HTTP Header Viewer
Paste raw HTTP response headers to parse the status line and headers into a readable table, with plain-English explanations of common headers.
Copy headers from your browser's DevTools Network tab, curl -I output, Postman, or any other tool.
Status
OK
HTTP/1.1| Header Name | Value |
|---|---|
| Content-TypeThe media type (MIME type) of the response body, e.g. text/html or application/json. | text/html; charset=utf-8 |
| Cache-ControlDirectives for how the response may be cached by browsers and proxies. | max-age=3600 |
| ETagA version identifier for the resource, used for cache validation. | "abc123" |
| Content-EncodingThe compression algorithm applied to the response body, e.g. gzip or br. | gzip |
| ServerIdentifies the software running on the origin server, e.g. nginx or cloudflare. | nginx |
How to Use the HTTP Header Viewer
Paste raw HTTP response headers — copied from your browser's DevTools Network tab, a curl -I command, Postman, or any other tool — into the box above. The first "HTTP/..." line is parsed as the status line and shown separately, and every subsequent "Header-Name: value" line is split on its first colon and rendered as a clean table. This tool is a parser and formatter for headers you already have — it does not fetch live headers from a URL itself.
Example
Pasting Content-Type: text/html; charset=utf-8 produces a row with header name "Content-Type" and value "text/html; charset=utf-8", along with a plain-English note explaining what the Content-Type header does, since it's one of the common well-known headers this tool recognizes.
Common Use Cases
- Quickly reading and understanding a long block of headers copied from DevTools or curl.
- Checking which caching, security, or CORS headers a server response includes.
- Learning what common headers like Content-Security-Policy or Strict-Transport-Security actually do.
FAQs
- Why doesn't this tool fetch headers directly from a URL? Browsers block cross-origin JavaScript from reading most response headers of arbitrary third-party sites due to CORS restrictions — a live-fetch version would fail for the vast majority of real websites and would be misleading. Instead, this tool works with headers you've already captured from DevTools, curl, or another tool that isn't subject to those browser restrictions.
- How does the parser split each header line? Each line is split on its first colon only — everything before the first colon becomes the header name, and everything after (trimmed) becomes the value. This correctly handles values that themselves contain colons, like
Content-Type: text/html; charset=utf-8or time-formatted values. - Which headers get a plain-English explanation? A set of about a dozen commonly seen headers — including Content-Type, Cache-Control, Set-Cookie, Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, Access-Control-Allow-Origin, ETag, Content-Encoding, Vary, Location, and Server — show a short note beneath the header name when they appear in your pasted input.