What HTTP headers does my browser send?
The list above reconstructs what your browser sends with every request, because JavaScript cannot read its own request headers. The reconstruction is close but not authoritative: your server-side view would also show cookies, Accept encodings, and any header an extension or proxy added on the way out.
A view of the main HTTP request headers your browser sends is shown above. Every time you load a page, your browser attaches a set of headers, small labelled fields that tell the server about the request. We reconstruct the client-visible ones here from what your browser exposes to JavaScript.
Common headers include User-Agent (your browser identity), Accept-Language (your language preferences), Accept (which content types you can handle), and increasingly the Sec-CH-UA Client Hints that report browser brand, platform and mobile status in a structured way. Some headers, like your IP-derived details, are added by the network rather than your browser.
Headers are the quiet handshake behind every request. Most people never see them, yet they shape which version of a page you get and feed analytics and fingerprinting alike.
How a website reads this
This is the exact call a page makes. Nothing else is involved, and nothing is sent anywhere: the value is read in your browser and displayed to you.
reconstructed from navigator, not read directlyA page cannot read the headers its own document was fetched with. What this card shows is the same information rebuilt from the JavaScript equivalents: navigator.userAgent for User-Agent, navigator.languages for Accept-Language, document.referrer for Referer. The server, of course, sees the real thing.
- Needs your permission
- No, it is read silently
- Can it be faked
- Yes. Headers are just text an HTTP client chooses to send. Extensions rewrite them routinely, and any script or command line tool can send anything.
- Contribution to a fingerprint
- Not counted. Not counted separately: every field here is already counted on its own page, and double counting is how entropy estimates end up claiming more than there are people. How we estimate this.
What you should know
Why sites collect it
Servers must read headers to serve the right content: the correct language, a compatible layout, the right compression. Analytics and security systems parse them to classify traffic, and fingerprinting scripts combine them for a device profile.
Privacy implications
Individually most headers are low-entropy, but together they form one of the richest passive fingerprints available, because they arrive on every request without any script running. The order and exact set of headers can itself be distinctive. Client Hints aim to make this more privacy-respecting by sending only what a site asks for.
How to change or hide it
You cannot stop headers entirely without breaking the web, but you can reduce distinctiveness: keep your browser updated so your headers match the crowd, use a browser that minimises Client Hints, and avoid extensions that inject unusual headers. Privacy browsers normalise headers to blend users together.
Frequently asked questions
Can I see every header a server receives?
Not purely in the browser. Some headers are added by the network and are not visible to page scripts. This page shows the client-visible set; a server-side echo tool shows the full list.
Are request headers a privacy risk?
Collectively they can fingerprint you, since they are sent on every request without consent. Keeping a mainstream, updated setup helps you blend in.
Sources
Browser behaviour changes and vendors cap these values differently, so the claims above that are not self-evident are checked against the specifications and vendor documentation below.
Last checked on . How these values are measured and estimated is set out on the methodology page.
Something wrong here? Tell us what your browser reports and it gets corrected.