HTTP Headers Tool

How to use the HTTP Headers Parser

Paste raw HTTP request or response headers — copied from Chrome DevTools, curl -v, an API client, a proxy log, or a Postman request — and get a clean, normalized header block. Spot duplicates, see cookie attributes, understand cache directives, and normalize casing. For a full CORS check use the CORS Simulator, and for a graded security-header audit the Security Headers Analyzer. Runs locally; headers are never uploaded.

What it does

• Parses raw header text (any line endings, any casing).
• Normalizes header-name casing (Header-Case, lowercase for HTTP/2, or preserve).
• Flags duplicates and recommends how to resolve each group.
• Analyzes cookies — request Cookie pairs and Set-Cookie attributes with Secure / HttpOnly / SameSite warnings.
• Explains Cache-Control — cacheability, freshness, and validators in plain language.
• Flags secret-shaped values (auth headers, tokens) and masks them before copy / share; decode a Bearer JWT in the JWT Decoder.

When to use it

• Compare request headers sent by two clients to find a discrepancy.
• Normalize DevTools-copied headers into a clean, consistent block.
• Spot a duplicate Content-Type or Authorization added by middleware.
• Audit a Set-Cookie response for Secure, HttpOnly, SameSite.
• Understand whether a response is cacheable and for how long.
• For a CORS preflight failure, hand off to the CORS Simulator.

How to use it

1. Copy headers from Chrome DevTools (Network → Headers → "view source") or from curl -v.
2. Paste into the parser — the normalized output renders with a duplicate/diagnostics verdict.
3. Pick a casing style; open the extended tabs for Duplicates, Cookies, and Cache.
4. Use Mask secrets before copying or sharing headers that contain auth/token values.
5. For a full security audit, send to the HTTP Security Headers Analyzer; for code, use the cURL Converter.

Tips & pitfalls

• HTTP header names are case-insensitive (RFC 7230), but some servers, proxies, and SDKs still treat them as case-sensitive — normalize when in doubt.
• Duplicate Content-Type or Authorization from middleware is a common source of mysterious failures.
• A Set-Cookie without Secure and HttpOnly is a security smell.
• Cache-Control: no-store is stricter than no-cache — make sure your intent matches.
• For security scoring of a complete response, use the Security Headers Analyzer.

FAQ

• How do I parse HTTP headers online? Paste the raw header text — the parser produces a normalized header block with a duplicate/diagnostics verdict.
• How do I normalize header casing? Pick the Header case option — Header-Case, lowercase (HTTP/2), or preserve as pasted.
• What is a CORS preflight? An OPTIONS request the browser sends before a "non-simple" cross-origin request, to verify the server allows it — check it in the CORS Simulator.
• Why is my Authorization header missing? Often: lost during a CORS preflight (server didn't include it in Access-Control-Allow-Headers) or stripped by a proxy.
• Are my headers uploaded? No. Parsing runs in your browser; nothing is sent to a server.
• How do I check security headers? Use the HTTP Security Headers Analyzer for a graded audit with CSP, HSTS, cookies, and platform-specific fix snippets.

Runs locally in your browser. No uploads. For a security audit, hand off to the HTTP Security Headers Analyzer.

Inspecting a full request? The API Debugging Studio shows parsed headers alongside the body, JWT decode, and an issue review on a single screen.

Related guides

• Parse HTTP headers