About the HTTP Headers Parser
Paste raw HTTP request or response headers — from browser DevTools, curl -I or server logs — and get a readable breakdown with a short explanation of each well-known header. For responses, the parser also points out missing security headers such as Strict-Transport-Security and Content-Security-Policy.
Switch to JSON output to turn the headers into an object, with repeated headers such as Set-Cookie collected into arrays.
How to use it
- Paste headers, one per line (the status line is optional).
- Read the explanations and security notes.
- Toggle JSON output if you need structured data.
Features
- Explains 45+ common headers
- Security header check
- Folded/multi-line header support
- JSON export
Frequently asked questions
How do I see a site's response headers?
Run curl -I https://example.com, or open DevTools → Network, select the request and view Response Headers.
Which security headers should a site send?
At minimum Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff and a Referrer-Policy. X-Frame-Options or CSP frame-ancestors prevent clickjacking.
Is my data uploaded anywhere?
No. All processing happens in JavaScript inside your browser tab. Your input is never sent to a server, logged or stored, so it is safe to use with internal or sensitive data.