HTTP Headers Parser

Raw HTTP headers from curl -I or the Network tab in DevTools look like one solid block of text. This tool breaks it down into individual fields, explains what each header does, and flags common missing security headers.

How to use it

• Paste raw headers (curl -I output, the Headers tab in DevTools, or a copied raw response).
• Each header is parsed out individually with a short explanation of what it means.
• Missing security headers (Content-Security-Policy, X-Content-Type-Options, etc.) are flagged with a warning.

Common uses

• Quickly checking a site's security headers before a release or an audit.
• Understanding an unfamiliar header from a third-party API response without looking it up every time.
• Debugging caching or CORS issues by analyzing the server's response headers.

Things to keep in mind

Header order mostly doesn't matter for HTTP, except in rare cases involving repeated headers of the same type (e.g. multiple Set-Cookie headers).

A missing security header isn't always a mistake — some of them (HSTS, for example) only make sense for HTTPS sites or specific use cases.