HTTP Headers Parser
Paste raw HTTP headers and get a clean breakdown with explanations of common headers, security headers, and cookies.
Processed locally in your browser — nothing is uploaded.
HTTP Headers Parser
0 characters
As JSON
Output appears here…About HTTP Headers Parser
Paste headers copied from DevTools, cURL -v output, or a raw HTTP exchange. The parser normalizes them into name-value pairs, explains what well-known headers mean, and exports them as JSON for use in code.
Common uses
- Understand a response's caching behavior at a glance
- Check which security headers a server sends
- Convert copied headers into a JSON object for fetch or Axios
Example
Input
Content-Type: application/json Cache-Control: max-age=3600, public
Output
{
"Content-Type": "application/json",
"Cache-Control": "max-age=3600, public"
}Frequently asked questions
Do the headers I paste here leave my browser?
No. Parsing runs entirely on your device and nothing is uploaded or logged — which matters because pasted headers often include Cookie and Authorization values that are live credentials.
Can I paste curl -v output directly into the parser?
Yes. The > and < direction markers curl adds are stripped automatically, start lines like "HTTP/2 200" or "GET /path HTTP/1.1" are recognized separately, and lines that aren't name: value pairs are skipped with a warning.
Which headers does the tool mark as security headers?
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and the legacy X-XSS-Protection all get a shield marker plus a one-line explanation.
Are HTTP header names case-sensitive?
No. HTTP defines header names as case-insensitive, so Content-Type and content-type are the same header; HTTP/2 and HTTP/3 actually require lowercase names on the wire. The parser matches names case-insensitively but preserves the casing you pasted.
Why are repeated headers joined with commas in the JSON output?
RFC 9110 defines a repeated header as equivalent to one header whose values are joined by commas, so the JSON view combines them that way. Set-Cookie is the well-known exception to that rule, since cookie values can themselves contain commas.