100% Client-Side

HTTP Header Parser

Parse and analyze raw HTTP request or response headers

Free Client-Side No Login No Storage
Loading tool...
JWT Decoder & Inspector Decode and inspect JWT tokens — header, payload, claims at a glance URL Decoder Decode percent-encoded URLs back to readable query strings JSON Formatter & Validator Beautify and validate JSON data — with syntax highlighting and error detection

How to Use the HTTP Header Parser

  1. Paste raw HTTP headers (from curl, dev tools, etc.).
  2. Click Parse to get a structured, numbered breakdown.

Detects HTTP status lines and request lines automatically. Each header is parsed into name-value pairs.

What is HTTP Header Parsing & Security Analysis?

The HTTP Header Parser dissects raw HTTP request and response header text into structured key-value pairs, identifying protocol versions, caching directives, content types, and critical security headers. It audits headers against modern web security standards, highlighting missing defenses such as Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), and X-Frame-Options.

Common Uses

  • Auditing website security headers to harden applications against XSS and clickjacking
  • Debugging HTTP caching directives (`Cache-Control`, `ETag`, `Last-Modified`)
  • Inspecting CORS configuration headers (`Access-Control-Allow-Origin`, `Vary`)
  • Analyzing raw network traces and curl response headers during API development

Frequently Asked Questions

What are the most critical security headers every website needs?

Essential security headers include Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Content-Type-Options: nosniff, X-Frame-Options, and Referrer-Policy.

How does Cache-Control impact API responses?

Directives like `no-store` prevent browsers and proxies from caching sensitive personal data, while `public, max-age=31536000` instructs CDNs and browsers to cache static assets for peak performance.

Can I paste raw curl output directly into this parser?

Yes. The parser recognizes standard HTTP header text blocks copied directly from browser DevTools, curl, Postman, or server logs.

Notes from this implementation

One header per line, including the odd ones

Paste a raw header block. The parser splits on the first colon in each line. Host: example.com is a name and a value. A line without a colon is a request line or a mistake, and it should stay visible rather than being attached to the previous header. HTTP header names are case-insensitive; values are not. Bearer and bearer differ if the server is strict, which many are not, until one is.

Folded header lines (a leading space continuing the previous value) are rare in HTTP/1.1 traffic you see today and illegal in HTTP/2. If you are debugging a capture, do not re-fold them. Watch for Content-Length disagreeing with Transfer-Encoding. That pair is a classic request-smuggling condition, and this page only shows you the fields. It does not send the request.