API Header Parser

Parse HTTP request and response headers

This API Header Parser turns pasted HTTP header lines into a searchable table and a JSON array. Use it to inspect a response copied from your browser's Network panel, a terminal, or an API debugging session. Each field keeps its original name and value, with a short explanation for common headers.

How to use the API Header Parser

1. Paste one header block into Raw HTTP headers, with one Name: value field per line.
2. Review the live header count, repeated field count, and any input warnings.
3. Search the table for a header name or value, then copy individual values or copy/download the JSON output.

An optional HTTP status line such as HTTP/1.1 202 Accepted or request line such as GET /reports HTTP/1.1 is displayed separately. Leading empty lines are ignored. After the header block starts, an empty line ends parsing so that message content is not mistaken for headers. Paste redirect responses or other separate messages one at a time.

What the parser preserves

Values are split at the first separator colon, so a value such as https://api.example.org/reports/32 stays intact. Spaces and tabs around values are trimmed. Empty values remain empty strings. Header names are compared without regard to case when counting unique names, while their original spelling is retained in the output.

Repeated fields appear as separate objects in the JSON array. This matters for Set-Cookie, which must not be combined into a comma-separated value. The parser also accepts colon-prefixed HTTP/2 and HTTP/3 pseudo-header displays, such as :method: GET. It reads text representations of these fields, not binary HTTP/2 or HTTP/3 frames.

[
  {"name": "Content-Type", "value": "application/json"},
  {"name": "Set-Cookie", "value": "view=compact; Path=/"},
  {"name": "Set-Cookie", "value": "language=fr; Path=/"}
]

Common headers to inspect

• Content-Type: identifies the representation's media type, such as JSON or HTML.
• Cache-Control: describes how browsers and shared caches may store or reuse a response.
• Location: identifies a redirect destination or a newly created resource.
• Authorization and Cookie: carry credentials or session information and should be treated as sensitive.
• Access-Control-Allow-Origin: indicates which origins can read a response under CORS rules.
• Content-Security-Policy: restricts resources that a browser may load.

Parsing runs in your browser. The tool does not fetch a URL, send pasted headers to an API, or save them in query parameters. Remove credentials before sharing copied output. A readable field is not proof of a secure configuration: interpreting cache, authentication, and security behavior requires the request context.

Related API debugging tools

To retrieve headers from a website, use the HTTP Header Checker. Investigate response codes with HTTP Status Codes, or inspect a client identifier with the User Agent Parser.

For protocol details, consult RFC 9110: HTTP Semantics and the MDN HTTP headers reference.