HTTP Header Parser

Paste raw HTTP request or response headers to parse and inspect them. Common headers include explanations and security insights.

Sample Header Logs:

Raw HTTP Headers12 lines • 407 B

Status:200 Protocol: HTTP/2

Showing 11 of 11 headers

Header	Value	Description
content-type	application/json; charset=utf-8	Indicates the media type of the resource/body, including optional charset.
cache-control	no-cache, no-store, must-revalidate	Directives for caching mechanisms in requests and responses.
x-request-id	4f3a2b1c-8d9e-4f1a-b2c3-d4e5f6a7b8c9	Unique identifier for the request, used for tracing.
x-ratelimit-limit	1000	Maximum number of requests allowed in the rate limit window.
x-ratelimit-remaining	999	Number of requests remaining in the current rate limit window.
x-ratelimit-reset	1750000000	Unix timestamp when the rate limit window resets.
strict-transport-security	max-age=31536000; includeSubDomains; preload	Forces browsers to only use HTTPS for this domain.
content-encoding	gzip	Encoding applied to the response body (gzip, br, deflate).
vary	Accept-Encoding	Tells caches which request headers to use for cache key variation.
access-control-allow-origin	*	CORS header specifying which origins can access this resource.
content-length	342	The size of the response body in bytes.

Headers analyzed and categorized

Total: 11Security Headers: 1CORS Headers: 1Cache Directives: 2

HTTP Header Parser

HTTP headers carry metadata about requests and responses. Security headers like Strict-Transport-Security, Content-Security-Policy, and X-Content-Type-Options protect against common attacks. Cache headers like Cache-Control and ETagcontrol browser caching behavior. Copy headers from browser DevTools (Network tab → Headers) or from curl -v output.

Built and maintained by Meet Shah · Last updated 19 July 2026

What this tool is used for

Parsing a raw header block from a capture into readable pairs.
Reading an explanation of a header you have not seen before.
Checking whether a header you expected is present.
Inspecting a response's headers from a paste rather than a browser.
Comparing two responses' header sets to find what an intermediary added.

Frequently Asked Questions

What can I paste in?: A raw request or response block copied from devtools, curl's `-i` output, or a log. The first line is recognised as either a request line with a method and path or a status line with a code, and the rest are parsed as fields.
How are headers matched to descriptions?: By lowercased name, since field names are case-insensitive and HTTP/2 requires them lowercase on the wire. That means the same paste works whether it came from an HTTP/1.1 capture or a modern devtools panel.
What do the security and CORS groupings tell me?: Which headers are doing protective work versus routine transport. Seeing the security group nearly empty on a response is a faster read than scanning thirty alphabetical lines for the three that matter.
Can a header appear more than once?: Yes, and it is legal — `Set-Cookie` in particular is sent once per cookie and must not be merged. Repeated fields are kept as separate entries rather than collapsed into one.
Why does a folded multi-line header not parse?: Line folding — continuing a value on an indented next line — was deprecated by RFC 7230 and is rejected by most modern servers. Anything still producing it should be fixed rather than accommodated.
Does it fetch the headers for a URL?: No, it parses text you supply. A browser cannot read arbitrary cross-origin response headers without CORS permission, so a tool claiming to do it live is either proxying through a server or limited to a handful of exposed fields.

Common errors and gotchas

Parsing a paste that lost its line breaks, which merges several headers into one value.
Overlooking a repeated header, which some are allowed to be and which combine differently.
Misreading a folded header, which older syntax allowed to span lines.
Treating HTTP/2 pseudo-headers as ordinary headers, which they are not.
Reading a header's presence as proof it was honoured.