DevCoreTools

HTTP Headers Parser

Paste raw HTTP headers to format, inspect, normalize, and review security or API-related warnings.

Raw HTTP headers

Paste request headers, response headers, or a block with an optional request/status line.

Processed locally in your browser Limit Header text. Your input is processed in your browser and is not uploaded or sent to a server. Avoid pasting production secrets, access tokens, private keys, passwords, or sensitive customer data unless you understand the risk.
0 input charactersEmpty0 headers0 warnings

Structured output

Normalized names, duplicate behavior, categories, warnings, and export formats.

Waiting for inputEmpty
Parsed headers appear here.

Load a sample or paste raw request/response headers to inspect categories, duplicates, sensitive values, and formatted output.

HTTP header parsing guide

Clean up copied browser, API client, proxy, and server header blocks without sending them anywhere.

Request vs response headers

Request blocks can include a method line such as GET /v1/users HTTP/1.1. Response blocks can include a status line such as HTTP/1.1 200 OK.

Duplicate headers

Some repeated headers can be comma-combined, while cookies and authentication challenges should stay as separate lines. The table calls out the safer behavior.

CORS, cache, and content

Headers are grouped into common developer categories so preflight responses, cache directives, content negotiation, and custom API metadata are easier to scan.

Security headers

Browser-facing response headers are checked for common hardening fields like Content Security Policy, HSTS, frame protection, referrer policy, and content-type sniffing protection.

Sensitive values

Authorization, Cookie, Set-Cookie, bearer tokens, basic auth, API keys, sessions, and token-like values are flagged and redacted in structured summaries.

Text-only parsing

The parser never executes header contents, calls an endpoint, validates a live URL, or resolves anything over the network. It only reads the pasted text.

Keep working

View all API & Auth tools
URL Parser / Query String ParserEncoding & DecodingParse full URLs, relative URLs, and query strings into structured parts.cURL to Code ConverterConvert cURL commands into readable HTTP request code snippets locally.HTTP Cookie Parser / BuilderParse and build Cookie and Set-Cookie headers locally with secure attribute warnings.JWT VerifierVerify JWT signatures with a secret or public key and inspect claim checks locally.Base64 Encoder/DecoderEncoding & DecodingEncode and decode Base64 and Base64URL text in your browser.OpenAPI ValidatorValidate OpenAPI and Swagger specs locally with structured errors and warnings.JSON FormatterJSON ToolsFormat, validate, inspect, and export JSON locally.
Learn more: JWT Guide

FAQ

Does this tool send my headers anywhere?

No. It treats the input as local text in your browser and does not make network requests or store pasted values.

Why are some values redacted in JSON output?

Structured summaries redact likely secrets so reports are safer to share. The formatted header block still preserves the raw value for your own controlled copy workflow.

Can I paste a status line or request line?

Yes. The parser recognizes common HTTP request lines and response status lines, then parses the remaining lines as headers.

How are Set-Cookie duplicates handled?

Set-Cookie is intentionally kept as separate entries because comma-combining cookie headers can change behavior.

Does it validate live endpoints or CORS behavior?

No. It only formats and inspects header text. It does not call APIs, fetch URLs, resolve DNS, or test browser behavior against a server.