📨HTTP Headers Analyzer

About this tool

Paste headers from curl -i, curl -v, DevTools, a proxy or a log. Each header is listed with a plain-English explanation. Set-Cookie, Cache-Control and HSTS are broken down, a security-header checklist is shown for responses, and you can copy everything as JSON.

Reading HTTP headers

Headers carry the metadata of every HTTP request and response: content type and size, compression, caching rules, redirects, cookies, CORS permissions and security policies. The analyzer explains about 50 common headers. Cache-Control max-age values are converted into minutes, hours or days, each Set-Cookie is split into its attributes (Path, Max-Age, Secure, HttpOnly, SameSite) with a warning if Secure, HttpOnly or SameSite is missing, and HSTS max-age is shown in years. For responses, it checks the five headers security scanners look for: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It also flags Server and X-Powered-By values that reveal your stack. Folded multi-line headers and HTTP/2 pseudo-headers such as :status are handled. Honest limits: a missing header isn't always a vulnerability (for example, CSP needs careful design), and explanations are summaries rather than the full specification. Authorization and Cookie headers contain secrets, so redact them before sharing, even though nothing here leaves your browser. HTTP status codes, the CSP header generator and the HAR viewer are related.

Frequently asked questions