HTTP Headers Explainer
Look up common HTTP headers and explain pasted raw headers.
Search reference
| Header | Category | Description |
|---|---|---|
| Accept | Request | Media types the client can process, e.g. application/json. |
| Accept-Encoding | Request | Compression algorithms the client supports, e.g. gzip, br. |
| Accept-Language | Request | Preferred natural languages for the response. |
| Authorization | Request | Credentials for authenticating the request, e.g. Bearer token. |
| Cache-Control | General | Directives for caching behavior in both requests and responses. |
| Content-Encoding | Response | Compression applied to the response body. |
| Content-Length | General | Size of the message body in bytes. |
| Content-Security-Policy | Security | Restricts sources for scripts, styles, images, etc. to prevent XSS. |
| Content-Type | General | MIME type of the body, e.g. application/json; charset=utf-8. |
| Cookie | Request | Stored cookies sent back to the server. |
| CORS (Access-Control-Allow-Origin) | Security | Specifies which origins may access the resource cross-origin. |
| ETag | Response | Opaque identifier for a specific version of a resource, used for caching. |
| Host | Request | Domain name and port of the server being requested. |
| If-Modified-Since | Request | Conditional request — only return the resource if changed since this date. |
| If-None-Match | Request | Conditional request using ETag to avoid re-downloading unchanged resources. |
| Location | Response | URL to redirect to, used with 3xx status codes. |
| Origin | Request | The origin (scheme + host + port) that initiated the request. |
| Referer | Request | The URL of the page that linked to the resource being requested. |
| Set-Cookie | Response | Instructs the client to store a cookie. |
| Strict-Transport-Security | Security | Forces browsers to use HTTPS for future requests (HSTS). |
| User-Agent | Request | Identifies the client application, OS, and device. |
| Vary | Response | Lists request headers used to select the response, for caching purposes. |
| WWW-Authenticate | Response | Indicates the auth scheme required to access the resource. |
| X-Content-Type-Options | Security | Set to nosniff to prevent MIME-type sniffing. |
| X-Frame-Options | Security | Controls whether the page can be embedded in an iframe, to prevent clickjacking. |
| X-Forwarded-For | Request | Identifies the originating IP address of a client through a proxy. |
Paste raw headers to explain
MIME type of the body, e.g. application/json; charset=utf-8.
Directives for caching behavior in both requests and responses.
Controls whether the page can be embedded in an iframe, to prevent clickjacking.
About the HTTP Headers Explainer
Search a reference of common HTTP request, response, and security headers, or paste raw headers to get each one explained inline — all offline, no network calls.
Examples
Explain header
Cache-Control: no-cacheOutput
Directives for caching behavior.Related tools
CIDR Range Expander
Network & IP
Expand a CIDR block into individual addresses, or compress a range into CIDR blocks.
DNS Record Types Reference
Network & IP
Searchable reference of DNS record types with examples.
HTTP Status Codes
Network & IP
Searchable reference of HTTP status codes with meaning and usage guidance.
IP Converter
Network & IP
Convert IPv4 to decimal/hex/binary, and expand or compress IPv6.
IPv6 Expander/Compressor
Network & IP
Expand an IPv6 address to full form or compress it to shorthand.
MAC Address Tools
Network & IP
Validate and reformat MAC addresses, and look up the OUI vendor prefix.
Frequently asked questions
Version 1.0.0 · Updated 2026-08-07 · Runs entirely in your browser