HTTP Header Explainer
Paste a block of HTTP request or response headers and get every line explained, with the spec that defines it and what your value actually means.
Works with curl -I output, the "Raw" copy from browser DevTools, and plain
Name: value lines. Explanations update as you type.
Paste a block of HTTP headers above — or press “Load sample” — and every line is explained here as you type.
Header reference — search all known headers
| Header | Direction | What it does | Copy |
|---|
How it works
Paste a block of HTTP headers — the output of curl -I, a "Copy request
headers" from Chrome or Firefox DevTools, or anything shaped like Name: value
— and every line is parsed and explained: what the header is for, whether it belongs on
a request or a response, which specification defines it, and what your particular value
actually means. The parser follows the field-line grammar of
RFC 9110 (HTTP Semantics) and RFC 9112 (HTTP/1.1): it
understands a leading status line such as HTTP/2 200 or a request line such as
GET /index.html HTTP/1.1, folds obsolete line-continuations, strips the
> and < prefixes that curl -v adds, keeps
repeated headers separate, and tells you plainly which lines it could not read.
Values are decoded against their own specs where that helps: Cache-Control and
Age directives against RFC 9111 (so
max-age=31536000 reads as "1 year"), Set-Cookie attributes against
RFC 6265 with a warning when Secure, HttpOnly or
SameSite is missing, Strict-Transport-Security against
RFC 6797, ETag and the If-* conditionals against
RFC 9110, and the CORS headers against the WHATWG Fetch standard. Headers that are not in the
reference are still listed, marked as unrecognised rather than guessed at.
Everything runs in your browser: the page makes no network requests, so it never fetches the
site whose headers you pasted and never sends your headers anywhere. That matters, because a
real header dump routinely contains session cookies, Authorization tokens and
internal hostnames. Nothing is uploaded, logged or stored.
Frequently asked questions
How do I read HTTP headers?
Paste the block straight from curl -I, from the "Raw" copy in your browser DevTools network panel, or as plain Name: value lines. Each header is listed with what it does, whether it belongs on a request or a response, the RFC that defines it, and a breakdown of your particular value. A leading status line such as HTTP/2 200 or a request line such as GET /index.html HTTP/1.1 is recognised too, and lines that are not valid header fields are reported rather than silently dropped.
What does Cache-Control: max-age=31536000 mean?
max-age is a freshness lifetime in seconds, so 31536000 seconds is 365 days: the browser may reuse the cached copy for a year without asking the origin again. The explainer converts every duration for you and spells out the other RFC 9111 directives alongside it, including the difference between no-cache (store it, but revalidate every time) and no-store (never write it to any cache), and it flags the contradictory no-store plus max-age combination.
Is it safe to paste headers with cookies or tokens into this tool?
Yes. The parsing, the reference data and the whole 90-header lookup are bundled into the page and run in your browser, and the page makes no network requests at all: it never fetches the site whose headers you pasted and never sends your headers anywhere. That matters because a real header dump usually contains a session cookie, an Authorization token or an internal hostname. Even so, treat any credential you paste anywhere as one you should rotate.