HTTP Response Header Analyzer

How to use HTTP Response Header Analyzer

1. Paste header lines, optionally including an HTTP status line. Remove request credentials that are not needed for your review.
2. Analyze the text and read the advisory checks alongside any unparsed lines.
3. Copy or download the report. Export parsed headers as JSON when another script needs each value, including duplicates.

When to use this tool

Review a copied response-header block while investigating caching, redirects or security headers. The tool analyzes pasted text; it does not fetch or scan the target website.

Header presence is only one part of configuration review

A Content-Security-Policy header can contain a permissive or unsuitable policy. Cache-Control depends on whether the resource is public, private or user-specific. HSTS is meaningful in an HTTPS deployment context. The analyzer reports named settings and explanatory notes; it does not award a security score. JSON export uses arrays so repeated lines, including Set-Cookie, are not incorrectly joined into one value.

Worked example

Content-Type: application/json
Cache-Control: no-store
Set-Cookie: first=1
Set-Cookie: second=2
JSON export keeps two set-cookie values.

Limits and output checks

The tool does not contact the server, inspect TLS or determine which policies a browser actually enforced. It expects ordinary Name: value lines, not a HAR file or all HTTP/2 pseudo-header syntax. Reports and JSON can contain sensitive cookie values; exports are local actions.

Reference: HTTP field semantics.

Continue your workflow

Built by PixelOkay. Report a problem or browse all developer tools. Browser-based tools; API requests, referenced media and optional libraries can contact external hosts.