tool4.dev

HTTP & APIs / LOCAL TOOL

HTTP Header Inspector

Parse raw HTTP request or response headers locally and inspect repeated fields, caching, security, and CORS signals.

Runs locally — input is never uploaded
Paste raw HTTP headers
ResultReady when you are

WHAT IT DOES

Read the headers that shape an HTTP exchange.

Paste a raw HTTP request line, response status line, or header block and get a structured reading of what it contains. The inspector preserves repeated names and original order, accepts CRLF or LF line endings, reports malformed lines explicitly, and groups common caching, negotiation, routing, security, content, cross-origin, and CORS fields without contacting the host.

Why use it?

Use it to understand a copied request or response header block without making another network request or flattening repeated fields.

How to use this tool

  1. Paste the raw header block, optionally including its request or status line, and inspect it.
  2. Review repeated names, malformed lines, and the caching, content, or security sections relevant to your issue.
  3. For example, inspect two Set-Cookie lines as separate entries. Masking in the reading does not redact the original source you pasted, and the presence of a header does not prove the policy is effective.

Details and limitations

  • Request lines such as GET / HTTP/1.1 and response lines such as HTTP/1.1 200 OK are identified before the fields are interpreted.
  • Header names are compared case-insensitively for interpretation but displayed with the spelling and order you pasted.
  • Authorization, Cookie, and Set-Cookie values are masked in the reading so a copied production header block is safer to inspect on screen.
  • Malformed lines, missing separators, and invalid start lines become neutral diagnostics instead of silently disappearing from the result.
  • Interpretation is descriptive: seeing a security or caching header does not mean the server passed a security audit or that a policy is complete.

COMMON QUESTIONS

Header Inspector questions

Can it inspect a response without fetching the URL?
Yes. Paste the response status line and headers you already have. The tool reads that text locally and never makes a request to the host named by a header or URL.
Are repeated headers supported?
Yes. Every valid field line becomes its own entry, even when the name repeats. This preserves information that a normal key-value object would overwrite.
Are credentials shown in the result?
No. Authorization, Cookie, and Set-Cookie values are masked in the structured interpretation. The raw text remains in your input field so you can edit or clear it yourself.