Parse and Build HTTP Headers
Paste raw HTTP headers from browser DevTools, inspect them in a clean grid, detect duplicates, normalise casing, and export as JSON or raw text.
Open HTTP Headers Parser & Builder.
- You are debugging a CORS preflight failure and need to inspect the exact Access-Control headers being sent.
- You need to compare request headers sent by two different clients to find a discrepancy.
- You are building a request snippet and need to transform copied DevTools headers into JSON format for fetch or Axios.
- A proxy is adding duplicate headers and you need to identify which headers appear more than once.
- Copy headers from Chrome DevTools: Network tab → select a request → Headers tab → right-click → Copy all as text.
- Paste the raw headers into the HTTP Headers Parser.
- Review the grid view — duplicate headers are highlighted and you can edit or delete individual entries.
- Export as JSON, as a cURL
-Hflag list, or as normalised raw text.
- HTTP header names are case-insensitive (RFC 7230) but some servers treat them case-sensitively. Use the normalise option to convert to lowercase.
- CORS preflight responses must include both
Access-Control-Allow-OriginandAccess-Control-Allow-Methods— check both are present. - If
Content-Typeappears twice, one copy will silently win — always check for duplicates in proxy and middleware configurations. - Large number of headers from single-page apps may include many tracking and analytics headers — filter them before sharing.
CORS preflight response headers
HTTP/2 204 access-control-allow-origin: https://app.example.com access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS access-control-allow-headers: Authorization, Content-Type, X-Request-ID access-control-max-age: 86400 vary: Origin content-length: 0
{
"access-control-allow-origin": "https://app.example.com",
"access-control-allow-methods": "GET, POST, PUT, DELETE, OPTIONS",
"access-control-allow-headers": "Authorization, Content-Type, X-Request-ID",
"access-control-max-age": "86400",
"vary": "Origin",
"content-length": "0"
}
Open DevTools (F12), go to the Network tab, click any request, and click the Headers tab. Right-click in the headers area and select "Copy all as text", or use the raw headers section at the bottom of the panel.
A duplicate header is when the same name appears more than once. Some headers like Set-Cookie are intentionally duplicated. Others like Content-Type should appear once — duplicates indicate a proxy or middleware bug.
Yes. Export as a JSON object (useful for fetch/Axios), as cURL -H flags, or as normalised raw text. The JSON export can be piped into the JSON Snippet Generator for request code generation.
Privacy-first: runs locally in your browser. No uploads.