HTTP Header Viewer

Parse and analyze raw HTTP request/response headers.

Read raw HTTP headers as a table

Headers copied from curl -i, a proxy log or the browser network panel arrive as unbroken lines of name: value text. The HTTP Header Viewer splits that text into a two-column table, so that you can scan for a cache policy, a content type or a cookie without squinting at a block of text. It suits both request headers and response headers.

Reading a header block

Paste the headers into Input Data. Start with the status line such as HTTP/1.1 200 OK or the request line, followed by one header per line. Press Sample if you want an HTTP/2 response with a few common headers.
Click Process Now.
The first line appears in a highlighted banner labeled Status/Request. Below it a table with the columns Header Name and Value lists every remaining line.
Check the count shown in the summary row, then use Copy or Download to keep the text, or Clear to start over.

Highlighted headers

Six headers get a light yellow background, because they are the ones people most often look for: content-type, authorization, cache-control, set-cookie, server and access-control-allow-origin. Matching ignores letter case, so Content-Type and content-type are treated the same. Long values, such as tokens and cookie strings, wrap inside their cell instead of stretching the table.

Typical situations

Diagnosing a CORS error by looking for access-control-allow-origin in a response.
Checking whether a CDN response carries the cache-control lifetime you configured.
Confirming which content type and character set an endpoint returns.
Reviewing a header set from a support ticket that was pasted as plain text.

Things to be aware of

Each line is split at its first colon, which keeps colons inside values such as dates or URLs intact. Lines without a colon are skipped, and repeated headers, for example several Set-Cookie lines, are each shown as their own row. The total in the summary counts every line after the first, including blank ones, so treat it as an approximate figure. The viewer does not explain what a header means or flag security problems. It also does not fetch anything: it shows only the text you give it, so it cannot look up the headers of a live URL. Authorization values in your pasted text are displayed as typed, so mask secrets before sharing a screenshot.

Related Articles

Related Tools

Frequently Asked Questions

Can it fetch the headers of a URL for me?

No. It only parses text you paste in. To capture headers from a live site, use curl with the -i flag or your browser's developer tools, then paste the result into the Input Data box.

Which headers are highlighted?

Content-type, authorization, cache-control, set-cookie, server and access-control-allow-origin get a pale yellow background. The comparison ignores capitalization, so lower-case HTTP/2 style names are highlighted as well.

What does the first line of my input become?

It is treated as the request or status line, such as GET /index.html HTTP/1.1 or HTTP/1.1 404 Not Found, and is shown in a banner above the table. If you paste only headers, the first header will land in that banner instead.

How are duplicate headers handled?

Each line becomes its own table row, so repeated headers such as multiple Set-Cookie entries all appear separately. Nothing is merged or reordered, which lets you see exactly what was sent and check each cookie or directive on its own line.

Why does the header count look one too high?

The summary counts every line after the first, including blank lines and lines without a colon. Those are not shown as rows, so the table can have fewer entries than the number in the summary.