HTTP Headers Parser
Paste raw HTTP request or response headers and get every field broken out with its name, value, and an explanation of what it does, with security-related headers highlighted.
FreeOnline Tool
Loading…
How to Use
- Paste your HTTP request or response header text into the input box (copy it from your browser devtools or from curl output).
- Click the "Parse" button.
- Review the name, value, and meaning of each header field.
- Click a field to read a more detailed explanation of it.
Features
- Parses every standard field found in HTTP request and response headers.
- Explains what each header field actually means in plain language.
- Recognizes common fields such as Content-Type, Cache-Control, and Authorization.
- Highlights security-related headers including CORS, CSP, and HSTS.
- Formats long header values so they stay readable.
Use Cases
Debugging an API
Parse the headers of a request and its response to confirm that Content-Type, Authorization, and CORS fields are configured the way you intended.
Verifying caching behavior
Inspect Cache-Control, ETag, and Last-Modified to confirm the server is applying the caching policy you expect.
Reviewing security configuration
Check whether HSTS, CSP, X-Frame-Options, and similar headers are present and correctly set so you can spot weak spots early.
Tracking down CORS failures
Read the Access-Control-Allow-* headers to find the exact reason a cross-origin request is being rejected.
FAQ
How do I get HTTP headers from my browser?
Open Chrome DevTools (F12), switch to the Network tab, reload the page, and click any request. Request Headers and Response Headers appear in the panel on the right.
What is the difference between Content-Type and Accept?
Content-Type describes the format of the body you are sending, while Accept tells the other side which formats you would like to receive in the response.
How does Cache-Control: no-cache differ from no-store?
no-cache allows a cached copy to be stored but requires revalidation with the server before every reuse. no-store forbids caching entirely, so a fresh copy is fetched every time.
What is the difference between Bearer and Basic in the Authorization header?
Basic sends a Base64-encoded username:password pair and should only ever be used over HTTPS. Bearer sends a token, usually a JWT, and is the safer option used by OAuth 2 and most APIs.