About the HTTP Header Lookup
HTTP headers are small pieces of information that travel with every web request and response. They say what language the browser prefers, how long a page may be cached, what type of data the body is and much more. This lookup lists 62 common headers, tells you whether each is used in requests, responses or both, and gives a short explanation. Search for a name or a word like cache or cookie. Type a header name or a word and the HTTP headers appears at once, with a few related figures underneath, and you can copy the result with one tap. The sums run in your browser, so nothing you enter is uploaded.
Updated October 2026
How to use the HTTP Header Lookup
- 1Enter a header name or a word.
- 2Pick the units or options from the menus if the HTTP headers tool offers them.
- 3Read the HTTP headers in the large result box.
- 4Look at the extra rows for related figures.
- 5Press Copy result to keep the answer.
When you need the HTTP headers
Web developers use it to debug caching, cookies and cross-origin problems. Security teams use the list of security headers when they review a site, and API designers use it when they define what clients can send.
Headers starting with X- were once the convention for non-standard ones, such as X-Forwarded-For and X-Frame-Options, and many have become standard in other forms. Newer headers such as Permissions-Policy and Cross-Origin-Opener-Policy help to protect pages.
How the HTTP headers is worked out
A header is a name and a value separated by a colon, such as Content-Type: text/html. Request headers come from the client, response headers from the server, and some are used both ways. Content-Type says what kind of data the body holds. Cache-Control sets caching rules such as max-age. Set-Cookie asks the browser to store a cookie. Access-Control-Allow-Origin is the key CORS header. Strict-Transport-Security tells browsers to use HTTPS only.
Every answer on this page comes from that one rule, so you can check any result by hand with a calculator. The figures shown underneath, such as other units, are conversions of the same answer.
- 62 common headers
- Request or response
- Search by word
Mistakes to avoid with HTTP headers
Header names are not case-sensitive, but are written with capital letters by custom. Some headers can be forged by the client, such as X-Forwarded-For, so never trust them for security without checking where they come from. The list is a short reference and not the full specification.
On phone and computer
On a phone, type into the boxes one after another and read the HTTP headers underneath; Copy result puts it on the clipboard for a message or a note. On a computer the inputs sit on the left and the answer on the right, so you can change one figure and watch the HTTP headers move. The http header lookup works the same on both. Requests have other parts. Use HTTP Status Code Lookup for the response codes, MIME Type Lookup for content types, Port Number Lookup for services, and URL Parser to split the address.
Features
- Names are not case-sensitive
- Some headers can be forged
- Security headers protect pages
- Clear messages when the HTTP headers inputs make no sense
- Copy the result with one tap
- Private: nothing is uploaded
Frequently asked questions
How do I calculate HTTP headers?
A header is a name and a value separated by a colon, such as Content-Type: text/html. Request headers come from the client, response headers from the server, and some are used both ways. Content-Type says what kind of data the body holds. Cache-Control sets caching rules such as max-age. Set-Cookie asks the browser to store a cookie. Access-Control-Allow-Origin is the key CORS header. Strict-Transport-Security tells browsers to use HTTPS only.
What is the formula for HTTP headers?
A header is a name and a value separated by a colon, such as Content-Type: text/html. Request headers come from the client, response headers from the server, and some are used both ways. The http header lookup applies it exactly and rounds only the displayed answer to six significant figures.
What is the difference between request and response headers?
Request headers are sent by the client to describe the request. Response headers are sent back by the server.
What does Cache-Control: no-store do?
It tells browsers and caches not to keep a copy of the response.
Why is Referer spelled wrongly?
It was misspelled in the original specification, and the spelling stuck.
Is this http header lookup free and private?
Yes. It is free, needs no account and runs in your browser, so the numbers you type are not uploaded or stored.