "10.0.22631.0" for Windows 11 23H2), which is critical for enterprise patch management but a fingerprinting risk if sent unconditionally.
• Critical-CH: Servers must use the Critical-CH response header to signal that a navigation request should be retried if a requested hint was not sent, ensuring the server receives essential data before rendering.

High-entropy hints like Sec-CH-UA-Model and Sec-CH-UA-Arch are never sent by default. The server must explicitly request them via the Accept-CH response header, and the client can choose to grant or deny access based on user privacy settings.

• Device Model: Sec-CH-UA-Model reveals the exact hardware SKU (e.g., "Pixel 8 Pro", "iPhone15,2"), enabling precise device-specific optimizations but posing a significant fingerprinting vector.
• CPU Architecture: Sec-CH-UA-Arch exposes the underlying instruction set (e.g., "x86", "arm", "ia32"), allowing servers to deliver architecture-appropriate binaries.
• Bitness: Sec-CH-UA-Bitness distinguishes between 32-bit and 64-bit processes (e.g., "64"), which is essential for plugin delivery and memory allocation strategies.

The Accept-CH response header is the server's mechanism for requesting specific client hints on subsequent requests. For cross-origin resources, the Permissions-Policy header delegates hint access to third-party domains, preventing unauthorized leakage.

• Persistent Opt-In: Once a server sends Accept-CH: Sec-CH-UA-Model, Sec-CH-UA-Arch, the browser caches this preference and includes the requested hints on future same-origin requests without needing repeated prompts.
• Delegation Syntax: Permissions-Policy: ch-ua-model=(self "https://cdn.example.com") explicitly whitelists a CDN origin to receive the device model hint, blocking all other third parties.
• Origin Trial Legacy: The Accept-CH-Lifetime header was deprecated in favor of implicit persistence, eliminating the ability to set permanent opt-in across browsing sessions for privacy reasons.

Client hints extend beyond device identification to user preference signals, enabling servers to deliver optimized content without client-side JavaScript detection. These hints respect the user's OS-level accessibility and personalization settings.

• Sec-CH-Prefers-Color-Scheme: Signals the user's light or dark mode preference ("light" or "dark") directly in the HTTP request, allowing servers to serve appropriately themed assets before any HTML is parsed.
• Sec-CH-Prefers-Reduced-Motion: Communicates the user's accessibility setting for minimizing animations ("reduce" or "no-preference"), critical for serving motion-safe experiences to users with vestibular disorders.
• Sec-CH-Prefers-Contrast: Exposes the user's contrast preference ("more", "less", "no-preference", "custom"), enabling server-side delivery of high-contrast CSS without client-side media query evaluation.

Client hints provide real-time network condition telemetry, allowing servers to adapt payload size and asset quality based on the user's effective connection type and explicit data-saving preferences.

• Save-Data: The Save-Data hint is a boolean token ("on" or absent) indicating the user has enabled a data-reduction mode in their browser, signaling the server to serve compressed images, defer non-critical assets, and minimize total bytes transferred.
• Sec-CH-UA-Form-Factors: A structured hint indicating the device's primary usage mode, such as "Desktop", "Mobile", "Tablet", "XR", or "Automotive", enabling server-side adaptive layout decisions.
• Downlink and RTT: Legacy network hints like Downlink (estimated bandwidth in Mbps) and RTT (round-trip time in ms) are being replaced by the more structured Network Information API but remain in use for progressive enhancement.