How to Use BrowserScan with UAParser.js for Browser Audits

BrowserScan shows you what a website can observe about your browser in real time. UAParser.js turns the raw User-Agent string and Client Hints into structured fields your code can act on. Used together, they close a gap that neither tool fills alone: BrowserScan tells you what is exposed, and UAParser.js tells you how that exposure gets interpreted server-side.

This article explains the workflow, the setup steps, practical examples, and the problems the combination solves.

Why pair BrowserScan with UAParser.js?

First viewport screenshot of uaparser.dev.

BrowserScan is a free online tool that analyzes browser fingerprints and privacy leaks. It reports your IP address, timezone, location, ISP, proxy status, blacklist status, and a fingerprint authenticity score. It also runs bot detection signals such as WebDriver and CDP indicators, plus DNS leak, WebRTC leak, canvas fingerprint, plugin, client hints, and browser kernel checks.

UAParser.js is a JavaScript library and REST API for detecting browsers, operating systems, devices, CPU architectures, apps, bots, and AI crawlers from User-Agent strings and Client Hints. It returns structured client insights such as browser name and version, OS name and version, and device type. It is roughly 11.9 kB minified and gzipped, distributed via npm, and works in both browsers and Node.js.

The two tools answer different questions:

• BrowserScan answers: What can this browser reveal about me right now?
• UAParser.js answers: How will a server classify the signals this browser sends?

A privacy audit needs both answers. A fingerprint that looks clean in the browser can still be misclassified by a parser, and a parser can only be as accurate as the signals it receives.

The combined workflow at a glance

1. Baseline the browser. Run BrowserScan to capture your fingerprint, leak results, and bot signals.
2. Capture the raw signals. Record navigator.userAgent and the Sec-CH-UA-* headers your browser sends.
3. Parse them. Feed those signals into UAParser.js on the client or server.
4. Compare. Check whether the parsed browser, OS, and device match what BrowserScan reported.
5. Fix or document. Adjust configuration, headers, or test expectations, then re-run both tools.

Step 1: Run a BrowserScan baseline

First viewport screenshot of www.browserscan.net.

Open BrowserScan and run the main fingerprint test first. Note the following:

• The reported browser name and version, OS, and device type
• The fingerprint authenticity score
• Bot detection signals (WebDriver, CDP, navigator properties)
• Client Hints values, if your browser sends them
• DNS and WebRTC leak results, plus IP, timezone, and proxy status

Save a screenshot or export the values. This is your reference point for every later comparison.

If you are auditing a proxy or VPN setup, also run the leak tests before changing anything. For a deeper look at IP-level exposure, see bulk IP analysis for browser fingerprint privacy.

Step 2: Capture the raw signals

In the browser console, collect the strings your code will parse:

console.log(navigator.userAgent);
console.log(navigator.userAgentData?.brands);
console.log(navigator.userAgentData?.mobile);

On the server side, log the incoming request headers:

console.log(req.headers['user-agent']);
console.log(req.headers['sec-ch-ua']);
console.log(req.headers['sec-ch-ua-platform']);
console.log(req.headers['sec-ch-ua-mobile']);

These are the same inputs UAParser.js consumes. Keeping a copy makes mismatches reproducible.

Step 3: Set up UAParser.js

Client-side setup

Install the package or load it from a CDN:

npm install ua-parser-js

<script src="https://cdn.jsdelivr.net/npm/ua-parser-js/dist/ua-parser.min.js"></script>

Then parse the current browser:

const uap = new UAParser();
const result = uap.getResult();
console.log(result.browser); // { name, version, major, type }
console.log(result.os);      // { name, version }
console.log(result.device);  // { model, type, vendor }
console.log(result.cpu);     // { architecture }

Server-side setup with Client Hints

Since v2.0.0, UAParser.js can accept Client Hints alongside the User-Agent header. Client Hints only work in a secure context (localhost or HTTPS) and in Chromium-based browsers from version 85 onward:

const http = require('http');
const uap = require('ua-parser-js');

http.createServer(function (req, res) {
  const hints = 'Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Bitness';
  res.setHeader('Accept-CH', hints);
  res.setHeader('Critical-CH', hints);

  const result = uap(req.headers).withClientHints();
  res.end(JSON.stringify(result, null, 2));
}).listen(1337, '127.0.0.1');

For the full API surface, see the UAParser.js documentation and the HTML quickstart.

Step 4: Compare BrowserScan and UAParser.js output

First viewport screenshot of www.browserscan.net.

Put the two reports side by side. The table below shows what a match and a mismatch look like.

UAParser.js also exposes helper methods such as isChromeFamily(), isBot(), and isAICrawler(). Use them to classify traffic the same way your backend would.

Example: catching a spoofed User-Agent

Suppose BrowserScan reports Firefox on Windows, but your server logs show a Chrome User-Agent with a Linux platform hint. Parse the request headers:

const { browser, os } = uap(req.headers).withClientHints();
if (browser.name === 'Chrome' && os.name === 'Windows') {
  // flag: browser report and server parse disagree
}

That disagreement is exactly the kind of inconsistency fingerprinting systems look for. BrowserScan surfaces it from the browser side; UAParser.js surfaces it from the server side.

Step 5: Validate bot and automation detection

First viewport screenshot of www.browserscan.net.

BrowserScan's bot detection checks WebDriver, CDP, and navigator properties. UAParser.js adds a second layer by classifying known bot and AI crawler User-Agent strings. Run both against the same environment:

• If BrowserScan flags automation but UAParser.js sees a normal browser string, the automation is hiding its User-Agent.
• If UAParser.js flags a bot but BrowserScan shows clean browser signals, the client may be a headless browser with a rewritten string.

Either pattern is worth investigating before you trust a test environment.

Step 6: Re-test after changes

After adjusting headers, proxy settings, or browser configuration, repeat the loop: BrowserScan baseline, raw signal capture, UAParser.js parse, comparison. Keep the previous results so you can see which change moved which signal.

Problems the combination solves

• Blind spots in privacy audits. BrowserScan shows exposure; UAParser.js shows interpretation. Together they cover both sides of the request.
• Spoofing detection. Comparing parsed output against browser-reported values reveals inconsistencies that a single tool misses.
• Analytics accuracy. Teams that segment traffic by browser or device can verify their parser against a live fingerprint report.
• Bot triage. Two independent signals make automation detection more reliable than either alone.
• Client Hints debugging. BrowserScan shows what hints are sent; UAParser.js shows how they are read.

When to use one tool instead of both

Use BrowserScan alone when you only need a quick privacy check, a leak test, or a fingerprint authenticity score. It requires no setup.

Use UAParser.js alone when you are building analytics, personalization, or traffic classification and do not need to audit the browser's own exposure.

Use both when you are validating a privacy setup, debugging a parser, testing a proxy or VPN, or investigating inconsistent traffic classification. For a broader comparison of fingerprinting tools, see BrowserScan vs Pixelscan.dev and WebBrowserTools and the 2026 browser privacy testing ranking.

Related reading

• BrowserScan vs VPN Master Pro IP Checker: 2026 Comparison - Compare BrowserScan and VPN Master Pro IP Checker for fingerprinting, leak tests, and privacy audits. See which tool reveals more and which upsells a VPN.
• DeviceAtlas Review: Device Intelligence for Real-Time Targeting - Evidence-based DeviceAtlas review covering device intelligence use cases, ideal users, setup, pricing signals, strengths, limitations, and decision criteria.

Sources and further reading

• UAParser.js: JavaScript User-Agent Parser & Device Detector - Detect browsers, operating systems, devices, CPU architectures, apps, bots, and AI crawlers from User-Agent strings and Client Hints with UAParser.js.

FAQ

Does BrowserScan use UAParser.js?

BrowserScan is an independent online testing platform. UAParser.js is a separate JavaScript library. They are complementary tools, not components of one product.

Can I run UAParser.js in the browser and on the server?

Yes. UAParser.js is isomorphic and works in browsers and Node.js with a single API. Client Hints parsing requires a secure context.

What is the difference between a fingerprint and a User-Agent parse?

A fingerprint is a combination of many browser and device signals. A User-Agent parse is a structured reading of one or two of those signals. BrowserScan reports the fingerprint; UAParser.js structures the User-Agent and Client Hints.

Why do BrowserScan and UAParser.js sometimes disagree?

Disagreements usually come from spoofed User-Agent strings, missing Client Hints, browser extensions that rewrite headers, or outdated parser data. Comparing both outputs is how you find them.

Is UAParser.js free to use?

UAParser.js is distributed via npm and has a long maintenance history on GitHub. Check its official site for current licensing and package options.

Conclusion

BrowserScan and UAParser.js solve different halves of the same problem. BrowserScan reveals what your browser exposes; UAParser.js shows how a server turns those signals into browser, OS, device, and bot classifications. Run BrowserScan first, capture the raw signals, parse them with UAParser.js, and compare. That loop turns a one-off privacy check into a repeatable audit you can trust.