HTTP Headers Explainer
Look up common HTTP headers and explain pasted raw headers.
Search reference
| Header | Category | Description |
|---|---|---|
| Accept | Request | Media types the client can process, e.g. application/json. |
| Accept-Encoding | Request | Compression algorithms the client supports, e.g. gzip, br. |
| Accept-Language | Request | Preferred natural languages for the response. |
| Authorization | Request | Credentials for authenticating the request, e.g. Bearer token. |
| Cache-Control | General | Directives for caching behavior in both requests and responses. |
| Content-Encoding | Response | Compression applied to the response body. |
| Content-Length | General | Size of the message body in bytes. |
| Content-Security-Policy | Security | Restricts sources for scripts, styles, images, etc. to prevent XSS. |
| Content-Type | General | MIME type of the body, e.g. application/json; charset=utf-8. |
| Cookie | Request | Stored cookies sent back to the server. |
| CORS (Access-Control-Allow-Origin) | Security | Specifies which origins may access the resource cross-origin. |
| ETag | Response | Opaque identifier for a specific version of a resource, used for caching. |
| Host | Request | Domain name and port of the server being requested. |
| If-Modified-Since | Request | Conditional request — only return the resource if changed since this date. |
| If-None-Match | Request | Conditional request using ETag to avoid re-downloading unchanged resources. |
| Location | Response | URL to redirect to, used with 3xx status codes. |
| Origin | Request | The origin (scheme + host + port) that initiated the request. |
| Referer | Request | The URL of the page that linked to the resource being requested. |
| Set-Cookie | Response | Instructs the client to store a cookie. |
| Strict-Transport-Security | Security | Forces browsers to use HTTPS for future requests (HSTS). |
| User-Agent | Request | Identifies the client application, OS, and device. |
| Vary | Response | Lists request headers used to select the response, for caching purposes. |
| WWW-Authenticate | Response | Indicates the auth scheme required to access the resource. |
| X-Content-Type-Options | Security | Set to nosniff to prevent MIME-type sniffing. |
| X-Frame-Options | Security | Controls whether the page can be embedded in an iframe, to prevent clickjacking. |
| X-Forwarded-For | Request | Identifies the originating IP address of a client through a proxy. |
Paste raw headers to explain
MIME type of the body, e.g. application/json; charset=utf-8.
Directives for caching behavior in both requests and responses.
Controls whether the page can be embedded in an iframe, to prevent clickjacking.
About the HTTP Headers Explainer
Search a reference of common HTTP request, response, and security headers, or paste raw headers to get each one explained inline — all offline, no network calls.
Examples
Explain header
Cache-Control: no-cacheOutput
Directives for caching behavior.Keyboard shortcuts
- Copy the main outputCtrl / ⌘ + Shift + C
- Download the resultCtrl / ⌘ + S
- Share this toolCtrl / ⌘ + Shift + S
- Reset the inputsAlt + R
- Open the tool search paletteCtrl / ⌘ + K
Related tools
HTTP Header Comparator
Network & IP
Diff two sets of HTTP headers, case-insensitively.
Bulk URL Status Checker
Network & IP
Check HTTP status codes and redirects for many URLs at once.
Cookie Attribute Analyzer
Network & IP
Parse Set-Cookie headers and flag security issues.
HTTP Cache Header Planner
Network & IP
Plan Cache-Control, ETag and max-age headers for any asset type.
HTTP Status Codes
Network & IP
Searchable reference of HTTP status codes with meaning and usage guidance.
URL Redirect Chain Analyzer
Network & IP
Trace every redirect hop with status codes, timing and the final URL.
Frequently asked questions
Read more
- Understanding CORS errors and how to fix them
Why 'No Access-Control-Allow-Origin header' shows up, what the browser is actually enforcing, and the exact headers that fix each case.
- Testing APIs from the browser: what works, what CORS blocks, and why
How a browser-based REST client sends real requests, why some endpoints fail with a CORS error, and how to work around it without installing anything.
- Debugging WebSockets: handshake, close codes, and reading a transcript
How to test a ws:// or wss:// endpoint from the browser, and what the common close codes actually mean.
Version 1.0.0 · Updated 2026-08-07 · Runs entirely in your browser