HTTP Header Parser

Parse raw HTTP headers into a structured format

Content-Type: application/json Authorization: Bearer token X-Custom-Header: value
Loading editor...

HTTP Header Parser — Analyze & Decode HTTP Headers Online

Understanding the Basics

HTTP headers are metadata key-value pairs exchanged between clients and servers in the HTTP request and response cycle. Request headers carry information from the client: Accept (acceptable content types), Authorization (credentials), Content-Type (body format), User-Agent (client identity), Cookie (session data), and Cache-Control (caching directives). Response headers carry information from the server: Content-Type (body format), Set-Cookie (session creation), Cache-Control (caching instructions), CORS headers (Access-Control-Allow-Origin), security headers (Strict-Transport-Security, X-Content-Type-Options, Content-Security-Policy), and performance headers (Link with preload). HTTP headers are defined in numerous RFCs and are extensible — custom headers use the X- prefix convention (though RFC 6648 deprecated this for new registrations). Security-relevant headers protect against XSS (Content-Security-Policy), clickjacking (X-Frame-Options), MIME sniffing (X-Content-Type-Options), protocol downgrade (Strict-Transport-Security), and information disclosure (Server, X-Powered-By). Parsing and understanding HTTP headers is fundamental for debugging API integrations, analyzing CORS failures, auditing web application security posture, optimizing caching strategies, and configuring reverse proxies.

How to Use the Tool

  1. Paste HTTP headers (one per line in "Header-Name: value" format) into the input area — copy them from browser DevTools Network tab or curl -I output.
  2. The parser identifies each header name and value, normalizing case and stripping whitespace.
  3. Each header is displayed in a structured table with its parsed value and an explanation of what it does.
  4. Security headers are highlighted with a green (present and strong), yellow (present but weak), or red (missing) indicator.
  5. CORS-related headers are grouped and analyzed for correctness.

Key Features & Specifications

  • Parses raw HTTP header blocks (request or response) into structured name-value tables
  • Explains what each recognized header does with a brief description
  • Security header analysis: grades HSTS, CSP, X-Frame-Options, CORS, and X-Content-Type-Options
  • Cache-Control directive breakdown: parses max-age, no-cache, no-store, must-revalidate, and more
  • Cookie header parsing: splits Set-Cookie into name, value, domain, path, expires, SameSite, and security flags

Frequently Asked Questions (FAQ)

Q:Where can I get HTTP response headers to paste into this tool?
In Chrome: open DevTools (F12) → Network tab → click a request → Headers tab → copy the Response Headers section. With curl: use curl -I https://example.com to fetch headers only, or curl -i to include headers with the response body.
Q:What security headers should every web application have?
At minimum: Strict-Transport-Security (enforce HTTPS), Content-Security-Policy (XSS prevention), X-Content-Type-Options: nosniff (prevent MIME sniffing), X-Frame-Options: DENY or SAMEORIGIN (clickjacking prevention), and Referrer-Policy (control referrer information leakage). Check securityheaders.com for a comprehensive audit.
Q:What does "Access-Control-Allow-Origin: *" mean and is it safe?
This CORS header allows any origin to make cross-site requests to the endpoint, including unauthenticated requests. It is safe for completely public APIs (like a public weather API) but dangerous for authenticated endpoints — using * while also accepting credentials is explicitly blocked by browsers to prevent CSRF.