What operating system am I using?

There are two completely different questions hiding behind “OS detection”, and mixing them up is where most confusion starts. The first is what operating system is this visitor on? — answered by the browser itself. The second is what machine sits behind this IP address? — which can only ever be estimated.

Detection from the browser: exact

Every HTTP request your browser sends includes a User-Agent header, a short string naming the browser, its version, the rendering engine and the operating system. Chromium browsers additionally send User-Agent Client Hints, a structured version of the same data that can be queried with higher entropy: platform, platform version, CPU architecture, bitness and even the device model on Android. That is why the card at the top of this page can name your OS and version outright rather than guessing. Firefox and Safari still rely on the classic User-Agent string, which is why some fields read “Not reported” there.

Beyond the headers, a site can narrow things further with JavaScript: the number of logical CPU threads, screen size and pixel ratio, touch point count, installed font metrics, WebGL renderer strings and how the platform rasterises canvas output. Combined, these form a device fingerprint that survives a User-Agent change — which is exactly why simply spoofing a User-Agent rarely fools a serious anti-bot system.

Detection from an IP address: an estimate

An IP address is an address on a network, not a machine identifier. Nothing in the packet says “Windows 11”. What you can read is the surrounding context. Reverse DNS often encodes exactly what the device is — names containing cpe, dyn, dsl, cable or ppp almost always sit on consumer lines behind a router, while names containing lte, mobile or a carrier brand indicate a cellular connection. The ASN and ISP tell you whether the range belongs to a hosting company, a broadband provider or a mobile operator. Public IP intelligence adds mobile, hosting and proxy flags.

From there the estimate is statistical rather than certain. Mobile carrier exits are overwhelmingly Android handsets or LTE modems. Datacenter ranges are overwhelmingly Linux servers. Consumer lines that answer on a proxy port and resolve to CPE-style names are usually embedded router firmware such as OpenWrt, RouterOS or a vendor build. When a proxy echoes back a Server or Viaheader naming Squid, nginx, 3proxy or Microsoft-IIS, that is a much stronger signal, because proxy software ships per platform.

This tool only reports high confidence when at least two strong, independent signals agree. One strong signal gives medium confidence, weak hints alone give low confidence, and when nothing useful is available the answer stays “Not determined”. We would rather show you an honest blank than a fabricated operating system.

What a proxy changes, and what it does not

Routing through a residential proxy replaces the IP a site sees, so the location, ISP and ASN all change with it — and any OS estimate made from the IP now describes the proxy's exit host, not you. Your browser keeps sending the same User-Agent, the same client hints and the same canvas fingerprint. That mismatch — a German residential IP paired with a headless Linux fingerprint, for instance — is one of the cheapest detection signals there is. If you are automating at scale, match the fingerprint to the exit: mobile IPs should carry mobile fingerprints, US residential IPs should carry a plausible US desktop profile.