Does this cover every HTTP header?

It covers the most common request, response, and security headers used in everyday web development.

Can I paste multiple headers at once?

Yes, paste raw headers one per line in the 'Paste raw headers' panel.

Are unrecognized headers flagged?

Yes, headers not in the reference table are marked as unrecognized or custom.

Is my data uploaded to a server?

No. This tool runs entirely in your browser using standard web APIs, so your input never leaves your device and nothing is logged or stored on our servers.

Does it work offline and on mobile?

Yes. Once the page has loaded it keeps working without a network connection, and the layout is responsive so it stays usable on phones and tablets.

HTTP Headers Explainer

Look up common HTTP headers and explain pasted raw headers.

Support

Works Offline

Privacy First

No Login

No API

Search reference

Header name or keyword

Header	Category	Description
Accept	Request	Media types the client can process, e.g. application/json.
Accept-Encoding	Request	Compression algorithms the client supports, e.g. gzip, br.
Accept-Language	Request	Preferred natural languages for the response.
Authorization	Request	Credentials for authenticating the request, e.g. Bearer token.
Cache-Control	General	Directives for caching behavior in both requests and responses.
Content-Encoding	Response	Compression applied to the response body.
Content-Length	General	Size of the message body in bytes.
Content-Security-Policy	Security	Restricts sources for scripts, styles, images, etc. to prevent XSS.
Content-Type	General	MIME type of the body, e.g. application/json; charset=utf-8.
Cookie	Request	Stored cookies sent back to the server.
CORS (Access-Control-Allow-Origin)	Security	Specifies which origins may access the resource cross-origin.
ETag	Response	Opaque identifier for a specific version of a resource, used for caching.
Host	Request	Domain name and port of the server being requested.
If-Modified-Since	Request	Conditional request — only return the resource if changed since this date.
If-None-Match	Request	Conditional request using ETag to avoid re-downloading unchanged resources.
Location	Response	URL to redirect to, used with 3xx status codes.
Origin	Request	The origin (scheme + host + port) that initiated the request.
Referer	Request	The URL of the page that linked to the resource being requested.
Set-Cookie	Response	Instructs the client to store a cookie.
Strict-Transport-Security	Security	Forces browsers to use HTTPS for future requests (HSTS).
User-Agent	Request	Identifies the client application, OS, and device.
Vary	Response	Lists request headers used to select the response, for caching purposes.
WWW-Authenticate	Response	Indicates the auth scheme required to access the resource.
X-Content-Type-Options	Security	Set to nosniff to prevent MIME-type sniffing.
X-Frame-Options	Security	Controls whether the page can be embedded in an iframe, to prevent clickjacking.
X-Forwarded-For	Request	Identifies the originating IP address of a client through a proxy.

Paste raw headers to explain

Content-Type: application/json

MIME type of the body, e.g. application/json; charset=utf-8.

Cache-Control: no-cache

Directives for caching behavior in both requests and responses.

X-Frame-Options: DENY

Controls whether the page can be embedded in an iframe, to prevent clickjacking.

About the HTTP Headers Explainer

Search a reference of common HTTP request, response, and security headers, or paste raw headers to get each one explained inline — all offline, no network calls.

Examples

Explain header

YAMLCache-Control: no-cache

Output

Directives for caching behavior.

Keyboard shortcuts

Copy the main outputCtrl / ⌘ + Shift + C
Download the resultCtrl / ⌘ + S
Share this toolCtrl / ⌘ + Shift + S
Reset the inputsAlt + R
Open the tool search paletteCtrl / ⌘ + K

Related tools

HTTP Header Comparator

Network & IP

Diff two sets of HTTP headers, case-insensitively.

Bulk URL Status Checker

Network & IP

Check HTTP status codes and redirects for many URLs at once.

Cookie Attribute Analyzer

Network & IP

Parse Set-Cookie headers and flag security issues.

HTTP Cache Header Planner

Network & IP

Plan Cache-Control, ETag and max-age headers for any asset type.

HTTP Status Codes

Network & IP

Searchable reference of HTTP status codes with meaning and usage guidance.

HTTP/2 & TLS Version Test

Network & IP

See which TLS versions a site accepts and whether it serves HTTP/2.

Frequently asked questions

Understanding CORS errors and how to fix them
Why 'No Access-Control-Allow-Origin header' shows up, what the browser is actually enforcing, and the exact headers that fix each case.
Testing APIs from the browser: what works, what CORS blocks, and why
How a browser-based REST client sends real requests, why some endpoints fail with a CORS error, and how to work around it without installing anything.
Debugging WebSockets: handshake, close codes, and reading a transcript
How to test a ws:// or wss:// endpoint from the browser, and what the common close codes actually mean.

Version 1.0.0 · Updated 2026-08-07 · Runs entirely in your browser

HTTP Headers Explainer

About the HTTP Headers Explainer

Examples

Keyboard shortcuts

Related tools

HTTP Header Comparator

Bulk URL Status Checker

Cookie Attribute Analyzer

HTTP Cache Header Planner

HTTP Status Codes

HTTP/2 & TLS Version Test

Frequently asked questions

Does this cover every HTTP header?

Can I paste multiple headers at once?

Are unrecognized headers flagged?

Is my data uploaded to a server?

Does it work offline and on mobile?

Read more