HTTP header parser

Paste headers from your browser's network tab, curl -i or a log. Each header is listed with a plain explanation of what it does, Set-Cookie lines are broken into their attributes, and a short check shows the common security headers that are missing.

Raw headers

Response, 6 headers. HTTP/1.1 200 OK

Content-Type
text/html; charset=utf-8
Media type of the body, optionally with a charset.
Cache-Control
public, max-age=3600
Caching rules: max-age, no-store, no-cache, public, private and more.
Set-Cookie
session=abc123; Path=/; HttpOnly
Asks the browser to store a cookie; each cookie has its own Set-Cookie header.
Cookie session
- Path: /
- HttpOnly: hidden from JavaScript
- Hint: no Secure attribute, so the cookie can be sent over plain HTTP.
- Hint: no SameSite attribute; browsers apply their own default (usually Lax).
Strict-Transport-Security Security header
max-age=31536000; includeSubDomains
HSTS: tells the browser to use only HTTPS for this site for the given max-age.
X-Content-Type-Options Security header
nosniff
With "nosniff", the browser must trust the declared Content-Type instead of guessing.
Server
nginx
Software that produced the response; it can reveal what the server runs.

Security header check (rule of thumb)

This only looks at the headers you pasted and applies common recommendations. It is a hint list, not a security audit, and some headers do not apply to every response (an API, for example).

Runs in your browser: nothing you enter is sent anywhere.

How to use it

Paste the headers into the box. A request or response start line is detected automatically.
Read each header with its explanation. Security headers carry a label.
For responses, check the hints at the bottom for missing security headers.
Use Copy to get the parsed headers as JSON.

How parsing works

Each line is split at the first colon into a name and value. Names must be valid HTTP tokens; other lines are reported with their line number. A line that starts with a space or tab continues the previous header (an obsolete but still seen form). Parsing stops at the first blank line, where the body would begin.

Example

The sample response has a Set-Cookie header without Secure and SameSite, so the cookie hints list both. It lacks a Content-Security-Policy, Referrer-Policy, Permissions-Policy and X-Frame-Options, which are listed as not set, and Server is flagged as revealing the software.

Tips

Repeated headers such as Set-Cookie appear once per line.
Header names are case-insensitive; the explanation matches any capitalisation.

Frequently asked questions

Where do I get the headers to paste?

In browser developer tools open the Network tab, click a request and copy the headers. With curl, run curl -I https://example.com for the response headers or curl -i to include the body. Pasting the first line (HTTP/1.1 200 OK or GET / HTTP/1.1) is optional.

Which security headers does it look for?

Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options (unless the CSP has frame-ancestors), Referrer-Policy and Permissions-Policy. These are common recommendations and the list is labelled as hints, not an audit; an API response may not need all of them.

Why does a header say there is no built-in note?

The tool explains about 60 well-known headers. Custom headers (often starting with X-) and rare ones are still listed, only without an explanation.

What do the Set-Cookie hints mean?

Secure keeps a cookie off plain HTTP, HttpOnly hides it from scripts, and SameSite limits when it is sent on cross-site requests. A missing attribute is only flagged as a hint: the right setting depends on what the cookie is for.

Is anything uploaded?

No. The headers are parsed in your browser.

More in Developer

All tools in this category: Developer ·Updated November 3, 2026