Search tools

Find and open any DevTooKit tool. Use arrow keys to navigate.

HTTP Headers Reference

Searchable reference of 70+ HTTP headers (request, response, general). Includes examples and RFC specs. Free online — runs locally, no upload.

74 of 74 HTTP headers

General Headers (9)

Cache-ControlGeneral

Directives for caching mechanisms

no-cache, no-store, must-revalidateRFC 7234
ConnectionGeneral

Control whether the network connection stays open

keep-aliveRFC 7230
DateGeneral

Date and time the message was sent

Wed, 21 Oct 2026 07:28:00 GMTRFC 7231
PragmaGeneral

HTTP/1.0 cache control (legacy)

no-cache
TrailerGeneral

Fields in the trailer of a chunked message

Expires
Transfer-EncodingGeneral

Form of encoding used to safely transfer the body

chunkedRFC 7230
UpgradeGeneral

Ask the server to upgrade to another protocol

websocket
ViaGeneral

Intermediate proxies and gateways

1.1 varnish
WarningGeneral

Additional info about the message's status

199 Miscellaneous warning

Request Headers (29)

AcceptRequest

Media types the client can accept

application/json, text/htmlRFC 7231
Accept-CharsetRequest

Character sets the client accepts

utf-8, iso-8859-1
Accept-EncodingRequest

Content encodings the client accepts

gzip, deflate, brRFC 7231
Accept-LanguageRequest

Preferred natural languages

en-US,en;q=0.9,es;q=0.8RFC 7231
AuthorizationRequest

Credentials for HTTP authentication

Bearer eyJhbGciOi...RFC 7235
CookieRequest

Stored HTTP cookies

session=abc123; theme=darkRFC 6265
DNTRequest

Do Not Track preference

1
ExpectRequest

Expectations the server needs to meet

100-continue
ForwardedRequest

Client info altered by proxies

for=192.0.2.60;proto=https
FromRequest

Email address of the user

user@example.com
HostRequest

Domain name of the server (required in HTTP/1.1)

api.example.comRFC 7230
If-MatchRequest

Make the request conditional on the ETag

"33a64df551425fcc55e4d42a148795d9f25f89d4"
If-Modified-SinceRequest

Make request conditional on modification date

Wed, 21 Oct 2026 07:28:00 GMT
If-None-MatchRequest

Make request conditional on ETag mismatch

W/"67ab43"
If-RangeRequest

Make range request conditional on ETag/date

"33a64df551425fcc55e4d42a148795d9f25f89d4"
If-Unmodified-SinceRequest

Make request conditional on no modification

Wed, 21 Oct 2026 07:28:00 GMT
Max-ForwardsRequest

Limit the number of proxies/loops

5
OriginRequest

Origin of the request (CORS)

https://example.comRFC 6454
Proxy-AuthorizationRequest

Credentials for proxy authentication

Basic dXNlcjpwYXNz
RangeRequest

Request only part of the body

bytes=0-1023
RefererRequest

Address of the previous page

https://example.com/page
TERequest

Transfer encodings the client accepts

trailers, deflate
User-AgentRequest

Client software identity string

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36RFC 7231
X-Forwarded-ForRequest

Client IP address through proxies

203.0.113.195, 70.41.3.18
X-Forwarded-HostRequest

Original Host header through proxy

example.com
X-Forwarded-ProtoRequest

Original protocol through proxy

https
X-Requested-WithRequest

Often used to identify AJAX requests

XMLHttpRequest
X-CSRF-TokenRequest

CSRF protection token

abc123def456
X-API-KeyRequest

API key for authentication

sk_test_123456789

Response Headers (36)

Accept-RangesResponse

Whether the server supports range requests

bytes
Access-Control-Allow-OriginResponse

CORS: which origins may access the resource

https://example.com or *Fetch
Access-Control-Allow-MethodsResponse

CORS: permitted HTTP methods

GET, POST, PUT, DELETE
Access-Control-Allow-HeadersResponse

CORS: permitted request headers

Content-Type, Authorization
Access-Control-Allow-CredentialsResponse

CORS: allow credentials

true
Access-Control-Expose-HeadersResponse

CORS: headers the browser can expose

X-Custom-Header
Access-Control-Max-AgeResponse

CORS: how long to cache preflight results

86400
AllowResponse

Methods the resource supports

GET, POST, HEAD
Content-DispositionResponse

Indicates if content is inline or attachment

attachment; filename="report.pdf"RFC 6266
Content-EncodingResponse

Encoding used on the body

gzipRFC 7231
Content-LanguageResponse

Language of the audience

en-USRFC 7231
Content-LengthResponse

Size of the body in bytes

34851RFC 7230
Content-LocationResponse

Alternate location for the returned data

/docs/data.json
Content-RangeResponse

Where in the full body this partial belongs

bytes 21010-47021/47022
Content-Security-PolicyResponse

CSP: restrict resource loading

default-src 'self'; script-src 'self'CSP3
Content-TypeResponse

Media type of the resource

application/json; charset=utf-8RFC 7231
Cross-Origin-Embedder-PolicyResponse

Controls cross-origin resource loading

require-corp
Cross-Origin-Opener-PolicyResponse

Isolates browsing context group

same-origin
Cross-Origin-Resource-PolicyResponse

Restricts cross-origin resource access

same-site
ETagResponse

Unique identifier for the version

"33a64df551425fcc55e4d42a148795d9f25f89d4"RFC 7232
ExpiresResponse

Date/time after which the response is stale

Wed, 21 Oct 2026 07:28:00 GMT
Last-ModifiedResponse

Date the resource was last modified

Wed, 21 Oct 2026 07:28:00 GMTRFC 7232
LocationResponse

URL to redirect to (3xx responses)

https://example.com/new-pageRFC 7231
Retry-AfterResponse

Seconds to wait before retrying (429/503)

120
ServerResponse

Server software identity

nginx/1.25.3
Set-CookieResponse

Set an HTTP cookie

session=abc123; HttpOnly; Secure; SameSite=StrictRFC 6265
Strict-Transport-SecurityResponse

HSTS: force HTTPS

max-age=31536000; includeSubDomains; preloadRFC 6797
VaryResponse

Headers that determine cached responses

Accept-Encoding, Origin
WWW-AuthenticateResponse

Authentication scheme (401 responses)

Bearer realm="api"RFC 7235
X-Content-Type-OptionsResponse

Prevent MIME-sniffing

nosniff
X-Frame-OptionsResponse

Control framing/clickjacking

DENY
X-Powered-ByResponse

Technology stack (often hidden for security)

Express
X-RateLimit-LimitResponse

Rate limit quota

1000
X-RateLimit-RemainingResponse

Remaining requests in window

999
X-RateLimit-ResetResponse

When the rate limit resets (epoch)

1735689600
X-XSS-ProtectionResponse

Legacy XSS filter (deprecated, use CSP instead)

1; mode=block

About HTTP Headers Reference

HTTP Headers Reference is a local-first reference utility on DevTooKit for everyday headers tasks. Searchable reference of 70+ HTTP headers (request, response, general). Includes examples and RFC specs. DevTooKit keeps headers work on-device and installable as a PWA for offline use. Pair it with neighboring tools instead of hopping across random websites.

What stays local: Lookups and values you reference.

What you can do with HTTP Headers Reference

  • Free online http headers reference — no account required
  • Searchable reference of 70+ HTTP headers (request, response, general). Includes examples and RFC specs
  • Runs locally in your browser (nothing uploaded for processing)
  • Works offline after installing the DevTooKit PWA

How to use HTTP Headers Reference

  1. Open HTTP Headers Reference. Go to the free HTTP Headers Reference page on DevTooKit.
  2. Enter your input. Paste or type your headers data — it stays in this browser tab.
  3. Run the tool. Use HTTP Headers Reference to get results instantly with no server round-trip for processing.
  4. Copy and continue. Copy the output into your editor, PR, or API client as needed.

Privacy

What stays local: Lookups and values you reference. DevTooKit is local-first — no signup wall, no server-side processing for this tool, and no watermark on results.

Related tools

FAQ — HTTP Headers Reference

Privacy, offline use, and how this free online tool works.

Does HTTP Headers Reference upload my data to a server?

No. HTTP Headers Reference runs in your browser. Your input stays on this device and is not sent to DevTooKit for processing.

Is HTTP Headers Reference free?

Yes — free, with no account and no paywall to use the core headers workflow.

Why use HTTP Headers Reference on DevTooKit?

Processing stays local. Fast, free, and grouped with related Reference tools — without sending your data to a third-party server.

Can I use HTTP Headers Reference offline?

Yes after the first visit. Install DevTooKit as a PWA and this tool keeps working without a network connection.

Browse all 91 DevTooKit tools · More reference