HTTP Header Analyzer
Paste one response block only, not a URL or response body. No website is contacted. Use synthetic data: headers may contain cookies or other secrets.
Interpretation, privacy and input limits
This is a bounded local parser and selected-rule guide, not a browser policy engine, complete RFC validator, scanner or site-security grade. Missing, invalid, unknown and present observations are distinct; recommendations depend on response purpose, HTTPS, origins and application requirements. A present policy is not proof it is effective. Confirm deployment behavior separately.
Field names are case-insensitive; repeated fields and colon-containing values are retained in order. Only one response block is accepted. Multiple blocks, continuation lines, response bodies, malformed fields, forbidden controls and invalid Unicode are refused. No combined Set-Cookie interpretation is attempted; paste each cookie as its own Set-Cookie field. Do not infer browser behavior from ambiguous or contradictory fields.
The processing limit is 4096 UTF-16 characters and 128 fields. Ordinary native edits clip before transport at 4098 characters; every oversize edit is refused, never analyzed as a clipped prefix. Refusal clears the input and stale report/Copy. Shorten and re-enter valid text, or Clear. These native bounds do not certify hostile programmatic assignments or all IME behavior.
No payload logging, analytics or persistence is added by this tool. Interactive Auto server events traverse the Blazor connection; WebAssembly executes on-device. Copy explicitly places the complete report, including pasted values, on your clipboard. Treat all output as text. Website active only; extension and Android discovery metadata is inactive, not hard route denial.
HTTP Header Analyzer guide
Inspect pasted HTTP response headers without fetching a website.
Input and limitations
One response-header block, optionally starting with an HTTP status line; up to 4096 UTF-16 characters and 128 fields.
Check the selected options before using the result. Formatting and conversion do not establish that data is safe or suitable for your application.
How to use HTTP Header Analyzer
- Paste response headers, then Analyze headers to inspect caching, CORS, cookies, content type and selected security headers.
- Copy the plain-text report. Repeated headers remain separate; Set-Cookie dates are never comma-split.
- Findings are context-dependent observations, not proof of vulnerability or an overall site-security verdict.
- Clear removes pasted headers, report and errors.
Example
Paste Content-Type: text/plain and Cache-Control: no-store on separate lines, then Analyze headers. The report preserves both fields and provides context-dependent observations without contacting a website.
Privacy on the website
The website uses Blazor Auto: interactive processing can run on the server or in your browser, depending on the current session. Do not assume pasted input stays on your device. Use non-sensitive sample data, and never place passwords, tokens or personal data in page URLs.
Search indexing covers public tool descriptions, not your input or generated output. See the privacy policy for website analytics and other data handling.
Install and offline help
Use your browser's install action, if available. Installation is optional; you can keep using this website normally.
Tools need an internet connection. Offline support provides a connection information page, not all-tools offline use.
Reset keeps favorites and preferences. It does not restore unsaved tool content.