Category: Developer tools
HTTP Headers Parser
Parse pasted response headers and spot security and cache headers
Paste raw HTTP response headers — copied from your browser's network panel or a curl -I output — and see them split into a name, value and category, with common security and caching headers highlighted. Parsed entirely in your browser; nothing is fetched over the network.
| Name | Value | Category |
|---|---|---|
Content-Type | text/html; charset=utf-8 | General |
Cache-Control | no-cache, must-revalidate | Cache |
Strict-Transport-Security | max-age=63072000; includeSubDomains | Security |
X-Content-Type-Options | nosniff | Security |
X-Frame-Options | DENY | Security |
ETag | "33a64df551" | Cache |
Server | nginx | General |
Everything on this page is processed in your browser. Nothing is uploaded.
What this tool does
Response headers carry security controls like Strict-Transport-Security and X-Frame-Options, and caching controls like Cache-Control and ETag, mixed in with routine headers like Content-Type and Server. Scanning a raw block of pasted text for the ones that matter is slow, so this tool splits every line into a name and value and flags the headers that affect security or caching.
How to use it
- Copy response headers from your browser's DevTools network panel, or run curl -I against a URL and copy the output.
- Paste the raw text into the input.
- Review the parsed table; security and cache headers are marked separately from general ones.
Privacy
This tool runs entirely in your browser. Your input is never uploaded, stored or shared — closing the tab removes it.
Frequently asked questions
- Does this tool fetch the headers for me?
- No. It only parses text you paste in — it never makes a network request, so it works the same for a private or internal URL as a public one.
- Why is the status line ignored?
- A leading line such as "HTTP/1.1 200 OK" isn't a name/value header, so it's skipped rather than shown as a malformed row.
- Which headers count as security headers here?
- Common ones such as Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and the Cross-Origin-* isolation headers.