HTTP Header Parser
Parse a raw header block (or a full HTTP response) live — status badge, headers by category, duplicates, and a security grade with recommendations.
About this ToolHow it works, benefits & use casesTap to collapse
Paste a raw header block — or the full output of curl -i — and this parser breaks it down into something you can actually read. It tolerates CRLF line endings, an optional HTTP status line, and folded headers (continuation lines), and never chokes on stray junk. Each header is identified, described in plain language, and grouped into categories: general, request, response, security, caching, CORS and custom. The tool then runs a security audit: it checks for the headers that matter (HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, plus bonus credit for X-XSS-Protection and Permissions-Policy), assigns a letter grade from A to F with a score, and lists what is missing. Per-header analysis adds targeted hints — a Set-Cookie without Secure/HttpOnly/SameSite, a CSP using unsafe-inline, a leaky Server version, a wildcard CORS origin. Duplicate header names are detected, a colour-coded status badge is shown, and the full parse is exportable as JSON.
How to Use
- 1Paste raw "Name: Value" header lines, or a full HTTP response from curl -i, into the input — or click "Load example".
- 2Click "Parse headers"; a colour-coded status badge appears with header and category counts.
- 3Check the security grade (A–F) and score, and the "Missing security headers" list if any are absent.
- 4Browse the headers grouped by category, reading each one’s description plus any issue (⚠) or recommendation notes.
- 5Copy or share the parsed result as JSON, or pipe it to another tool.
Key Benefits
- Tolerant parsing of CRLF, an optional status line, folded continuation lines and junk
- Headers categorised as general, request, response, security, caching, CORS or custom
- Plain-language description for every recognised header
- Security audit with an A–F grade, a score, and a list of missing critical headers
- Per-header hints: insecure cookies, weak CSP, leaky Server header, wildcard CORS, missing charset
- Duplicate header-name detection and a colour-coded status badge
- Export the full analysis as JSON, with a shareable URL and pipe-to-tool support
Common Use Cases
- Auditing a production response’s security headers and acting on the missing-header list
- Reading a captured curl -i response without manually splitting status, headers and body
- Confirming Set-Cookie carries the Secure, HttpOnly and SameSite flags
- Spotting a wildcard Access-Control-Allow-Origin or an unsafe-inline CSP during review
- Catching accidentally duplicated headers from a misconfigured proxy or middleware
Paste raw `Name: Value` lines, or the full output of `curl -i`.
Was this tool helpful?
Share Your Experience
Help others discover this tool!
Related tools
- JSON FormatterFormat and validate JSON with syntax highlighting
- JSON to TypeScriptGenerate TypeScript interfaces from JSON
- User Agent ParserParse and analyze user agent strings
- Security Headers GeneratorGenerate hardened HTTP security headers with a live A+ to F grade, then export to nginx, Apache, Caddy, Vercel, Netlify, Next.js, Express, or Cloudflare; or audit a site's existing headers
- Words to NumberConvert written words to numbers
- cURL to Code ConverterConvert cURL commands to code in various languages
It scores five required headers — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy — with half-point bonuses for X-XSS-Protection and Permissions-Policy. The percentage maps to a letter: 90%+ is A, 80%+ B, 70%+ C, 60%+ D, and below that F. Missing required headers are listed so you know exactly what to add.
Yes. An optional HTTP/1.x status line on the first non-empty line is recognised and shown as a colour-coded badge (with the HTTP version, code and reason), and the remaining lines are parsed as headers. Pasting raw Name: Value lines without a status line works fine too.