HTTP header parser

request or response · what each header does · CSP and Cache-Control split into directives

Paste the output of curl -i, or DevTools' "Copy response headers", and read it as a table with each header explained. The multi-valued ones — Cache-Control, Content-Security-Policy, Link, Permissions-Policy — get broken into their individual directives, which is where the mistakes actually live. Responses also get a security-header checklist.

Raw headers

Headers

Directives, broken out

Security headers

Ready.

How to use

Paste the headers. A status line (HTTP/2 200) or a request line (GET /path HTTP/1.1) is recognised and shown separately, with the status class named.
The Headers table gives each header, its value, and what it does. Credential headers are outlined so you notice before you share the paste.
Directives, broken out splits the compound headers. A Cache-Control with five directives becomes five rows; a CSP becomes one row per directive.
Security headers appears for responses and checks the five that matter most, listing what is missing and what to set.
Obsolete line folding (a header continued on an indented next line) is joined back together, so pasted-and-wrapped headers still parse.

The header pairs that cause the most confusion

Cache-Control and Vary belong together. A cacheable response that varies by Accept-Language or Accept-Encoding but does not say so in Vary will be served to the wrong users by any shared cache. Conversely, Vary: User-Agent effectively disables caching, since almost every request has a different one. If you see Cache-Control: public with no Vary on a page that adapts to the visitor, that is a bug waiting to be reported as "the site showed me someone else's language".

Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true is invalid — the combination is explicitly forbidden and browsers reject the response entirely, which presents as a CORS error that looks like the header is missing. The fix is to echo the specific requesting origin instead of *. This combination is flagged.

Content-Type without a charset on text/html leaves the browser to guess the encoding, which is both a mojibake source and, historically, an XSS vector via UTF-7 sniffing. Always send ; charset=utf-8.

X-Frame-Options versus CSP frame-ancestors. The latter supersedes the former, and where both are present CSP wins in modern browsers. Keeping X-Frame-Options for older clients is fine; relying on it alone is not.

HSTS max-age is a commitment. Once a browser has seen Strict-Transport-Security: max-age=31536000, it refuses plain HTTP to that host for a year and you cannot recall it. Add includeSubDomains only when every subdomain — including the internal ones — has a valid certificate. Test with a short max-age first.

FAQ

Does it fetch the headers for a URL?

No — a browser cannot read the response headers of a cross-origin request without CORS permission, so paste them in. curl -sI https://example.com gives you exactly the right input.

Are header names case-sensitive?

No. HTTP/1.1 names are case-insensitive, and HTTP/2 and HTTP/3 require them to be lowercase on the wire — which is why DevTools shows them lowercase for HTTP/2 responses. Matching here is case-insensitive, and names are shown as you pasted them.

Can it parse multiple Set-Cookie headers?

Yes, one per line as they appear on the wire. For the attributes and the security checks on each cookie, the cookie parser goes much deeper.

What about the Link header?

Split into individual link values here. The Link header tool parses each one's rel and attributes properly, and builds new ones.