HTTP header parser
This HTTP header parser reads headers copied from browser developer tools or curl and lays them out in a clean table. Developers and site owners use it to spot missing security headers and to understand how a response will be cached.
- Runs in your browser
- Free, no account needed
- Copy or download the result
Result
Example
HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cache-Control: public, max-age=600 ETag: "33a64df5" Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Set-Cookie: sid=abc123; Path=/; Secure; HttpOnly Set-Cookie: theme=dark; Path=/ Vary: Accept-Encoding Server: nginx/1.25.3
Response: HTTP/1.1 200 OK Headers: 8 distinct; duplicates combined with commas, Set-Cookie kept separate Header Value Content-Type text/html; charset=utf-8 Cache-Control public, max-age=600 ETag "33a64df5" Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Set-Cookie sid=abc123; Path=/; Secure; HttpOnly Set-Cookie theme=dark; Path=/ Vary Accept-Encoding Server nginx/1.25.3 Security headers: Strict-Transport-Security: present, max-age 31,536,000 seconds, includes subdomains. Browsers only honor it over HTTPS. Content-Security-Policy: missing. A CSP limits where scripts and other content can load from. X-Content-Type-Options: present, nosniff Referrer-Policy: missing. Browsers then use their default, commonly strict-origin-when-cross-origin. Permissions-Policy: missing. It can turn off features such as camera or geolocation. Frame protection: missing. Use CSP frame-ancestors or X-Frame-Options to stop other sites framing the page. Server: reveals a software version (nginx/1.25.3). Caching headers: Cache-Control public: shared caches may store it, even for authenticated requests Cache-Control max-age=600: fresh for this many seconds (600) ETag: present, so caches can revalidate with If-None-Match. Vary: Accept-Encoding. Caches keep separate copies per value of these request headers.
How to use the http header parser
- Paste headers into the Raw HTTP headers box, one Name: value per line. The status line is optional.
- Leave Message type on Detect automatically, or choose Response headers or Request headers.
- Press Run.
- Read the table and notes, then use Copy result or Download.
How it works
Duplicate headers are combined with commas, except Set-Cookie, which stays on separate rows.
For responses it reports Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and frame protection as present or missing, and notes version numbers in Server or X-Powered-By.
Cache-Control directives are explained one by one, along with Expires, ETag, Last-Modified, Age and Vary.
Reading stops at the first blank line, so a pasted body is ignored, and lines that are not Name: value pairs are listed as skipped.
Nothing is fetched. The tool only reads the text you paste.
Everything runs in your browser. Your input is not uploaded or stored.
Questions and answers
How do I copy response headers from my browser?
Open developer tools, choose the Network tab, click the request and find the Response Headers section. Many browsers offer a raw view you can copy.
Which security headers should a website send?
Common ones are Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options set to nosniff, Referrer-Policy, Permissions-Policy and frame protection through CSP frame-ancestors or X-Frame-Options.
What does Cache-Control: no-cache mean?
The response may be stored, but a cache must check with the server before using it again. To stop storage entirely, use no-store.